CI: bump the four PR-proven action pins; hold upload-artifact for the signing path (#1653) - #1671
Merged
Merged
Conversation
…the signing path (#1653) checkout v5->v7, setup-dotnet v5->v6, cache v4->v6, paths-filter v3->v4 - all exercised by every PR run, so this PR's own CI proves them. upload-artifact stays v6 deliberately: its artifact-id output feeds all six SignPath signing steps, which only execute on release publish, and v7 changes artifact archiving semantics - bump only alongside a validated real signing run. A Dependabot ignore rule keeps Monday's github-actions group from proposing that major blindly; a comment in build.yml marks the hold at the first upload step. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements #1653's own suggested split.
Bumped (proved by this PR's CI run):
actions/checkoutv5→v7 (9 sites),actions/setup-dotnetv5→v6 (4),actions/cachev6 (4 — covers the ~340MB pg-runtime cache),dorny/paths-filterv3→v4 (3). All run on every PR, so a break is visible right here.Held:
actions/upload-artifactstays v6 (6 sites). Itsartifact-idoutput feeds all six SignPath signing steps, which only execute onrelease: [published]— v7's archiving changes (archiveparameter) would surface at release time. Marked with a comment at the first upload step, and a Dependabotignorerule so Monday's github-actions group can't propose the major blindly. The remaining scope of #1653 (validate v7 against a real signing run) stays tracked there — suggest leaving the issue open, scoped to that.Note:
nightly.ymlbumps take effect from main's copy per the scheduled-workflow rule — validated when next promoted.No CHANGELOG entry — CI infra only (same as #1644).
🤖 Generated with Claude Code