From 7c7564302997ad62904d16d9ae2f7c0ea7e156a4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 11 Oct 2026 20:34:36 +0000 Subject: [PATCH 1/2] build(deps): bump actions/upload-artifact Bumps the github-actions group with 1 update: [actions/upload-artifact](https://github.com/actions/upload-artifact). Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/release.yml | 2 +- .github/workflows/tests.yml | 2 +- .github/workflows/wheel-artifact.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8089eea7..0b5bc53d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -191,7 +191,7 @@ jobs: # assets. wheel-artifact.yml re-publishes it under the same name on a # schedule so the 90-day artifact expiry does not strand users. - name: Upload wheel as a workflow artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: python-hwpx-wheel path: | diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index b34bd38b..3d896696 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -64,7 +64,7 @@ jobs: - name: Upload pytest summary log if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: pytest-summary-${{ matrix.python-version }} path: pytest-summary.log diff --git a/.github/workflows/wheel-artifact.yml b/.github/workflows/wheel-artifact.yml index 0e835c33..b29da6e9 100644 --- a/.github/workflows/wheel-artifact.yml +++ b/.github/workflows/wheel-artifact.yml @@ -47,7 +47,7 @@ jobs: ls -l - name: Upload as the stable artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: python-hwpx-wheel path: | From 1d8ee34d93fefe04321ab72f546da6c7e253ab16 Mon Sep 17 00:00:00 2001 From: airmang <38392618+airmang@users.noreply.github.com> Date: Mon, 12 Oct 2026 11:24:08 +0900 Subject: [PATCH 2/2] test(release): refreeze the release steps on actions/upload-artifact v7.0.2 cf430e030ddbb5b0abf93d22962f4752f3646cd9 is the v7.0.2 tag commit, four commits after v7.0.1: action.yml is unchanged and the dist bundles add no URL, environment variable or module (artifact download retries on HTTP 429). Co-Authored-By: Claude Opus 5.5 --- tests/test_release_workflow_safety.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_release_workflow_safety.py b/tests/test_release_workflow_safety.py index f35ae82c..6b1f19d6 100644 --- a/tests/test_release_workflow_safety.py +++ b/tests/test_release_workflow_safety.py @@ -139,7 +139,7 @@ # Release assets (see wheel-artifact.yml). Upload-only: it reads # dist/ and the checksum manifest and mutates nothing. "Upload wheel as a workflow artifact", - "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a", + "actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9", False, { "name": "python-hwpx-wheel",