From 7105ecf249fa341aa7e46a11a69abd561cb8abec Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 06:18:49 +0000 Subject: [PATCH 1/2] build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.1. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4.6.2...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/doofus-external-trial-stage.yml | 2 +- .github/workflows/doofus-external-trial.yml | 2 +- .github/workflows/ui.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/doofus-external-trial-stage.yml b/.github/workflows/doofus-external-trial-stage.yml index 03e66e5e..f2ff622d 100644 --- a/.github/workflows/doofus-external-trial-stage.yml +++ b/.github/workflows/doofus-external-trial-stage.yml @@ -92,7 +92,7 @@ jobs: --downloaded-asset "$downloaded" - name: Upload exact canonical request artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: doofus-external-trial-request-v1 path: ${{ runner.temp }}/doofus-stage/doofus-external-trial-request.json diff --git a/.github/workflows/doofus-external-trial.yml b/.github/workflows/doofus-external-trial.yml index 83675453..59a37145 100644 --- a/.github/workflows/doofus-external-trial.yml +++ b/.github/workflows/doofus-external-trial.yml @@ -374,7 +374,7 @@ jobs: echo "receipt_artifact_name=$name" >> "$GITHUB_OUTPUT" - name: Upload durable public-safe receipt subjects - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ steps.names.outputs.receipt_artifact_name }} path: ${{ runner.temp }}/doofus-trial-output/public diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml index ec03616a..d528eaf5 100644 --- a/.github/workflows/ui.yml +++ b/.github/workflows/ui.yml @@ -144,7 +144,7 @@ jobs: # supplied: path" -- which lands last in the log and buries the real # error. Guard on the variable so an early failure reports itself. if: failure() && env.DUMBMONEY_NATIVE_SMOKE_FAILURE_GLOB != '' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dumbmoney-native-smoke-failure-${{ github.run_id }}-${{ github.run_attempt }} path: ${{ env.DUMBMONEY_NATIVE_SMOKE_FAILURE_GLOB }} @@ -340,7 +340,7 @@ jobs: ${{ env.DUMBMONEY_PUBLIC_SETUP }} ${{ env.DUMBMONEY_PUBLIC_MANIFEST }} - name: Upload only protected public release payload - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dumbmoney-windows-protected-setup-${{ github.sha }} path: | From 6b9053a8e8277f78171b6883f9fdc73f3883b864 Mon Sep 17 00:00:00 2001 From: cjharriskc-ai Date: Wed, 5 Aug 2026 02:43:20 -0500 Subject: [PATCH 2/2] Rotate the pinned upload-artifact digest Dependabot cannot reach Two test files pin the exact commit SHA of every trusted action. Dependabot edits the workflow and never the test, so the bump is unmergeable by construction until the pin is rotated by hand: tests/test_doofus_external_trial_workflow.py:58 tests/test_doofus_external_trial_stage_workflow.py:66 Resolved from the upstream tag ref rather than the pull request title: gh api repos/actions/upload-artifact/git/ref/tags/v7.0.1 -> 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a which matches what the workflows now carry. A tag is mutable and a digest is not; taking the SHA from a title would defeat the point of pinning one. Grepped repo-wide for the old v4.6.2 digest afterwards -- no stragglers, and every `upload-artifact@` usage across the three workflows is now on the one SHA. Same class as #67; that one needed the same rotation for download-artifact. Co-Authored-By: Claude Opus 5 --- tests/test_doofus_external_trial_stage_workflow.py | 2 +- tests/test_doofus_external_trial_workflow.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_doofus_external_trial_stage_workflow.py b/tests/test_doofus_external_trial_stage_workflow.py index 1d0e6dfc..6759d413 100644 --- a/tests/test_doofus_external_trial_stage_workflow.py +++ b/tests/test_doofus_external_trial_stage_workflow.py @@ -63,7 +63,7 @@ def test_stage_workflow_upload_is_exact_short_lived_and_commit_pinned() -> None: in uses ) assert ( - "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02" + "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" in uses ) assert "name: doofus-external-trial-request-v1" in text diff --git a/tests/test_doofus_external_trial_workflow.py b/tests/test_doofus_external_trial_workflow.py index 055c95cb..6fc199e8 100644 --- a/tests/test_doofus_external_trial_workflow.py +++ b/tests/test_doofus_external_trial_workflow.py @@ -55,7 +55,7 @@ def test_workflow_actions_are_commit_pinned_and_permissions_are_minimal() -> Non in uses ) assert ( - "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02" + "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" in uses ) assert (