build(deps): bump actions/download-artifact to v8.0.2

[qnbs]

User description

Summary

• Update every actions/download-artifact reference in ci.yml, mutation.yml, and tauri-build.yml from v8.0.1 to v8.0.2, pinned to immutable commit 9000827ccba6bdab643e8b6fd33ac0654aef8333.
• This is the narrow current-main successor for Dependabot PR build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 #1051, whose original checks were against an older main base.

Upstream and workflow review

• GitHub reports the target commit's signature as verified; the official v8.0.2 release is non-draft/non-prerelease and was published 2026-10-07.
• The upstream patch release improves download retries for HTTP 429 and valid Retry-After headers and updates @actions/artifact to 6.3.1. The action runtime remains Node 24, matching the pinned v8.0.1 action.
• All three repository references were enumerated and updated; no sibling uses: path remains on the old SHA.

Validation

• Local frozen dependency reconcile, signing doctor, outgoing signature/attribution checks, PR budget, and ci:prepush passed on this exact one-commit branch. The local gate failed closed to full admission (AMBIGUOUS) and all local checks passed.
• Full hosted CI, CodeQL/security, reviewer governance, and independent review are required on this exact head before merge.

Summary by Sourcery

Update artifact downloads to the verified v8.0.2 action release across CI workflows.

CI:

• Update all GitHub Actions workflows to use the immutable v8.0.2 release of actions/download-artifact.
• Adopt the upstream patch release with improved retry handling for rate-limited artifact downloads.

---

Summary by cubic

Bumps actions/download-artifact from v8.0.1 to v8.0.2 in all three workflows, pinned to the verified v8.0.2 release commit. The patch improves download retries for HTTP 429 responses with valid Retry-After headers and updates @actions/artifact to 6.3.1.

^{Written for commit 20dfe03. Summary will update on new commits.}

---

CodeAnt-AI Description

Make CI artifact downloads more reliable during rate limits

What Changed

• CI, mutation-report, and release workflows use an updated artifact downloader that retries rate-limited downloads.

Impact

✅ Fewer CI failures from artifact download rate limits
✅ More reliable browser test runs
✅ More reliable release bundle assembly

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• Chores
  • Updated the pinned artifact download action used in CI, mutation testing, and release workflows.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR makes a narrow dependency-only update by replacing every pinned actions/download-artifact v8.0.1 reference with the verified immutable v8.0.2 commit in three GitHub Actions workflows, without changing artifact handling configuration. Local checks passed, while full hosted CI and security/review gates remain required.

File-Level Changes

Change	Details	Files
Upgrade all artifact-download workflow references to the verified, immutable v8.0.2 commit.	Replace the previous v8.0.1 commit SHA with the v8.0.2 SHA. Apply the update consistently across build, mutation-testing, and Tauri artifact download jobs. Preserve existing artifact names, patterns, paths, and workflow behavior.	.github/workflows/ci.yml .github/workflows/mutation.yml .github/workflows/tauri-build.yml
Validate the dependency update and document release and review safeguards.	Confirm the upstream release signature, version status, Node 24 runtime, retry improvements, and artifact-library update. Verify no repository references remain on the old SHA. Record successful local validation while requiring hosted CI, security, governance, and independent review before merge.	.github/workflows/ci.yml .github/workflows/mutation.yml .github/workflows/tauri-build.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
worldscript-studio	Ready	Preview	Oct 17, 2026 10:18am UTC

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	20dfe03	Oct 17, 2026 · 10:18	10:23

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T10:19:30.577511Z	20dfe03	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codescene-access]

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[codeant-ai]

🏁 CodeAnt Quality Gate Results

Commit: 20dfe033
Scan Time: 2026-10-17 10:23:37 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found
Duplicate Code	✅ PASSED	0.0% duplicated
SAST	✅ PASSED	No security issues
Bugs	✅ PASSED	Rating S: No bugs
IAC	✅ PASSED	Rating B: 1 issues (1 medium)

View Full Results

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: qnbs/WorldScript-Studio/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: ef4c867e-78f3-4de0-acb4-0fee6c1a3cfa

📥 Commits

Reviewing files that changed from the base of the PR and between a710b39 and 20dfe03.

📒 Files selected for processing: 3

• .github/workflows/ci.yml
• .github/workflows/mutation.yml
• .github/workflows/tauri-build.yml

Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

📝 Walkthrough

Three GitHub Actions workflows update the pinned commit for actions/download-artifact. The action remains at version v8, and the CI workflow keeps its existing artifact name and destination.

Changes: Artifact download action pins

Layer / File(s)	Summary
Update workflow action pins .github/workflows/ci.yml, .github/workflows/mutation.yml, .github/workflows/tauri-build.yml	The CI, mutation, and release workflows use updated commit pins for actions/download-artifact. The action remains at v8.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 20dfe

The workflows retain their artifact selection and extraction behavior with the v8.0.2 update, so no actionable merge risk is evident. Merge remains subject to the required hosted checks passing on this head.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Approved.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[codeant-ai]

CodeAnt PR Risk: Low Risk

• The PR appears safe to merge; it only updates the pinned commit for actions/download-artifact while keeping the v8 version label unchanged.

Assessed commit: 20dfe033e5de