ci(github-action)!: Update action actions/upload-artifact (v4.6.2 → v7.0.1) - #493
Conversation
![its-saffron[bot]](https://avatars.githubusercontent.com/in/3901073?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
There was a problem hiding this comment.
AI Automated Review
Full PR review.
Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)
PR Review: Update actions/upload-artifact v4 → v7
Recommendation: Approve
This is a routine dependency update from the Renovate bot. The change pins actions/upload-artifact from @v4 to @v7.0.1 via full SHA in .github/workflows/eval-harness.yaml. The diff is minimal (+1/-1 lines) and has passed CI validation.
Change Analysis
| Aspect | Finding |
|---|---|
| File modified | .github/workflows/eval-harness.yaml |
| Change scope | Single action version pin: v4 → v7.0.1 |
| SHA pin | 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a (correctly resolves to v7.0.1) |
| CI Status | ✅ validate check passed |
Version Jump Assessment (v4 → v7)
The major version bump (v4 → v7) spans three intermediate major versions. Key changes:
- v5 → v6: Requires Node.js 24; minimum runner version 2.327.1. The eval-harness workflow uses
ubuntu-latestwhich satisfies this. - v6 → v7: ESM upgrade; new
archive: falseinput for direct (unzipped) uploads.
Compatibility check for eval-harness.yaml usage:
The workflow uses the action with standard inputs only:
uses: actions/upload-artifact@v7
with:
name: eval-report
path: eval-report/eval-report.jsonThe name and path inputs are stable across all v4–v7 versions. The new archive: false option is opt-in and not used here, so no behavioral changes affect this workflow.
Security Considerations
| Check | Status |
|---|---|
| Full SHA pin | ✅ Present (043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) |
| Commit matches tagged release | ✅ SHA verified against v7.0.1 release |
| No untrusted inputs | ✅ No user-controlled parameters affected |
Repository Standards Compliance
This PR follows standard practices for GitHub Actions dependency updates:
- Uses full commit SHA pin (security best practice)
- Comments the version for human readability
- Single-purpose change with minimal blast radius
- CI validation has passed
Linked Sources Verification
The GitHub compare metadata and release enrichment confirm:
- v7.0.1 is a real release (published 2026-04-10)
- No breaking changes to the inputs used in eval-harness.yaml
- v7...v7.0.1 are identical (v7.0.1 is a no-op patch on v7.0.0 tag)
Unknowns / Needs Verification
None identified. The PR is straightforward with complete context available.
Verdict: This is a safe, low-risk dependency update that follows best practices. No blockers.
1 participant
This PR contains the following updates:
v4→v7Release Notes
actions/upload-artifact (actions/upload-artifact)
v7.0.1Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v7...v7.0.1
v7.0.0Compare Source
v7 What's new
Direct Uploads
Adds support for uploading single files directly (unzipped). Callers can set the new
archiveparameter tofalseto skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. Thenameparameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.ESM
To support new versions of the
@actions/*packages, we've upgraded the package to ESM.What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v6...v7.0.0
v7Compare Source
v6.0.0Compare Source
v6 - What's new
Node.js 24
This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.
What's Changed
Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0
v6Compare Source
v5.0.0Compare Source
What's Changed
BREAKING CHANGE: this update supports Node
v24.x. This is not a breaking change per-se but we're treating it as such.@actions/artifacttov4.0.0v5.0.0by @danwkennedy in #734New Contributors
Full Changelog: actions/upload-artifact@v4...v5.0.0
v5Compare Source
Configuration
📅 Schedule: (in timezone America/Edmonton)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.