deps(actions)(deps): bump dawidd6/action-download-artifact from 20 to 24 - #112
deps(actions)(deps): bump dawidd6/action-download-artifact from 20 to 24#112dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [dawidd6/action-download-artifact](https://github.com/dawidd6/action-download-artifact) from 20 to 24. - [Release notes](https://github.com/dawidd6/action-download-artifact/releases) - [Commits](dawidd6/action-download-artifact@v20...v24) --- updated-dependencies: - dependency-name: dawidd6/action-download-artifact dependency-version: '24' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
|
|
Reviewed head Next step: re-run/configure CLA Assistant to exempt @dependabot[bot] on this PR and make the CLA check pass. |
phylax-ci
added
the
ticket-exempt
0xAlcibiades
left a comment
0xAlcibiades
left a comment
There was a problem hiding this comment.
Comment — a four-major jump (v20→v24) on a third-party action deserves one check before merge.
Two things:
- Consider pinning by SHA. This file already SHA-pins
cargo-bins/cargo-binstallwith a version comment, butdawidd6/action-download-artifactfloats on a tag. Dependabot is just preserving the existing style, so this isn't a regression — but an artifact-download action withgithub_tokenaccess in a shared reusable workflow is exactly where tag-hijack risk concentrates. Moving these twouses:lines todawidd6/action-download-artifact@<sha> # v24(and letting dependabot maintain the pin) matches the repo's own discipline. - Changelog check across four majors: both call sites only use
github_token/workflow/branch inputs on the pages/baseline paths, and thetestcheck passed — but neither of those steps runs on this PR's trigger, so the bump is effectively unexercised. Worth a one-minute skim of the v21–v24 release notes for input renames or default flips (if_no_artifact_foundbehavior has changed across majors of this action before) before merging.
Fine to merge once someone's done that skim; happy to be the rubber stamp after.
3 participants
Bumps dawidd6/action-download-artifact from 20 to 24.
Release notes
Sourced from dawidd6/action-download-artifact's releases.
... (truncated)
Commits
d63b86afix: preserve workflow run ordering (#425)57aa996chore: simplify artifact filtering (#423)7325d46chore: remove redundant action code (#422)fdd98d5chore: simplify action implementation (#421)2156211fix: stream GHES artifact downloads (#420)a64f37fHarden upload workflow token scope with explicitGITHUB_TOKENpermissions (...b3e5a4cbuild(deps): update brace-expansion (#418)01843d9joint fixes and improvements (#417)7f871e0fix: continue after expired artifacts (#413)0015e1bnode_modules: update (#416)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)ticket-exempt: generated Dependabot dependency update; no dedicated engineering-capacity issue required.