From 32ee8ceeed196aaf7a59bee8a04e10fe4dd525c1 Mon Sep 17 00:00:00 2001 From: Marcono1234 Date: Wed, 5 Aug 2026 17:36:14 +0200 Subject: [PATCH] Bump actions/upload-artifact to 7.0.1 For `cifuzz.yml` the previous pinned version was apparently not a release but just some commit around v3 (?), which is also not supported anymore. So if fuzzing had actually found something, it is quite likely that uploading the result would have failed. And for `scorecard.yml` the workflow already logged a warning about Node.js 20 being deprecated. Not sure why Dependabot had not attempted to update either of them so far. --- .github/workflows/cifuzz.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 9f64d856..68b02ea9 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -22,7 +22,7 @@ jobs: fuzz-seconds: 300 output-sarif: true - name: Upload Crash - uses: actions/upload-artifact@65d862660abb392b8c4a3d1195a2108db131dd05 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: failure() && steps.build.outcome == 'success' with: name: artifacts diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 6fe63bc2..91a9aa40 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -50,7 +50,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: SARIF file path: results.sarif