From 26fe9336b7cdfd6a558d5b58504f17048035e8d1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 18:05:09 +0000 Subject: [PATCH 1/3] chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.1. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/hol-plugin-scanner.yml | 2 +- .github/workflows/npm-publish.yml | 2 +- .github/workflows/tests.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/hol-plugin-scanner.yml b/.github/workflows/hol-plugin-scanner.yml index f3aec5e..d1de336 100644 --- a/.github/workflows/hol-plugin-scanner.yml +++ b/.github/workflows/hol-plugin-scanner.yml @@ -30,7 +30,7 @@ jobs: run: node scripts/sarif-coordinates.js plugin-scanner.sarif - name: Upload failed scanner report if: failure() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: hol-plugin-scanner-sarif path: plugin-scanner.sarif diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 475c8e5..d959e64 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -33,7 +33,7 @@ jobs: - name: Build npm package run: npm pack --pack-destination dist/npm - name: Upload verified package - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: npm-package path: dist/npm/*.tgz diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 59f8459..d801a19 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -66,7 +66,7 @@ jobs: - name: Collect five Claude and five Codex fixture journeys run: node scripts/golden-path-matrix.js --fixture scripts/fixtures/golden-path/minimal-node.json --runtime both --repeat 5 --output artifacts/golden-path-matrix-${{ matrix.slug }}.json - name: Upload platform evidence - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: golden-path-${{ matrix.slug }} path: artifacts/golden-path-matrix-${{ matrix.slug }}.json @@ -91,7 +91,7 @@ jobs: - name: Enforce the complete 30-run grid run: node scripts/golden-path-matrix.js --merge artifacts/golden-path-matrix-windows.json,artifacts/golden-path-matrix-linux.json,artifacts/golden-path-matrix-macos.json --output artifacts/golden-path-matrix-complete.json --require-complete - name: Upload complete matrix - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: golden-path-complete path: artifacts/golden-path-matrix-complete.json From 27d60a48f28b63be0e3c8c63e058ccda189d5a40 Mon Sep 17 00:00:00 2001 From: Seth Gammon Date: Thu, 16 Jul 2026 15:41:31 -0400 Subject: [PATCH 2/3] test(ci): update upload-artifact workflow contract --- scripts/test-golden-path-matrix.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/test-golden-path-matrix.js b/scripts/test-golden-path-matrix.js index 7f332a5..2c69a6e 100644 --- a/scripts/test-golden-path-matrix.js +++ b/scripts/test-golden-path-matrix.js @@ -155,7 +155,7 @@ function main() { 'os: macos-latest', 'os: windows-latest', '--runtime both --repeat 5', - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02', + 'actions/upload-artifact@043fb46b3e08840d1a31c89e569d025350d76ea5', 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093', '--require-complete', ]) assert(workflow.includes(expected), `tests workflow must include ${expected}`); From 313d25e3465d1e68679257dfaff8aede0fd5c423 Mon Sep 17 00:00:00 2001 From: Seth Gammon Date: Thu, 16 Jul 2026 15:43:27 -0400 Subject: [PATCH 3/3] fix(ci): match upload-artifact workflow pin --- scripts/test-golden-path-matrix.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/test-golden-path-matrix.js b/scripts/test-golden-path-matrix.js index 2c69a6e..196d091 100644 --- a/scripts/test-golden-path-matrix.js +++ b/scripts/test-golden-path-matrix.js @@ -155,7 +155,7 @@ function main() { 'os: macos-latest', 'os: windows-latest', '--runtime both --repeat 5', - 'actions/upload-artifact@043fb46b3e08840d1a31c89e569d025350d76ea5', + 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093', '--require-complete', ]) assert(workflow.includes(expected), `tests workflow must include ${expected}`);