Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 8, 2025

Bumps actions/upload-artifact from 4 to 5.

Release notes

Sourced from actions/upload-artifact's releases.

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

New Contributors

Full Changelog: actions/upload-artifact@v4...v5.0.0

v4.6.2

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v4...v4.6.2

v4.6.1

What's Changed

Full Changelog: actions/upload-artifact@v4...v4.6.1

v4.6.0

What's Changed

Full Changelog: actions/upload-artifact@v4...v4.6.0

v4.5.0

What's Changed

New Contributors

... (truncated)

Commits
  • 330a01c Merge pull request #734 from actions/danwkennedy/prepare-5.0.0
  • 03f2824 Update github.dep.yml
  • 905a1ec Prepare v5.0.0
  • 2d9f9cd Merge pull request #725 from patrikpolyak/patch-1
  • 9687587 Merge branch 'main' into patch-1
  • 2848b2c Merge pull request #727 from danwkennedy/patch-1
  • 9b51177 Spell out the first use of GHES
  • cd231ca Update GHES guidance to include reference to Node 20 version
  • de65e23 Merge pull request #712 from actions/nebuk89-patch-1
  • 8747d8c Update README.md
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

  • Chores
    • Updated CI/CD artifact upload configuration to use the latest version for improved reliability.

✏️ Tip: You can customize this high-level summary in your review settings.

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v5)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels Dec 8, 2025
@vercel
Copy link

vercel bot commented Dec 8, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments
Project Deployment Preview Comments Updated (UTC)
pipedream-docs Ignored Ignored Dec 8, 2025 10:02am
pipedream-docs-redirect-do-not-edit Ignored Ignored Dec 8, 2025 10:02am

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Dec 8, 2025

Walkthrough

Updated the GitHub Actions workflow configuration to use actions/upload-artifact@v5 instead of v4 for the validation report upload step. This is a routine dependency version bump with no functional changes to the workflow logic.

Changes

Cohort / File(s) Change Summary
GitHub Actions Workflow
.github/workflows/scheduled-package-validation.yaml
Updated actions/upload-artifact action version from v4 to v5 in the Upload Validation Report step.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

  • Straightforward action version bump with no logic or behavioral impact
  • Single-file change affecting only a dependency reference
  • No testing or compatibility concerns apparent from summary

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Description check ⚠️ Warning The PR description is largely incomplete relative to the template. While it contains detailed release notes and Dependabot metadata, it lacks the required 'WHY' section specified in the description template. Add a 'WHY' section explaining the rationale for upgrading to v5, such as security improvements, bug fixes, or feature benefits mentioned in the release notes.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title 'Bump actions/upload-artifact from 4 to 5' directly and clearly describes the main change in the pull request, which is upgrading the GitHub Action version.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch dependabot/github_actions/actions/upload-artifact-5

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between a5e39f4 and a3ff0c7.

📒 Files selected for processing (1)
  • .github/workflows/scheduled-package-validation.yaml (1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
  • GitHub Check: Lint Code Base
  • GitHub Check: pnpm publish
🔇 Additional comments (1)
.github/workflows/scheduled-package-validation.yaml (1)

42-49: Verify compatibility of upload-artifact@v5 breaking changes with this workflow.

The upgrade to v5 introduces breaking changes (Node v24.x support treated as breaking, @actions/artifact bumped to v4.0.0). Although the inputs used here (name, path, retention-days) are standard and likely compatible, we should verify that no migration steps are needed.

Please check the following:

  1. Confirm that all inputs used in this step remain compatible with v5
  2. Verify whether the new artifact-digest output should be captured and used (e.g., for artifact verification or auditing)
  3. Run the workflow after merge to ensure it functions as expected with v5

If needed, consult the actions/upload-artifact v5 release notes and migration guide for any required changes.


Comment @coderabbitai help to get the list of available commands and usage tips.

@luancazarine luancazarine merged commit a284285 into master Dec 9, 2025
7 checks passed
@luancazarine luancazarine deleted the dependabot/github_actions/actions/upload-artifact-5 branch December 9, 2025 20:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code User submitted Submitted by a user

Development

Successfully merging this pull request may close these issues.

3 participants