Skip to content

chore(deps): update github artifact actions (major) - #222

Merged
chgl merged 1 commit into
masterfrom
renovate/major-github-artifact-actions
Mar 7, 2026
Merged

chgl merged 1 commit into
masterfrom
renovate/major-github-artifact-actions

Conversation

@renovate

@renovate renovate Bot commented Mar 2, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
actions/download-artifact action major v7.0.0 → v8.0.0
actions/upload-artifact action major v6.0.0 → v7.0.0

Release Notes

actions/download-artifact (actions/download-artifact)

v8.0.0

Compare Source

v8 - What's new
Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to false.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @​actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

actions/upload-artifact (actions/upload-artifact)

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0


Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented Mar 2, 2026 •

Copy link
Copy Markdown
Contributor

✅MegaLinter analysis: Success

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 4 0 0 0.08s
✅ COPYPASTE jscpd yes no no 1.25s
✅ DOCKERFILE hadolint 1 0 0 0.06s
✅ JSON jsonlint 3 0 0 0.08s
✅ JSON prettier 3 0 0 1.13s
✅ JSON v8r 3 0 0 2.65s
✅ MARKDOWN markdownlint 1 0 0 0.5s
✅ MARKDOWN markdown-table-formatter 1 0 0 0.21s
✅ PYTHON bandit 1 0 0 2.4s
✅ PYTHON black 1 0 0 0.88s
✅ PYTHON flake8 1 0 0 0.65s
✅ PYTHON isort 1 0 0 0.27s
✅ PYTHON mypy 1 0 0 3.16s
✅ PYTHON pylint 1 0 0 2.72s
✅ PYTHON pyright 1 0 0 1.63s
✅ PYTHON ruff 1 0 0 0.03s
✅ REPOSITORY checkov yes no no 25.33s
✅ REPOSITORY dustilock yes no no 0.01s
✅ REPOSITORY gitleaks yes no no 0.26s
✅ REPOSITORY git_diff yes no no 0.01s
✅ REPOSITORY grype yes no no 43.5s
✅ REPOSITORY kics yes no no 4.0s
✅ REPOSITORY kingfisher yes no no 6.54s
✅ REPOSITORY secretlint yes no no 1.19s
✅ REPOSITORY syft yes no no 2.41s
✅ REPOSITORY trivy yes no no 11.24s
✅ REPOSITORY trivy-sbom yes no no 0.14s
✅ REPOSITORY trufflehog yes no no 4.92s
✅ YAML prettier 6 0 0 0.69s
✅ YAML v8r 6 0 0 5.8s
✅ YAML yamllint 6 0 0 0.99s

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.4.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_BANDIT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,COPYPASTE_JSCPD,DOCKERFILE_HADOLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_DUSTILOCK,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_KICS,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

@renovate
renovate Bot force-pushed the renovate/major-github-artifact-actions branch from 9fb4645 to ca6b434 Compare March 7, 2026 17:51
@github-actions

github-actions Bot commented Mar 7, 2026

Copy link
Copy Markdown
Contributor

Trivy image scan report

ghcr.io/chgl/github-reusable-workflow-without-test-image:pr-222 (debian 13.3)

No Vulnerabilities found

No Misconfigurations found

Python

1 known vulnerabilities found (CRITICAL: 0 HIGH: 0 MEDIUM: 0 LOW: 1)

Show detailed table of vulnerabilities
Package ID Severity Installed Version Fixed Version
pip CVE-2026-1703 LOW 25.3 26.0

No Misconfigurations found

@github-actions

github-actions Bot commented Mar 7, 2026

Copy link
Copy Markdown
Contributor

Trivy image scan report

ghcr.io/chgl/github-reusable-workflow-with-fixed-image-tags:v1.2.3-beta.123 (debian 13.3)

No Vulnerabilities found

No Misconfigurations found

Python

1 known vulnerabilities found (LOW: 1 CRITICAL: 0 HIGH: 0 MEDIUM: 0)

Show detailed table of vulnerabilities
Package ID Severity Installed Version Fixed Version
pip CVE-2026-1703 LOW 25.3 26.0

No Misconfigurations found

@github-actions

github-actions Bot commented Mar 7, 2026

Copy link
Copy Markdown
Contributor

Trivy image scan report

ghcr.io/chgl/github-reusable-workflow:pr-222 (debian 13.3)

No Vulnerabilities found

No Misconfigurations found

Python

1 known vulnerabilities found (HIGH: 0 MEDIUM: 0 LOW: 1 CRITICAL: 0)

Show detailed table of vulnerabilities
Package ID Severity Installed Version Fixed Version
pip CVE-2026-1703 LOW 25.3 26.0

No Misconfigurations found

@chgl
chgl merged commit c047f31 into master Mar 7, 2026
41 checks passed
@chgl
chgl deleted the renovate/major-github-artifact-actions branch March 7, 2026 17:56
@github-actions

github-actions Bot commented Mar 7, 2026

Copy link
Copy Markdown
Contributor

🎉 This PR is included in version 1.11.16 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant