From 55df277f0822955a23cdf2f89bbe4e322807f634 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 19:24:32 +0000 Subject: [PATCH 1/2] build(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.1 to 8.0.2. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/nightly-recovery.yml | 10 +++++----- .github/workflows/nightly.yml | 10 +++++----- .github/workflows/release-recovery.yml | 10 +++++----- .github/workflows/release.yml | 18 +++++++++--------- 4 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/workflows/nightly-recovery.yml b/.github/workflows/nightly-recovery.yml index b5f7d6b..26cf899 100644 --- a/.github/workflows/nightly-recovery.yml +++ b/.github/workflows/nightly-recovery.yml @@ -306,7 +306,7 @@ jobs: with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json} - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {pattern: nightly-recovery-build-*, path: candidate, merge-multiple: true} - name: Assemble exact nightly manifest run: | @@ -399,9 +399,9 @@ jobs: with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json} - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: nightly-recovery-candidate, path: candidate} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: nightly-recovery-plan, path: retained-plan} - id: app-token-read uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 @@ -450,7 +450,7 @@ jobs: with: {name: nightly-orphan-recovery-intent, path: nightly-orphan-recovery-intent.json, retention-days: 90, if-no-files-found: error} - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: {subject-path: nightly-orphan-recovery-intent.json} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: nightly-orphan-recovery-intent, path: retained-intent} - run: | cmp nightly-orphan-recovery-intent.json retained-intent/nightly-orphan-recovery-intent.json @@ -505,7 +505,7 @@ jobs: - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 if: inputs.operation == 'replace-unpublished-draft' with: {subject-path: nightly-deletion-receipt.json} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 if: inputs.operation == 'replace-unpublished-draft' with: {name: nightly-deletion-receipt, path: retained-receipt} - name: Retrieve deletion receipt before recreation diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 8ea5af0..3e58ea8 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -161,7 +161,7 @@ jobs: cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: nightly-* path: nightly-assets @@ -203,7 +203,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: nightly-release-candidate path: nightly-assets @@ -261,9 +261,9 @@ jobs: cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: nightly-release-candidate, path: nightly-assets} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: nightly-publication-intent} - name: Final read-only state validation shell: bash @@ -301,7 +301,7 @@ jobs: with: {name: nightly-tag-creation-receipt, path: nightly-tag-receipt.json, retention-days: 90, if-no-files-found: error} - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: {subject-path: nightly-tag-receipt.json} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: nightly-tag-creation-receipt, path: retained-tag-receipt} # recover-orphan-tag proofs must stop before this POST succeeds. Cooperative # `gh run cancel` can still create the draft; force-cancel after tag+receipt. diff --git a/.github/workflows/release-recovery.yml b/.github/workflows/release-recovery.yml index 263c559..b9ab9f5 100644 --- a/.github/workflows/release-recovery.yml +++ b/.github/workflows/release-recovery.yml @@ -233,7 +233,7 @@ jobs: cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: official-recovery-build-* path: release-source/target/distrib @@ -391,9 +391,9 @@ jobs: with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json} - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: official-recovery-candidate, path: candidate} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: official-recovery-plan, path: retained-plan} - id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 @@ -447,7 +447,7 @@ jobs: with: {name: official-recovery-intent, path: official-recovery-intent.json, retention-days: 90, if-no-files-found: error} - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: {subject-path: official-recovery-intent.json} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: official-recovery-intent, path: retained-intent} - name: Retrieve and authenticate pre-mutation intent run: | @@ -487,7 +487,7 @@ jobs: - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 if: inputs.operation == 'replace-unpublished-assets' && steps.preflight.outputs.delete_count != '0' with: {subject-path: official-recovery-delete-receipt.json} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 if: inputs.operation == 'replace-unpublished-assets' && steps.preflight.outputs.delete_count != '0' with: {name: official-recovery-delete-receipt, path: retained-receipt} - name: Retrieve and authenticate deletion receipt diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 613ea0e..8f859ea 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -143,7 +143,7 @@ jobs: run: bash scripts/install-pinned-dist.sh # Get the dist-manifest - name: Fetch local artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: pattern: artifacts-* path: target/distrib/ @@ -219,14 +219,14 @@ jobs: persist-credentials: false submodules: recursive - name: Install cached dist - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: cargo-dist-cache path: ~/.cargo/bin/ - run: chmod +x ~/.cargo/bin/dist # Get all the local artifacts for the global tasks to use (for e.g. checksums) - name: Fetch local artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: pattern: artifacts-* path: target/distrib/ @@ -268,7 +268,7 @@ jobs: cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: artifacts-build-* path: target/distrib/ @@ -328,7 +328,7 @@ jobs: cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: pr-upload-proof-candidate path: pr-upload-proof @@ -365,12 +365,12 @@ jobs: cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: cargo-dist-cache path: ~/.cargo/bin/ - run: chmod +x ~/.cargo/bin/dist - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: artifacts-* path: target/distrib/ @@ -452,7 +452,7 @@ jobs: cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: official-release-candidate path: release-assets @@ -487,7 +487,7 @@ jobs: cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: official-release-candidate path: release-assets From b0e953378afa66abdfc671dd713803fec2e6febb Mon Sep 17 00:00:00 2001 From: jatmn <12479882+jatmn@users.noreply.github.com> Date: Sun, 18 Oct 2026 21:01:25 +0000 Subject: [PATCH 2/2] build(deps): synchronize download-artifact pin sources Register the v8.0.2 SHA in the approved Action registry, cargo-dist configuration, and release overlay so the workflow bump survives generation and validation. Keep the existing release-policy and byte-comparison gates intact. --- dist-workspace.toml | 2 +- tools/release-please-policy/patch-dist-workflow.mjs | 12 ++++++------ tools/release-tooling.json | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/dist-workspace.toml b/dist-workspace.toml index 5079732..e529817 100644 --- a/dist-workspace.toml +++ b/dist-workspace.toml @@ -33,7 +33,7 @@ x86_64-pc-windows-msvc = "windows-2025" [dist.github-action-commits] "actions/checkout" = "3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1 "actions/upload-artifact" = "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1 -"actions/download-artifact" = "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8.0.1 +"actions/download-artifact" = "9000827ccba6bdab643e8b6fd33ac0654aef8333" # v8.0.2 "actions/attest-build-provenance" = "4d101475d8b20a2381f78447822ac1eab6504dd8" # v4.2.2 "actions/attest" = "1e69f48acb82d1966a394da916b4c1698aa569d6" # v4.2.2 "actions/setup-node" = "820762786026740c76f36085b0efc47a31fe5020" # v7.0.0 diff --git a/tools/release-please-policy/patch-dist-workflow.mjs b/tools/release-please-policy/patch-dist-workflow.mjs index b300785..8f4561b 100644 --- a/tools/release-please-policy/patch-dist-workflow.mjs +++ b/tools/release-please-policy/patch-dist-workflow.mjs @@ -183,7 +183,7 @@ source = source.slice(0, hostStart) + ` # Assemble the complete non-publishable cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: artifacts-build-* path: target/distrib/ @@ -243,7 +243,7 @@ source = source.slice(0, hostStart) + ` # Assemble the complete non-publishable cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: pr-upload-proof-candidate path: pr-upload-proof @@ -280,12 +280,12 @@ source = source.slice(0, hostStart) + ` # Assemble the complete non-publishable cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: cargo-dist-cache path: ~/.cargo/bin/ - run: chmod +x ~/.cargo/bin/dist - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: artifacts-* path: target/distrib/ @@ -367,7 +367,7 @@ source = source.slice(0, hostStart) + ` # Assemble the complete non-publishable cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: official-release-candidate path: release-assets @@ -402,7 +402,7 @@ source = source.slice(0, hostStart) + ` # Assemble the complete non-publishable cache-dependency-path: tools/release-please-policy/package-lock.json - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund working-directory: tools/release-please-policy - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: official-release-candidate path: release-assets diff --git a/tools/release-tooling.json b/tools/release-tooling.json index 849fa99..2188dc3 100644 --- a/tools/release-tooling.json +++ b/tools/release-tooling.json @@ -20,7 +20,7 @@ "checkout": "3d3c42e5aac5ba805825da76410c181273ba90b1", "setupNode": "820762786026740c76f36085b0efc47a31fe5020", "uploadArtifact": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a", - "downloadArtifact": "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c", + "downloadArtifact": "9000827ccba6bdab643e8b6fd33ac0654aef8333", "attest": "1e69f48acb82d1966a394da916b4c1698aa569d6", "attestBuildProvenance": "4d101475d8b20a2381f78447822ac1eab6504dd8", "createGitHubAppAction": "bcd2ba49218906704ab6c1aa796996da409d3eb1",