chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 - #1221
Conversation
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.1. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4.6.2...v7.0.1) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
github_actions
burtenshaw
added
enhancement
Cursor
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
TL;DR: Low-risk CI dependency bump (actions/upload-artifact → v7.0.1) across 3 workflow files. No principle/invariant/RFC conflicts, and the one notable compatibility question (upload v7 vs. download v8) checks out. One optional supply-chain hardening suggestion on the two publish workflows.
Automated Checks
- Lint (
.claude/hooks/lint.sh): FAIL, but not attributable to this PR. The hook reports 56 pre-existing files needing formatting undersrc//tests//envs/(e.g. agrid_worldmatplotlib block). This PR changes only 3.github/workflows/*.ymlfiles, which are outside the hook's Python scope, so it introduces zero lint findings. (uvwas not preinstalled in this env; I installed it to run the hook.) - Debug code (
.claude/hooks/check-debug.sh): CLEAN for this PR. Flaggedprint()/TODOlines all live in pre-existingsrc/modules (mcp_client.py,import_env.py, etc.); none are in the changed files.
Open RFCs Context
RFCs 000–012 are all In Review or Draft — covering environment abstractions, env spec, MCP, rubrics, agentic harnesses, auto-validation, catalog discovery (RFC 011 → discovery-catalog.yml), and capture providers. None govern CI/release action versions. This bump doesn't touch the RFC 011 discovery contract, only the action that uploads the catalog artifact. No RFC conflict.
Tier 1: Fixes Required
- None introduced by this PR. The YAML changes are valid single-line ref bumps; the lint/debug failures above are pre-existing and unrelated.
Compatibility Check (verified — no action needed)
upload-artifact@v7↔download-artifact@v8are intentionally compatible (released together 2026-02-26): v7 addsarchive: falsedirect uploads and v8 detects/handles non-ZIP downloads. The publish workflows upload withv7and download withv8downstream — a supported pairing.- Upload steps use only
name/path(noarchive/overwrite), so v7's additivearchiveparam and the v4 artifact-immutability change don't affect them; artifact names are unique per run. - All three workflows run on
ubuntu-latest, so v7's ESM migration is transparent. - SHA
043fb46d…is consistent with thev7.0.1tag per Dependabot's annotation.
Tier 2: Alignment Discussion
Principle Conflicts
None identified. CI-only change — no product code, API surface, client/server boundary, reward computation, or MCP tooling touched.
RFC Conflicts
None identified.
Recommendation (non-blocking)
ALIGNMENT FLAG: Publish workflows use a mutable tag instead of a SHA pin
- Principle/policy at stake: Supply-chain hardening (repo precedent:
hf-security-analysis[bot]SHA-pinneddiscovery-catalog.ymlin #1161) - The concern:
publish-pypi.yml:101andpublish-testpypi.yml:116useactions/upload-artifact@v7.0.1(a movable tag), whilediscovery-catalog.yml:51uses the immutable SHA043fb46d… # v7.0.1. Since these two workflows publish distributions to (Test)PyPI, pinning them to the same SHA is safer and more consistent. This is not a regression (the base already used a floating@v7; Dependabot preserves each occurrence's existing style, SHA→SHA and tag→tag), so it's a maintainer call rather than a blocker. - Suggested reviewer: @burtenshaw (last human editor / owner of the publish workflows)
Summary
- 0 mechanical issues introduced by this PR (lint/debug failures are pre-existing and unrelated).
- 1 non-blocking recommendation (SHA-pin the two publish workflows) for human review.
- 0 principle / invariant / RFC conflicts.
Sent by Cursor Automation: Pre-review
|
|
||
| - name: Upload release distribution artifact | ||
| uses: actions/upload-artifact@v7 | ||
| uses: actions/upload-artifact@v7.0.1 |
There was a problem hiding this comment.
Optional supply-chain hardening (non-blocking). This is a movable tag. The sibling discovery-catalog.yml pins the same action to an immutable SHA — a convention hf-security-analysis[bot] applied when hardening workflows in #1161. Since this workflow publishes distributions to PyPI, consider matching that SHA pin:
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1Not a regression — the base already used @v7, and Dependabot keeps tag refs as tags. This is a maintainer preference call.
|
|
||
| - name: Upload TestPyPI distribution artifact | ||
| uses: actions/upload-artifact@v7 | ||
| uses: actions/upload-artifact@v7.0.1 |
There was a problem hiding this comment.
Optional supply-chain hardening (non-blocking). Same note as publish-pypi.yml: this is a movable tag, whereas discovery-catalog.yml SHA-pins the same action. For a workflow that publishes to TestPyPI, consider pinning to the immutable SHA for consistency and supply-chain safety:
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1| SOURCE_OWNER: ${{ github.repository_owner }} | ||
| SOURCE_REVISION: ${{ github.sha }} | ||
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | ||
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
There was a problem hiding this comment.
SHA-pin convention correctly preserved here (matches the hardening from #1161). Verified: 043fb46d… corresponds to v7.0.1, and upload-artifact@v7 is compatible with the download-artifact@v8 used elsewhere in the release workflows (released together — v7 adds archive: false direct uploads, v8 handles non-ZIP downloads). No changes needed.
…ifact-7.0.1 Co-authored-by: benjamin.burtenshaw <benjamin.burtenshaw@huggingface.co>
There was a problem hiding this comment.
APPROVE at 48a767dd (refreshed onto main 6f67fbb7).
Pin verification
actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a resolves to the official v7.0.1 tag. The moving v7 tag currently resolves to that same commit, so the @v7 -> @v7.0.1 edits in publish-pypi.yml and publish-testpypi.yml are a no-op today and only remove the risk of the release pipeline silently picking up a future v7.0.x.
Major bump in discovery-catalog.yml (v4.6.2 -> v7.0.1)
No cross-action compatibility concern: openenv-catalog-${{ github.sha }} is uploaded for inspection and is never consumed by download-artifact in any workflow, so the v4/v5 artifact-backend split does not apply. if-no-files-found: error is still a supported input. The snapshot job that performs this upload ran green on the exact head, so v7.0.1 executed live rather than being inferred.
Release impact
Workflow-only; no wheel or sdist input changes. The 0.6.0 candidate will exercise publish-testpypi.yml with this pin end-to-end (build -> upload-artifact@v7.0.1 -> download-artifact@v8 -> publish -> install verification) before Thursday's production publish, so the changed publish path gets a real run rather than an assumption.
All 13 exact-head checks are green and the branch is up to date with main.
Sent by Cursor Automation: Release
…/pr-1221 fix(ci): harden GitHub Actions workflows (#1221)
OpenEnv 0.6.0 Breaking change - `--llm-endpoint` / OpenAIClient now take a full base URL; the implicit port 8000 is gone. `http://localhost` means port 80; use `http://localhost:8000` or `--llm-port 8000` for the old behavior (#1189, landed via #1237). New - NovitaSandboxProvider: run an OpenEnv server in a Novita AI sandbox over wss://, from a registry image or a local Dockerfile; install with `pip install openenv[novita]` (#1191). - RFC 008 Level 2 validation building blocks: manifest-v2, report-v2 and runtime-plan schemas, the severity-v2 policy, and DockerValidationProvider (#1178, #1179). The `openenv validate` CLI is unchanged in this release. Fixes - A failed `new_session()` no longer leaves the provider's container or sandbox running (#1145). Repository and environment images (not in the wheel) - coding_env `additional_imports` now extends the default safe-import allowlist (#1147). - Environment lockfile security updates: anyio 4.14.2 and soupsieve 2.9.2 (#1196, #1197, #1201, #1202). - CI hardening: per-job GITHUB_TOKEN scopes and SHA-pinned actions (#1221, #1223, #1225, #1226, #1228, #1239, #1240); validation-lab toolchain pins (#1229, #1230, #1231); docs navigation and Miles integration docs (#1219, #1220). Known, accepted for this release: Novita provider debt (unbraced $ARG ordering in Dockerfile flattening, a tbench2 example readiness leak); fixes follow in #1235. Validated: exact-head CI 13/13 on 0034202; TestPyPI 0.6.0.dev141 (run 35854754769) byte-identical to the release wheel apart from Version; clean wheel/sdist install, CLI, and Echo reset/step smoke.
2 participants
Bumps actions/upload-artifact from 4.6.2 to 7.0.1.
Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
CI-only workflow pin updates for artifact upload; v7 may require newer GitHub-hosted runners (Node 24 from v6+), but upload inputs are unchanged.
Overview
Updates actions/upload-artifact to v7.0.1 everywhere build outputs are stored in CI.
In discovery-catalog.yml, the upload step moves from the v4.6.2 commit pin to the v7.0.1 commit pin. In publish-pypi.yml and publish-testpypi.yml, the tag is tightened from
@v7to@v7.0.1for the same action. Artifact names, paths, andif-no-files-foundbehavior are unchanged.This is a Dependabot-style dependency bump only; no application or packaging logic changes.
Reviewed by Cursor Bugbot for commit 48a767d. Bugbot is set up for automated code reviews on this repo. Configure here.