build(deps): bump actions/upload-artifact from 4 to 7#149
build(deps): bump actions/upload-artifact from 4 to 7#149dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
📝 WalkthroughWalkthroughThe pull request updates the GitHub Actions workflow to use ChangesGitHub Actions Artifact Upload Version Bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Review rate limit: 9/10 reviews remaining, refill in 6 minutes. Comment |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/build.yml (1)
207-207: ⚡ Quick winPin
actions/upload-artifactto a commit SHA for supply-chain hardening.Lines 207, 219, and 231 use floating tag refs (
@v7) while most other actions are SHA-pinned. Replace these three with the exact commit:actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0afor consistency and tamper resistance.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build.yml at line 207, Replace the floating tag usages of the GitHub Action "actions/upload-artifact@v7" with the exact commit SHA "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" wherever it appears (the occurrences shown in the diff), i.e., update each "uses: actions/upload-artifact@v7" entry to the SHA-pinned ref to ensure supply-chain hardening and consistency with other actions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/build.yml:
- Line 207: Replace the floating tag usages of the GitHub Action
"actions/upload-artifact@v7" with the exact commit SHA
"actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" wherever it
appears (the occurrences shown in the diff), i.e., update each "uses:
actions/upload-artifact@v7" entry to the SHA-pinned ref to ensure supply-chain
hardening and consistency with other actions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5f7566c7-e8d9-40dc-87eb-4c6fbbd41988
📒 Files selected for processing (1)
.github/workflows/build.yml
Bumps actions/upload-artifact from 4 to 7.
Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit