From b783978502761a402502ee189702e744335a7e6e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 04:15:41 +0000 Subject: [PATCH] build(deps): Bump the actions group with 3 updates Bumps the actions group with 3 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/download-artifact](https://github.com/actions/download-artifact) and [taiki-e/install-action](https://github.com/taiki-e/install-action). Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `taiki-e/install-action` from 2.87.26 to 2.87.28 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/f7e5d7c961414b23f5b25b2da9294395d08513ad...1168f6810a3cb30a3514bf5756a3b7f0422c6df8) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.87.28 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/calibrate.yml | 4 ++-- .github/workflows/coverage.yml | 4 ++-- .github/workflows/instructions.yml | 10 +++++----- .github/workflows/prepare-release.yml | 2 +- .github/workflows/strength-batch.yml | 4 ++-- .github/workflows/supply-chain.yml | 2 +- 6 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/calibrate.yml b/.github/workflows/calibrate.yml index a6f98a11..39902cc6 100644 --- a/.github/workflows/calibrate.yml +++ b/.github/workflows/calibrate.yml @@ -319,7 +319,7 @@ jobs: # artifact name cannot be uploaded twice. - name: Keep the games if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ env.ARTIFACT }}-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.rung.engine }}-${{ matrix.rung.tag }} path: | @@ -359,7 +359,7 @@ jobs: # attempt is in the pattern so a rerun does not count an earlier # attempt's games as well. The prefix is followed by the run id, so a # blitz run's pattern cannot match a 40/15 run's artifacts. - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: ${{ env.ARTIFACT }}-${{ github.run_id }}-${{ github.run_attempt }}-* path: rungs diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 86cb0112..3665cf44 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -30,7 +30,7 @@ jobs: # not in rust-toolchain.toml, so a clone does not install them - name: Install the llvm tools run: rustup component add llvm-tools-preview - - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26 + - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28 with: # pinned for the reason the actions are tool: cargo-llvm-cov@0.9.0 @@ -47,7 +47,7 @@ jobs: # --no-run reuses the profile data the step above produced - name: Write the lcov run: cargo llvm-cov --workspace --locked --no-run --lcov --output-path lcov.info - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: coverage path: lcov.info diff --git a/.github/workflows/instructions.yml b/.github/workflows/instructions.yml index 5dcb25df..c93d671d 100644 --- a/.github/workflows/instructions.yml +++ b/.github/workflows/instructions.yml @@ -61,7 +61,7 @@ jobs: | [range(0; length; 6) as $i | .[$i:$i + 6] | join(" ")]' commits.txt)" \ >> "$GITHUB_OUTPUT" # the report reads a commit on the list with no row as a gap - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: commits path: commits.txt @@ -97,7 +97,7 @@ jobs: --out counts.csv ${DEPTH:+--depth "$DEPTH"} # the rows a failed chunk did count are still worth having - if: ${{ !cancelled() }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ env.NAME }} path: counts.csv @@ -111,11 +111,11 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: counts-* path: counts - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: commits - name: Report @@ -136,7 +136,7 @@ jobs: for path in sys.argv[1:]: print("".join(open(path).readlines()[1:]), end="") EOF - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: instruction-history path: history.csv diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 5141d2be..147b7d49 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -48,7 +48,7 @@ jobs: # made the cargo-release install below a no-op with no binary there cache-bin: false - - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26 + - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28 with: # pinned exactly, since a tool that floats makes a release # unreproducible: these write the release commit and the changelog, diff --git a/.github/workflows/strength-batch.yml b/.github/workflows/strength-batch.yml index 9a4c65c3..08e235f7 100644 --- a/.github/workflows/strength-batch.yml +++ b/.github/workflows/strength-batch.yml @@ -265,7 +265,7 @@ jobs: # artifact name cannot be uploaded twice. - name: Keep the games if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ env.ARTIFACTS }}-shard-${{ matrix.shard }} path: | @@ -305,7 +305,7 @@ jobs: # The attempt is in the pattern so a rerun does not count an earlier # attempt's games as well, and the batch so a later batch does not count # the one before it twice, its pairs already arriving as prior_pairs. - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: ${{ env.ARTIFACTS }}-shard-* path: shards diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index f8c7f144..b7377df0 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -38,7 +38,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # fetches a prebuilt cargo-deny rather than compiling one - - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26 + - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28 with: # Pinned because deny.toml's fields are the ones this version # defines. The advisory database is still fetched at run time, which