Repository navigation
chore(deps): Bump actions/download-artifact from 4 to 8 - #23
Conversation
dependabot
Bot
added
dependencies
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 8. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v4...v8) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
86e936e to
fa92c58
Compare
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| - name: Download image artifact | ||
| uses: actions/download-artifact@v4 | ||
| uses: actions/download-artifact@v8 |
There was a problem hiding this comment.
MEDIUM (Security Scan): actions/download-artifact is an external action referenced by the mutable major tag @v8. If that tag is moved, the workflow could execute a different action revision with the job's permissions.
Suggestion: Pin the action to a verified full commit SHA, optionally retaining v8 in a comment for readability.
Evidence:
uses: actions/download-artifact@v8
There was a problem hiding this comment.
not a bug: the fleet references actions/* at the major tag deliberately. Constitution XV rule 2 requires a Dependabot update path for the github-actions ecosystem and rule 4 auto-merges green minor/patch bumps — both of which need a moving semver tag, not a SHA. Every workflow in the org reads actions/checkout@v7 the same way. This PR does not introduce the pattern; it moves an existing @v4 reference to @v8 and leaves the pinning style alone. Switching the fleet to SHA pins is a constitution change, not a change to this Dependabot PR.
| steps: | ||
| - name: Download image artifact | ||
| uses: actions/download-artifact@v4 | ||
| uses: actions/download-artifact@v8 |
There was a problem hiding this comment.
MEDIUM (Security Scan): actions/download-artifact is an external action referenced by the mutable major tag @v8. If that tag is moved, the workflow could execute a different action revision with the job's permissions.
Suggestion: Pin the action to a verified full commit SHA, optionally retaining v8 in a comment for readability.
Evidence:
uses: actions/download-artifact@v8
There was a problem hiding this comment.
not a bug: the fleet references actions/* at the major tag deliberately. Constitution XV rule 2 requires a Dependabot update path for the github-actions ecosystem and rule 4 auto-merges green minor/patch bumps — both of which need a moving semver tag, not a SHA. Every workflow in the org reads actions/checkout@v7 the same way. This PR does not introduce the pattern; it moves an existing @v4 reference to @v8 and leaves the pinning style alone. Switching the fleet to SHA pins is a constitution change, not a change to this Dependabot PR.
| # merely started from the same commit. | ||
| - name: Download image artifact | ||
| uses: actions/download-artifact@v4 | ||
| uses: actions/download-artifact@v8 |
There was a problem hiding this comment.
MEDIUM (Security Scan): actions/download-artifact is an external action referenced by the mutable major tag @v8. If that tag is moved, the workflow could execute a different action revision with the job's permissions.
Suggestion: Pin the action to a verified full commit SHA, optionally retaining v8 in a comment for readability.
Evidence:
uses: actions/download-artifact@v8
There was a problem hiding this comment.
not a bug: the fleet references actions/* at the major tag deliberately. Constitution XV rule 2 requires a Dependabot update path for the github-actions ecosystem and rule 4 auto-merges green minor/patch bumps — both of which need a moving semver tag, not a SHA. Every workflow in the org reads actions/checkout@v7 the same way. This PR does not introduce the pattern; it moves an existing @v4 reference to @v8 and leaves the pinning style alone. Switching the fleet to SHA pins is a constitution change, not a change to this Dependabot PR.
Bumps actions/download-artifact from 4 to 8.
Release notes
Sourced from actions/download-artifact's releases.
... (truncated)
Commits
9000827Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2e455989Prepare download-artifact v8.0.2a00b90cMerge pull request #492 from actions/tunc-d-download-artifact-package-bump29bb7ceUpdate@actions/artifactto 6.3.1484a0b5Update the readme (#473)3e5f45bAdd regression tests for CJK characters (#471)e6d03f6Add a regression test for artifact name + content-type mismatches (#472)70fc10cMerge pull request #461 from actions/danwkennedy/digest-mismatch-behaviorf258da9Add change docsccc058eFix linting issues