chore(deps): update github artifact actions (major) by renovate[bot] · Pull Request #3442 · semaphoreui/semaphore

renovate · 2025-11-09T22:25:01Z

This PR contains the following updates:

Package	Type	Update	Change
actions/download-artifact	action	major	`v4` → `v8`
actions/upload-artifact	action	major	`v4` → `v7`

Release Notes

actions/download-artifact (actions/download-artifact)

`v8.0.1`

Compare Source

What's Changed

Support for CJK characters in the artifact name by @danwkennedy in #471
Add a regression test for artifact name + content-type mismatches by @danwkennedy in #472

Full Changelog: actions/download-artifact@v8...v8.0.1

`v8.0.0`

Compare Source

v8 - What's new

[!IMPORTANT]
actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT]
Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Don't attempt to un-zip non-zipped downloads by @danwkennedy in #460
Add a setting to specify what to do on hash mismatch and default it to error by @danwkennedy in #461

Full Changelog: actions/download-artifact@v7...v8.0.0

`v8`

Compare Source

`v7.0.0`

Compare Source

v7 - What's new

[!IMPORTANT]
actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in #440
Download Artifact Node24 support by @salmanmkc in #415
fix: update @actions/artifact to fix Node.js 24 punycode deprecation by @salmanmkc in #451
prepare release v7.0.0 for Node.js 24 support by @salmanmkc in #452

New Contributors

@patrikpolyak made their first contribution in #440
@salmanmkc made their first contribution in #415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

`v7`

Compare Source

`v6.0.0`

Compare Source

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

Update README for download-artifact v5 changes by @yacaovsnc in #417
Update README with artifact extraction details by @yacaovsnc in #424
Readme: spell out the first use of GHES by @danwkennedy in #431
Bump @actions/artifact to v4.0.0
Prepare v6.0.0 by @danwkennedy in #438

New Contributors

@danwkennedy made their first contribution in #431

Full Changelog: actions/download-artifact@v5...v6.0.0

`v6`

Compare Source

`v5.0.0`

Compare Source

What's Changed

Update README.md by @nebuk89 in #407
BREAKING fix: inconsistent path behavior for single artifact downloads by ID by @GrantBirki in #416

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

By name: name: my-artifact → extracted to path/ (direct)
By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

By name: name: my-artifact → extracted to path/ (unchanged)
By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:

You download artifacts by name
You download multiple artifacts by ID
You already use merge-multiple: true as a workaround

⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist

# Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

- uses: actions/download-artifact@v5
  with:
    artifact-ids: 12345
    path: dist/my-artifact  # Explicitly specify the nested path

New Contributors

@nebuk89 made their first contribution in #407

Full Changelog: actions/download-artifact@v4...v5.0.0

`v5`

Compare Source

actions/upload-artifact (actions/upload-artifact)

`v7.0.1`

Compare Source

What's Changed

Update the readme with direct upload details by @danwkennedy in #795
Readme: bump all the example versions to v7 by @danwkennedy in #796
Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in #797

Full Changelog: actions/upload-artifact@v7...v7.0.1

`v7.0.0`

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in #754
Upgrade the module to ESM and bump dependencies by @danwkennedy in #762
Support direct file uploads by @danwkennedy in #764

New Contributors

@Link- made their first contribution in #754

Full Changelog: actions/upload-artifact@v6...v7.0.0

`v7`

Compare Source

`v6.0.0`

Compare Source

v6 - What's new

[!IMPORTANT]
actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Upload Artifact Node 24 support by @salmanmkc in #719
fix: update @actions/artifact for Node.js 24 punycode deprecation by @salmanmkc in #744
prepare release v6.0.0 for Node.js 24 support by @salmanmkc in #745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

`v6`

Compare Source

`v5.0.0`

Compare Source

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

Update README.md by @GhadimiR in #681
Update README.md by @nebuk89 in #712
Readme: spell out the first use of GHES by @danwkennedy in #727
Update GHES guidance to include reference to Node 20 version by @patrikpolyak in #725
Bump @actions/artifact to v4.0.0
Prepare v5.0.0 by @danwkennedy in #734

New Contributors

@GhadimiR made their first contribution in #681
@nebuk89 made their first contribution in #712
@danwkennedy made their first contribution in #727
@patrikpolyak made their first contribution in #725

Full Changelog: actions/upload-artifact@v4...v5.0.0

`v5`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

cursor

Stale comment

Security Review: No issues found

This PR updates first-party GitHub artifact actions (actions/upload-artifact v4→v7, actions/download-artifact v4→v8) in the CI workflow. These are maintained by the GitHub actions/ organization.

No new permissions, secrets, or workflow triggers are introduced.

No new code paths or logic changes — only version strings in uses: directives.

The existing pattern of using mutable major-version tags (rather than SHA-pinned refs) is unchanged; this is a pre-existing posture, not a new risk from this PR.

No security findings to report.

_{Sent by Cursor Automation: Find vulnerabilities}

cursor

Stale comment

Security Review: No Vulnerabilities Found

PR: Dependency update of GitHub artifact actions (actions/upload-artifact v4 → v7, actions/download-artifact v4 → v8)

Scope: Single file changed (.github/workflows/dev.yml) — version bumps only, no logic changes.

Assessment:

Both actions/upload-artifact and actions/download-artifact are first-party GitHub Actions maintained by the actions/ organization. The referenced versions (v7.0.1 and v8.0.1 respectively) are legitimate, published releases.

The download-artifact@v8 update actually improves security posture: it now defaults digest-mismatch to error, enforcing artifact integrity checks that were previously only warnings.

The use of mutable major-version tags (@v7, @v8) follows the same pattern as the previous @v4 references — this is not a new risk introduced by the PR.

No injection risks, secret leakage, permission changes, or supply-chain concerns identified.

Result: Clean — no findings.

_{Sent by Cursor Automation: Find vulnerabilities}

cursor

Stale comment

Security Review: No Issues Found

This PR bumps two first-party GitHub Actions (actions/upload-artifact v4 → v7, actions/download-artifact v4 → v8) in .github/workflows/dev.yml. Both are official, verified releases from the actions organization.

Supply-chain risk: Low. These are first-party GitHub Actions with verified signatures. The use of major version tags (e.g., v7, v8) rather than pinned SHAs is consistent with the existing pattern and is standard for official actions.

Security improvement: download-artifact@v8 now defaults digest-mismatch behavior to error, which strengthens artifact integrity checks.

No new permissions, secrets exposure, code execution paths, or injection vectors are introduced by this change.

_{Sent by Cursor Automation: Find vulnerabilities}

cursor

Stale comment

Security review (automation)

Scope: .github/workflows/dev.yml only bumps first-party GitHub actions: actions/upload-artifact@v4 → @v7 and actions/download-artifact@v4 → @v8. No workflow logic, permissions, triggers, or step inputs (name, path, etc.) were changed in this diff.

Findings: None rated medium or higher.

Analysis (concise):

Injection / SSRF / secrets: These edits only change action major versions; they do not introduce new attacker-controlled sinks or logging.

Authn/authz: Unchanged; deploy jobs remain gated with if: github.repository_owner == 'semaphoreui'.

Supply chain: Still actions/* maintained by GitHub; same trust model as the prior @v4 pins. download-artifact v8 tightens integrity handling (hash mismatch defaults to error per upstream release notes), which is security-positive rather than a regression.

Prior automation threads: Cleaned up so this assessment is the active one.

Slack (paste-ready): PR 3442 security review: clean — dependency-only bump to official upload-artifact / download-artifact majors; no new medium+ issues identified.

_{Sent by Cursor Automation: Find vulnerabilities}

cursor

Stale comment

Security review (automation)

Scope: .github/workflows/dev.yml only — actions/upload-artifact v4→v7 and actions/download-artifact v4→v8.

Outcome: No medium, high, or critical issues identified in the changed lines.

Notes: Artifact name and path remain fixed literals (not PR-controlled). Supply-chain trust is unchanged in kind (first-party actions/* major tags). download-artifact v8 tightens integrity handling (digest mismatch defaults to error), which is a defensive default rather than a new exposure.

Prior automation assessment threads were cleared so this review reflects the current diff only.

_{Sent by Cursor Automation: Find vulnerabilities}

cursor

Stale comment

Security review (automation)

Scope: .github/workflows/dev.yml only — actions/upload-artifact v4→v7 and actions/download-artifact v4→v8 (nine uses: lines).

Outcome: No medium, high, or critical issues identified in the changed lines.

Analysis:

Injection / SSRF / secrets: Diff changes action major versions only; artifact name (semaphore) and path (bin/semaphore) remain fixed literals with no PR-controlled inputs.

Authn/authz: Unchanged. Deploy jobs still gated with if: github.repository_owner == 'semaphoreui'; Docker push/login still skipped on pull_request.

Supply chain: Still first-party actions/* maintained by GitHub; mutable major tags (@v7, @v8) match the prior @v4 posture and are not a new risk from this PR. download-artifact@v8 defaults digest mismatch to error, which strengthens artifact integrity vs v4.

Prior automation threads: Validated; no unresolved findings remain applicable.

Slack (paste-ready): PR 3442 security review — clean. Renovate bump of official upload-artifact / download-artifact majors in dev.yml only; no new medium+ vulnerabilities; v8 digest check is a defensive improvement.

_{Sent by Cursor Automation: Find vulnerabilities}

_{Sent by Cursor Automation: Find vulnerabilities}

cursor

Stale comment

Security review (automation)

Scope: .github/workflows/dev.yml only — actions/upload-artifact v4→v7 and actions/download-artifact v4→v8 (nine uses: lines).

Outcome: No medium, high, or critical issues identified in the changed lines.

Analysis:

Injection / SSRF / secrets: Diff changes action major versions only; artifact name (semaphore) and path (bin/semaphore) remain fixed literals with no PR-controlled inputs.

Authn/authz: Unchanged. Deploy jobs still gated with if: github.repository_owner == 'semaphoreui'; Docker push/login still skipped on pull_request.

Supply chain: Still first-party actions/* maintained by GitHub; mutable major tags (@v7, @v8) match the prior @v4 posture and are not a new risk from this PR. download-artifact@v8 defaults digest mismatch to error, which strengthens artifact integrity vs v4.

Prior automation threads: Validated; no unresolved inline findings remain applicable.

Slack (paste-ready): PR 3442 security review — clean. Renovate bump of official upload-artifact / download-artifact majors in dev.yml only; no new medium+ vulnerabilities; v8 digest check is a defensive improvement.

_{Sent by Cursor Automation: Find vulnerabilities}

cursor

Stale comment

Security review (automation)

Scope: .github/workflows/dev.yml only — actions/upload-artifact v4→v7 and actions/download-artifact v4→v8 (nine uses: lines).

Outcome: No medium, high, or critical issues identified in the changed lines.

Analysis:

Version bumps only; no workflow logic, permissions, triggers, or step inputs changed.

Artifact names (semaphore, dredd-hooks) and paths remain hardcoded constants with no attacker-controlled input.

archive: false (v7 direct-upload mode) is not enabled; default zip behavior is unchanged.

v8 defaults digest mismatches to error, which hardens artifact integrity checks rather than weakening them.

Prior path-traversal risk in download-artifact (CVE-2024-42471, fixed in ≥4.1.3) is not reintroduced; v8 includes current fixes.

Supply-chain note (informational, below reporting threshold): @v7/@v8 are floating major tags from the official actions/ org—the same pinning model as the previous @v4 pins. No new exploitable attack path from this change alone.

_{Sent by Cursor Automation: Find vulnerabilities}

cursor

Security review (automation)

Scope: .github/workflows/dev.yml only — actions/upload-artifact v4→v7 and actions/download-artifact v4→v8 (14 uses: lines).

Outcome: No medium, high, or critical issues identified in the changed lines.

Notes:

Artifact names (semaphore, dredd-hooks) and paths are hardcoded; no attacker-controlled input reaches these actions.
Artifacts are produced and consumed within the same workflow run (build-local → downstream jobs); no cross-workflow or external artifact sources.
v8 defaults digest mismatches to error, which hardens integrity checks versus v4; the prior path-traversal advisory (CVE-2024-42471) was patched in v4.1.3 and remains addressed in v8.
Floating major tags (@v7/@v8) are pre-existing practice; pinning to commit SHAs would reduce supply-chain risk but is outside this PR’s diff and not a new exposure.

Prior findings: No unresolved automation threads; previous assessments validated — still no exploitable path.

_{Sent by Cursor Automation: Find vulnerabilities}

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from b88097c to 0aea0eb Compare November 10, 2025 21:12

renovate Bot force-pushed the renovate/major-github-artifact-actions branch 2 times, most recently from cc8eb97 to 3f90632 Compare December 15, 2025 16:57

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from 3f90632 to 4ff97df Compare December 31, 2025 14:43

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from 4ff97df to 4d5e4af Compare February 2, 2026 14:43

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from 4d5e4af to 2163afe Compare February 12, 2026 16:59

renovate Bot force-pushed the renovate/major-github-artifact-actions branch 3 times, most recently from c8b66ba to 0dceac7 Compare February 26, 2026 20:36

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from 0dceac7 to 1a6ce0e Compare March 5, 2026 11:02

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from 1a6ce0e to 35bd267 Compare March 26, 2026 17:45

renovate Bot force-pushed the renovate/major-github-artifact-actions branch 2 times, most recently from 45c23eb to 50c9265 Compare April 15, 2026 09:57

cursor Bot reviewed Apr 15, 2026

View reviewed changes

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from 50c9265 to 5313cb6 Compare April 16, 2026 13:41

cursor Bot reviewed Apr 16, 2026

View reviewed changes

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from 5313cb6 to ab0cd29 Compare April 16, 2026 19:47

cursor Bot reviewed Apr 16, 2026

View reviewed changes

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from ab0cd29 to aea6999 Compare April 21, 2026 16:46

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from aea6999 to 95a1bf0 Compare April 29, 2026 11:55

renovate Bot force-pushed the renovate/major-github-artifact-actions branch 2 times, most recently from cc949e3 to 8f71eda Compare May 14, 2026 17:01

cursor Bot reviewed May 14, 2026

View reviewed changes

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from 8f71eda to 938d62b Compare May 22, 2026 17:55

cursor Bot reviewed May 22, 2026

View reviewed changes

renovate Bot force-pushed the renovate/major-github-artifact-actions branch 2 times, most recently from f9c8af3 to 05f86b7 Compare June 2, 2026 16:34

cursor Bot reviewed Jun 2, 2026

View reviewed changes

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from 05f86b7 to 619320d Compare June 11, 2026 09:29

cursor Bot reviewed Jun 11, 2026

View reviewed changes

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from 619320d to a916da8 Compare June 15, 2026 14:37

cursor Bot reviewed Jun 15, 2026

View reviewed changes

chore(deps): update github artifact actions

11a3570

renovate Bot force-pushed the renovate/major-github-artifact-actions branch from a916da8 to 11a3570 Compare June 18, 2026 16:07

cursor Bot reviewed Jun 18, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): update github artifact actions (major)#3442

chore(deps): update github artifact actions (major)#3442
renovate[bot] wants to merge 1 commit into
developfrom
renovate/major-github-artifact-actions

renovate Bot commented Nov 9, 2025 •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented Nov 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

v8 - What's new

Direct downloads

Enforced checks (breaking)

ESM

What's Changed

v7 - What's new

Node.js 24

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

v5.0.0

🚨 Breaking Change

What Changed

Migration Guide

✅ No Action Needed If:

⚠️ Action Required If:

New Contributors

What's Changed

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

v6 - What's new

Node.js 24

What's Changed

What's Changed

New Contributors

Configuration

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security Review: No Vulnerabilities Found

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security review (automation)

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security review (automation)

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security review (automation)

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security review (automation)

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Security review (automation)

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Security review (automation)

renovate Bot commented Nov 9, 2025 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading