build(deps): bump the all-github-actions group with 22 updates

[dependabot]

Bumps the all-github-actions group with 22 updates:

Package	From	To
actions/github-script	7	9
actions/checkout	4	7
actions/upload-artifact	4	7
actions/setup-dotnet	5.1.0	5.4.0
actions/setup-go	6.2.0	6.5.0
actions/setup-java	5.2.0	5.4.0
actions/setup-node	4	6
actions/download-artifact	4	8
actions/upload-pages-artifact	4.0.0	5.0.0
actions/deploy-pages	4.0.5	5.0.0
lycheeverse/lychee-action	2.1.0	2.8.0
actions/setup-python	6.2.0	6.3.0
amannn/action-semantic-pull-request	5	6
astral-sh/setup-uv	8.2.0	8.3.0
docker/login-action	3.6.0	4.4.0
docker/setup-buildx-action	3.12.0	4.2.0
docker/setup-qemu-action	3.2.0	4.2.0
sigstore/cosign-installer	3.5.0	4.1.2
docker/build-push-action	5.4.0	7.3.0
anchore/sbom-action	0.22.2	0.24.0
softprops/action-gh-release	2.5.0	3.0.1
ruby/setup-ruby	1.288.0	1.316.0

Updates actions/github-script from 7 to 9

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

• getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
• Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

• require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
• getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
• If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

• Add ACTIONS_ORCHESTRATION_ID to user-agent string by @​Copilot in actions/github-script#695
• ci: use deployment: false for integration test environments by @​salmanmkc in actions/github-script#712
• feat!: add getOctokit to script context, upgrade @​actions/github v9, @​octokit/core v7, and related packages by @​salmanmkc in actions/github-script#700

New Contributors

• @​Copilot made their first contribution in actions/github-script#695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v8.0.0

What's Changed

• Update Node.js version support to 24.x by @​salmanmkc in actions/github-script#637
• README for updating actions/github-script from v7 to v8 by @​sneha-krip in actions/github-script#653

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

• @​salmanmkc made their first contribution in actions/github-script#637
• @​sneha-krip made their first contribution in actions/github-script#653

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

• Upgrade husky to v9 by @​benelan in actions/github-script#482
• Add workflow file for publishing releases to immutable action package by @​Jcambass in actions/github-script#485
• Upgrade IA Publish by @​Jcambass in actions/github-script#486
• Fix workflow status badges by @​joshmgross in actions/github-script#497
• Update usage of actions/upload-artifact by @​joshmgross in actions/github-script#512
• Clear up package name confusion by @​joshmgross in actions/github-script#514
• Update dependencies with npm audit fix by @​joshmgross in actions/github-script#515
• Specify that the used script is JavaScript by @​timotk in actions/github-script#478
• chore: Add Dependabot for NPM and Actions by @​nschonni in actions/github-script#472

... (truncated)

Commits

• 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
• ca10bbd fix: use @​octokit/core/types import for v7 compatibility
• 86e48e2 merge: incorporate main branch changes
• c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
• afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
• ff8117e ci: fix user-agent test to handle orchestration ID
• 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
• 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
• c17d55b ci: add getOctokit integration test job
• a047196 test: add getOctokit integration tests via callAsyncFunction
• Additional commits viewable in compare view

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @​ericsciple in actions/checkout#2314
• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327
• Clarify v6 README by @​ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248
• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• v6-beta by @​ericsciple in actions/checkout#2298

... (truncated)

Commits

• 9c091bb update error wording (#2467)
• 1044a6d getting ready for checkout v7 release (#2464)
• f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
• d914b26 upgrade module to esm and update dependencies (#2463)
• 537c7ef Bump @​actions/core and @​actions/tool-cache and Remove uuid (#2459)
• 130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
• 7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
• 0f9f3aa Bump actions/publish-immutable-action (#2458)
• f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
• df4cb1c Update changelog for v6.0.3 (#2446)
• Additional commits viewable in compare view

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in actions/upload-artifact#754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in actions/upload-artifact#762
• Support direct file uploads by @​danwkennedy in actions/upload-artifact#764

New Contributors

• @​Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

• Upload Artifact Node 24 support by @​salmanmkc in actions/upload-artifact#719
• fix: update @​actions/artifact for Node.js 24 punycode deprecation by @​salmanmkc in actions/upload-artifact#744
• prepare release v6.0.0 for Node.js 24 support by @​salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

• Update README.md by @​GhadimiR in actions/upload-artifact#681
• Update README.md by @​nebuk89 in actions/upload-artifact#712
• Readme: spell out the first use of GHES by @​danwkennedy in actions/upload-artifact#727
• Update GHES guidance to include reference to Node 20 version by @​patrikpolyak in actions/upload-artifact#725
• Bump @actions/artifact to v4.0.0
• Prepare v5.0.0 by @​danwkennedy in actions/upload-artifact#734

... (truncated)

Commits

• 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
• 634250c Include changes in typespec/ts-http-runtime 0.3.5
• e454baa Readme: bump all the example versions to v7 (#796)
• 74fad66 Update the readme with direct upload details (#795)
• bbbca2d Support direct file uploads (#764)
• 589182c Upgrade the module to ESM and bump dependencies (#762)
• 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
• 02a8460 Add proxy integration test
• b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
• e516bc8 docs: correct description of Node.js 24 support in README
• Additional commits viewable in compare view

Updates actions/setup-dotnet from 5.1.0 to 5.4.0

Release notes

Sourced from actions/setup-dotnet's releases.

v5.4.0

What's Changed

Enhancements

• Improve global.json SDK version validation for rollForward by @​priyagupta108 in actions/setup-dotnet#742
• Pin actions to commit SHAs in workflows by @​priya-kinthali in actions/setup-dotnet#744
• Expand the CSC problem matcher to light up more errors on GitHub. by @​StephenCleary in actions/setup-dotnet#717

Documentation

• Docs(action): Explicitly mark all optional inputs with required: false by @​kranthipoturaju in actions/setup-dotnet#737

Bug Fixes

• Fix global.json creation command by @​michal2612 in actions/setup-dotnet#694

Dependency Updates

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-dotnet#746

New Contributors

• @​jasongin made their first contribution in actions/setup-dotnet#746
• @​michal2612 made their first contribution in actions/setup-dotnet#694
• @​kranthipoturaju made their first contribution in actions/setup-dotnet#737
• @​StephenCleary made their first contribution in actions/setup-dotnet#717

Full Changelog: actions/setup-dotnet@v5...v5.4.0

v5.3.0

What's Changed

Enhancements

• Add dotnet-version: latest support with dotnet-channel input by @​mahabaleshwars in actions/setup-dotnet#730
• Support global.json's rollForward latest* variants by @​js6pak in actions/setup-dotnet#538
• Improve version resolution by @​akoeplinger in actions/setup-dotnet#560

Dependency Updates

• Upgrade @actions/* and fast-xml-parser dependencies by @​Copilot in actions/setup-dotnet#728
• Update install scripts to v2026.05.19 (preserve archive links) by @​MichaelSimons in actions/setup-dotnet#736
• Add rollForward note in README, improve proxy health check in e2e tests and bump version to v5.3.0 by @​priyagupta108 in actions/setup-dotnet#738

Bug Fixes

• Update Test Proxy job by @​priya-kinthali in actions/setup-dotnet#703

New Contributors

• @​Copilot made their first contribution in actions/setup-dotnet#728
• @​akoeplinger made their first contribution in actions/setup-dotnet#560
• @​MichaelSimons made their first contribution in actions/setup-dotnet#736
• @​js6pak made their first contribution in actions/setup-dotnet#538

... (truncated)

Commits

• 26b0ec1 Expand the CSC problem matcher to light up more errors on GitHub. (#717)
• da5e548 docs(action): explicitly mark all optional inputs with required: false (#737)
• 9bd3b44 Improve readability of global.json creation command (#694)
• 4406a63 Bump @​actions/cache to 5.1.0, log cache write denied (#746)
• dc3262d pin actions to commit SHAs in workflows (#744)
• 95a3f8b Validate global.json SDK version before rollForward optimization (#742)
• 9a946fd Add rollForward note in README, improve proxy health check in e2e tests and b...
• 98af08b Support global.json's rollForward latest* variants (#538)
• 8404272 Update install scripts to v2026.05.19 (#736)
• f1970f5 Don't download releases-index.json to resolve major version (#560)
• Additional commits viewable in compare view

Updates actions/setup-go from 6.2.0 to 6.5.0

Release notes

Sourced from actions/setup-go's releases.

v6.5.0

What's Changed

Dependency update

• Upgrade actions dependencies by @​priyagupta108 with @​Copilot in actions/setup-go#744
• Upgrade @​types/node and typescript-eslint dependencies to resolve npm audit findings by @​HarithaVattikuti in actions/setup-go#755
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-go#758
• Upgrade version to 6.5.0 in package.json and package-lock.json by @​HarithaVattikuti in actions/setup-go#762

New Contributors

• @​priyagupta108 with @​Copilot made their first contribution in actions/setup-go#744
• @​jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

• Add go-download-base-url input for custom Go distributions by @​gdams in actions/setup-go#721

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in actions/setup-go#727

Documentation update

• Rearrange README.md, add advanced-usage.md by @​priyagupta108 in actions/setup-go#724
• Fix Microsoft build of Go link by @​gdams in actions/setup-go#734

New Contributors

• @​gdams made their first contribution in actions/setup-go#721

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

• Update default Go module caching to use go.mod by @​priyagupta108 in actions/setup-go#705
• Fix golang download url to go.dev by @​178inaba in actions/setup-go#469

Full Changelog: actions/setup-go@v6...v6.3.0

Commits

• 924ae3a chore: bump version to 6.5.0 in package.json and package-lock.json (#762)
• e91cc3b Bump @​actions/cache to 5.1.0, log cache write denied (#758)
• 4a2405e chore: update @​types/node and @​typescript-eslint dependencies to latest versi...
• 78961f6 chore: update @​actions dependencies and refresh license cache (#744)
• 4a36011 docs: fix Microsoft build of Go link (#734)
• 8f19afc feat: add go-download-base-url input for custom Go distributions (#721)
• 27fdb26 Bump minimatch from 3.1.2 to 3.1.5 (#727)
• def8c39 Rearrange README.md, add advanced-usage.md (#724)
• 4b73464 Fix golang download url to go.dev (#469)
• a5f9b05 Update default Go module caching to use go.mod (#705)
• See full diff in compare view

Updates actions/setup-java from 5.2.0 to 5.4.0

Release notes

Sourced from actions/setup-java's releases.

v5.4.0

What's Changed

• Bump @​typescript-eslint/parser from 8.48.0 to 8.61.1 by @​dependabot[bot] in actions/setup-java#1021
• Fix codeql workflow permissions by @​jsoref in actions/setup-java#993
• fix CodeQL permissions by @​gdams in actions/setup-java#1025
• fix: reject non-semver candidate versions in isVersionSatisfies by @​sproctor in actions/setup-java#1009
• Bump @​actions/cache to 5.1.0, handle cache write denied by @​jasongin in actions/setup-java#1026
• Add Maven Wrapper cache feature by @​mahabaleshwars in actions/setup-java#1027
• Spelling by @​jsoref in actions/setup-java#713
• add link to advanced configuration for JetBrains by @​robstoll in actions/setup-java#850
• docs(action): fix missing required or default fields by @​kranthipoturaju in actions/setup-java#1007
• feat: add microsoft openjdk 17.0.18 by @​al-kau in actions/setup-java#1002
• Update README.md - use "alert syntax for Markdown" for notes by @​mhoffrog in actions/setup-java#924
• Bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in actions/setup-java#1033
• Update contributor guide with emoji for clarity by @​brunoborges in actions/setup-java#1028
• add javac problem matcher by @​Trass3r in actions/setup-java#562
• Clarify README version syntax and migration guidance by @​brunoborges with @​Copilot in actions/setup-java#1038
• Update undici artifacts to 6.27.0 (license cache + dist) by @​brunoborges in actions/setup-java#1040
• docs: enhance custom jdk file installation by @​stephanabel in actions/setup-java#996
• Templates for new Java distributions by @​panticmilos in actions/setup-java#429
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in actions/setup-java#1032
• Bump @​types/node from 25.9.3 to 26.0.0 by @​dependabot[bot] in actions/setup-java#1031
• docs: replace non-existent HelloWorldApp references with java --version by @​brunoborges with @​Copilot in actions/setup-java#1043
• docs: add JavaFX Maven project configuration instructions by @​brunoborges with @​Copilot in actions/setup-java#1044
• docs: self-signed certificate / internal CA handling for GitHub Enterprise by @​brunoborges in actions/setup-java#1050
• docs: document importing an internal CA into the installed JDK (cacerts) by @​brunoborges in actions/setup-java#1051
• chore: Harden workflows: least-privilege permissions + zizmor integration by @​brunoborges in actions/setup-java#1039
• dist: Add GraalVM Community distribution support by @​brunoborges with @​Copilot in actions/setup-java#1042
• docs: note jdkfile approach for Early Access / unreleased JDK builds by @​brunoborges in actions/setup-java#1058
• dist: Apply Copilot review suggestions from PR #1042 (GraalVM Community) by @​brunoborges in actions/setup-java#1059

New Contributors

• @​jsoref made their first contribution in actions/setup-java#993
• @​sproctor made their first contribution in actions/setup-java#1009
• @​jasongin made their first contribution in actions/setup-java#1026
• @​robstoll made their first contribution in actions/setup-java#850
• @​kranthipoturaju made their first contribution in actions/setup-java#1007
• @​al-kau made their first contribution in actions/setup-java#1002
• @​mhoffrog made their first contribution in actions/setup-java#924
• @​brunoborges made their first contribution in actions/setup-java#1028
• @​Trass3r made their first contribution in actions/setup-java#562
• @​stephanabel made their first contribution in actions/setup-java#996

Full Changelog: actions/setup-java@v5...v5.4.0

v5.3.0

What's Changed

• chore: update Java version to 25 in setup examples by @​alaahong in actions/setup-java#969
• Bump minimatch from 3.1.2 to 3.1.5 by @​dependabot[bot] in actions/setup-java#984
• Refactor error handling and improve test logging for installers by @​chiranjib-swain in actions/setup-java#989

... (truncated)

Commits

• 1bcf9fb dist: Address Copilot review suggestions from PR #1042 (GraalVM Community) (#...
• fa2c650 docs: note jdkfile approach for Early Access / unreleased JDK builds (#1058)
• 1d56e31 dist: Add GraalVM Community distribution support (#1042)
• 1d25252 chore: Harden workflows: least-privilege permissions + zizmor integration (#1...
• 668c1ea docs: add post-install keytool import for the JDK cacerts trust store (#1051)
• a9a46fb docs: document self-signed certificate / internal CA handling for GitHub Ente...
• 5431e71 docs: add JavaFX Maven project configuration instructions (#1044)
• 4baa9b4 docs: replace non-existent HelloWorldApp references with java --version (#1043)
• eab4b08 Bump @​types/node from 25.9.3 to 26.0.0 (#1031)
• bf0c0e6 Bump actions/checkout from 6 to 7 (#1032)
• Additional commits viewable in compare view

Updates actions/setup-node from 4 to 6

Release notes

Sourced from actions/setup-node's releases.

v6.0.0

What's Changed

Breaking Changes

• Limit automatic caching to npm, update workflows and documentation by @​priyagupta108 in actions/setup-node#1374

Dependency Upgrades

• Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @​dependabot[bot] in #1336
• Upgrade prettier from 2.8.8 to 3.6.2 by @​dependabot[bot] in #1334
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @​dependabot[bot] in #1362

Full Changelog: actions/setup-node@v5...v6.0.0

v5.0.0

What's Changed

Breaking Changes

• Enhance caching in setup-node with automatic package manager detection by @​priya-kinthali in actions/setup-node#1348

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

• Upgrade action to use node24 by @​salmanmkc in actions/setup-node#1325

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

• Upgrade @​octokit/request-error and @​actions/github by @​dependabot[bot] in actions/setup-node#1227
• Upgrade uuid from 9.0.1 to 11.1.0 by @​dependabot[bot] in actions/setup-node#1273
• Upgrade undici from 5.28.5 to 5.29.0 by @​dependabot[bot] in actions/setup-node#1295
• Upgrade form-data to bring in fix for critical vulnerability by @​gowridurgad in actions/setup-node#1332
• Upgrade actions/checkout from 4 to 5 by @​dependabot[bot] in actions/setup-node#1345

New Contributors

• @​priya-kinthali made their first contribution in actions/setup-node#1348
• @​salmanmkc made their first contribution in actions/setup-node#1325

Full Changelog: actions/setup-node@v4...v5.0.0

v4.4.0

... (truncated)

Commits

• 48b55a0 Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)
• ab72c7e Upgrade @​actions dependencies (#1525)
• 53b8394 Bump minimatch from 3.1.2 to 3.1.5 (#1498)
• 54045ab Scope test lockfiles by package manager and update cache tests (#1495)
• c882bff Replace uuid with crypto.randomUUID() (#1378)
• 774c1d6 feat(node-version-file): support parsing devEngines field (#1283)
• efcb663 fix: remove hardcoded bearer (#1467)
• d02c89d Fix npm audit issues (#1491)
• 6044e13 Docs: bump actions/checkout from v5 to v6 (#1468)
• 8e49463 Fix README typo (#1226)
• Additional commits viewable in compare view

Updates actions/download-artifact from 4 to 8

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Don't ...

  Description has been truncated

[github-actions]

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 321e2d3

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.82%	98.82%	➡️ +0.00%
Statements	98.76%	98.76%	➡️ +0.00%
Functions	99.72%	99.72%	➡️ +0.00%
Branches	95.19%	95.15%	📉 -0.04%

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml