From e325fafa288a9401b5f63e11dad74a9f7278d595 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 10:11:34 +0000 Subject: [PATCH 1/2] build(deps): bump actions/download-artifact from 5.0.0 to 8.0.1 Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 5.0.0 to 8.0.1. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v5...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/doofus-external-trial.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/doofus-external-trial.yml b/.github/workflows/doofus-external-trial.yml index 6628b1e2..83675453 100644 --- a/.github/workflows/doofus-external-trial.yml +++ b/.github/workflows/doofus-external-trial.yml @@ -406,7 +406,7 @@ jobs: ref: ${{ github.workflow_sha }} - name: Download durable receipt subjects - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ needs.external-trial.outputs.receipt_artifact_name }} path: ${{ runner.temp }}/doofus-trial-public @@ -492,7 +492,7 @@ jobs: ref: ${{ github.workflow_sha }} - name: Download attested public receipt subjects - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ needs.external-trial.outputs.receipt_artifact_name }} path: ${{ runner.temp }}/doofus-trial-public From 207cb921412367e8a052efb24679a52743e4bd73 Mon Sep 17 00:00:00 2001 From: cjharriskc-ai Date: Tue, 4 Aug 2026 23:07:04 -0500 Subject: [PATCH 2/2] Rotate the pinned download-artifact digest Dependabot cannot reach `tests/test_doofus_external_trial_workflow.py` pins the exact commit SHA of every trusted action. Dependabot can edit the workflow but never the test, so an action bump is unmergeable by construction until the pin is rotated by hand. workflow actions/download-artifact@3e5f45b2... # v8.0.1 test actions/download-artifact@634f93cb... # v5.0.0 Resolved from the upstream tag ref rather than trusting the label: gh api repos/actions/download-artifact/git/ref/tags/v8.0.1 -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c which matches what the workflow now uses. A tag is mutable and a digest is not; taking the digest from the PR title would defeat the point of pinning one. Grepped repo-wide for the old digest afterwards -- no stragglers. The three `download-artifact@` usages across `doofus-external-trial.yml` and `nimrod-external-witness.yml` are all on the new SHA. Co-Authored-By: Claude Opus 5 --- tests/test_doofus_external_trial_workflow.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_doofus_external_trial_workflow.py b/tests/test_doofus_external_trial_workflow.py index c52fc7ef..055c95cb 100644 --- a/tests/test_doofus_external_trial_workflow.py +++ b/tests/test_doofus_external_trial_workflow.py @@ -59,7 +59,7 @@ def test_workflow_actions_are_commit_pinned_and_permissions_are_minimal() -> Non in uses ) assert ( - "actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0" + "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" in uses ) assert "actions: read" in text