build(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2

.github/workflows/nightly-recovery.yml

@@ -306,7 +306,7 @@ jobs:
         with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json}
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with: {pattern: nightly-recovery-build-*, path: candidate, merge-multiple: true}
       - name: Assemble exact nightly manifest
         run: |
@@ -399,9 +399,9 @@ jobs:
         with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json}
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with: {name: nightly-recovery-candidate, path: candidate}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with: {name: nightly-recovery-plan, path: retained-plan}
       - id: app-token-read
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
@@ -450,7 +450,7 @@ jobs:
         with: {name: nightly-orphan-recovery-intent, path: nightly-orphan-recovery-intent.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: nightly-orphan-recovery-intent.json}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with: {name: nightly-orphan-recovery-intent, path: retained-intent}
       - run: |
           cmp nightly-orphan-recovery-intent.json retained-intent/nightly-orphan-recovery-intent.json
@@ -505,7 +505,7 @@ jobs:
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         if: inputs.operation == 'replace-unpublished-draft'
         with: {subject-path: nightly-deletion-receipt.json}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: inputs.operation == 'replace-unpublished-draft'
         with: {name: nightly-deletion-receipt, path: retained-receipt}
       - name: Retrieve deletion receipt before recreation

.github/workflows/nightly.yml

@@ -161,7 +161,7 @@ jobs:
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: nightly-*
           path: nightly-assets
@@ -203,7 +203,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: nightly-release-candidate
           path: nightly-assets
@@ -261,9 +261,9 @@ jobs:
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with: {name: nightly-release-candidate, path: nightly-assets}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with: {name: nightly-publication-intent}
       - name: Final read-only state validation
         shell: bash
@@ -301,7 +301,7 @@ jobs:
         with: {name: nightly-tag-creation-receipt, path: nightly-tag-receipt.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: nightly-tag-receipt.json}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with: {name: nightly-tag-creation-receipt, path: retained-tag-receipt}
       # recover-orphan-tag proofs must stop before this POST succeeds. Cooperative
       # `gh run cancel` can still create the draft; force-cancel after tag+receipt.

.github/workflows/release-recovery.yml

@@ -233,7 +233,7 @@ jobs:
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: official-recovery-build-*
           path: release-source/target/distrib
@@ -391,9 +391,9 @@ jobs:
         with: {node-version: 24.20.0, cache: npm, cache-dependency-path: tools/release-please-policy/package-lock.json}
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with: {name: official-recovery-candidate, path: candidate}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with: {name: official-recovery-plan, path: retained-plan}
       - id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
@@ -447,7 +447,7 @@ jobs:
         with: {name: official-recovery-intent, path: official-recovery-intent.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: official-recovery-intent.json}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with: {name: official-recovery-intent, path: retained-intent}
       - name: Retrieve and authenticate pre-mutation intent
         run: |
@@ -487,7 +487,7 @@ jobs:
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         if: inputs.operation == 'replace-unpublished-assets' && steps.preflight.outputs.delete_count != '0'
         with: {subject-path: official-recovery-delete-receipt.json}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: inputs.operation == 'replace-unpublished-assets' && steps.preflight.outputs.delete_count != '0'
         with: {name: official-recovery-delete-receipt, path: retained-receipt}
       - name: Retrieve and authenticate deletion receipt

.github/workflows/release.yml

@@ -143,7 +143,7 @@ jobs:
         run: bash scripts/install-pinned-dist.sh
       # Get the dist-manifest
       - name: Fetch local artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -219,14 +219,14 @@ jobs:
           persist-credentials: false
           submodules: recursive
       - name: Install cached dist
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
       - run: chmod +x ~/.cargo/bin/dist
       # Get all the local artifacts for the global tasks to use (for e.g. checksums)
       - name: Fetch local artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -268,7 +268,7 @@ jobs:
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: artifacts-build-*
           path: target/distrib/
@@ -328,7 +328,7 @@ jobs:
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: pr-upload-proof-candidate
           path: pr-upload-proof
@@ -365,12 +365,12 @@ jobs:
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
       - run: chmod +x ~/.cargo/bin/dist
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -452,7 +452,7 @@ jobs:
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: official-release-candidate
           path: release-assets
@@ -487,7 +487,7 @@ jobs:
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: official-release-candidate
           path: release-assets

dist-workspace.toml

@@ -33,7 +33,7 @@ x86_64-pc-windows-msvc = "windows-2025"
 [dist.github-action-commits]
 "actions/checkout" = "3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
 "actions/upload-artifact" = "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-"actions/download-artifact" = "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8.0.1
+"actions/download-artifact" = "9000827ccba6bdab643e8b6fd33ac0654aef8333" # v8.0.2
 "actions/attest-build-provenance" = "4d101475d8b20a2381f78447822ac1eab6504dd8" # v4.2.2
 "actions/attest" = "1e69f48acb82d1966a394da916b4c1698aa569d6" # v4.2.2
 "actions/setup-node" = "820762786026740c76f36085b0efc47a31fe5020" # v7.0.0

tools/release-please-policy/patch-dist-workflow.mjs

@@ -183,7 +183,7 @@ source = source.slice(0, hostStart) + `  # Assemble the complete non-publishable
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: artifacts-build-*
           path: target/distrib/
@@ -243,7 +243,7 @@ source = source.slice(0, hostStart) + `  # Assemble the complete non-publishable
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: pr-upload-proof-candidate
           path: pr-upload-proof
@@ -280,12 +280,12 @@ source = source.slice(0, hostStart) + `  # Assemble the complete non-publishable
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
       - run: chmod +x ~/.cargo/bin/dist
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: artifacts-*
           path: target/distrib/
@@ -367,7 +367,7 @@ source = source.slice(0, hostStart) + `  # Assemble the complete non-publishable
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: official-release-candidate
           path: release-assets
@@ -402,7 +402,7 @@ source = source.slice(0, hostStart) + `  # Assemble the complete non-publishable
           cache-dependency-path: tools/release-please-policy/package-lock.json
       - run: npm ci --omit=dev --ignore-scripts --no-audit --no-fund
         working-directory: tools/release-please-policy
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: official-release-candidate
           path: release-assets

tools/release-tooling.json

@@ -20,7 +20,7 @@
     "checkout": "3d3c42e5aac5ba805825da76410c181273ba90b1",
     "setupNode": "820762786026740c76f36085b0efc47a31fe5020",
     "uploadArtifact": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
-    "downloadArtifact": "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c",
+    "downloadArtifact": "9000827ccba6bdab643e8b6fd33ac0654aef8333",
     "attest": "1e69f48acb82d1966a394da916b4c1698aa569d6",
     "attestBuildProvenance": "4d101475d8b20a2381f78447822ac1eab6504dd8",
     "createGitHubAppAction": "bcd2ba49218906704ab6c1aa796996da409d3eb1",