feat: support archive v4

README.md

@@ -345,6 +345,7 @@ for family, grp in itertools.groupby(collected.checks.items(), key=lambda x: x[1
 - [`GH101`](https://learn.scientific-python.org/development/guides/gha-basic#GH101): Has nice names
 - [`GH102`](https://learn.scientific-python.org/development/guides/gha-basic#GH102): Auto-cancel on repeated PRs
 - [`GH103`](https://learn.scientific-python.org/development/guides/gha-basic#GH103): At least one workflow with manual dispatch trigger
+- [`GH104`](https://learn.scientific-python.org/development/guides/gha-wheel#GH104): Use unique names for upload-artifact
 - [`GH200`](https://learn.scientific-python.org/development/guides/gha-basic#GH200): Maintained by Dependabot
 - [`GH210`](https://learn.scientific-python.org/development/guides/gha-basic#GH210): Maintains the GitHub action versions with Dependabot
 - [`GH211`](https://learn.scientific-python.org/development/guides/gha-basic#GH211): Do not pin core actions as major versions

docs/pages/guides/gha_basic.md

@@ -660,7 +660,7 @@ this action later; specifically, may want to use
 
 ```yaml
 - name: Upload artifact
-  uses: actions/upload-pages-artifact@v2
+  uses: actions/upload-pages-artifact@v3
 ```
 
 This actions defaults to uploading `_site`, but you can give any `with: path:`
@@ -682,7 +682,7 @@ deploy:
   steps:
     - name: Deploy to GitHub Pages
       id: deployment
-      uses: actions/deploy-pages@v3
+      uses: actions/deploy-pages@v4
 ```
 
 {% endraw %}

docs/pages/guides/gha_pure.md

@@ -77,7 +77,7 @@ dist:
     - name: Build SDist and wheel
       run: pipx run build
 
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@v4
       with:
         name: Packages
         path: dist/*
@@ -125,7 +125,7 @@ later in the upload action for the release job, as well).
 > ```yaml
 > steps:
 >   - uses: actions/checkout@v4
->   - uses: hynek/build-and-inspect-python-package@v1
+>   - uses: hynek/build-and-inspect-python-package@v2
 > ```
 >
 > The artifact it produces is named `Packages`, so that's what you need to use
@@ -146,7 +146,7 @@ publish:
   runs-on: ubuntu-latest
   if: github.event_name == 'release' && github.event.action == 'published'
   steps:
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@v4
       with:
         name: Packages
         path: dist
@@ -172,7 +172,7 @@ publish:
   runs-on: ubuntu-latest
   if: github.event_name == 'release' && github.event.action == 'published'
   steps:
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@v4
       with:
         name: Packages
         path: dist
@@ -223,7 +223,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: hynek/build-and-inspect-python-package@v1
+      - uses: hynek/build-and-inspect-python-package@v2
 
   publish:
     needs: [dist]
@@ -234,7 +234,7 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'published'
 
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           name: Packages
           path: dist
@@ -269,15 +269,15 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: hynek/build-and-inspect-python-package@v1
+      - uses: hynek/build-and-inspect-python-package@v2
 
   publish:
     needs: [dist]
     runs-on: ubuntu-latest
     if: github.event_name == 'release' && github.event.action == 'published'
 
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           name: Packages
           path: dist

docs/pages/guides/gha_wheels.md

@@ -92,9 +92,9 @@ make_sdist:
     - name: Build SDist
       run: pipx run build --sdist
 
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@v4
       with:
-        name: SDist
+        name: cibw-sdist
         path: dist/*.tar.gz
 ```
 
@@ -125,9 +125,9 @@ build_wheels:
     - uses: pypa/cibuildwheel@v2.16
 
     - name: Upload wheels
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
-        name: Wheels-${{ matrix.os }}
+        name: cibw-wheels-${{ matrix.os }}
         path: wheelhouse/*.whl
 ```
 
@@ -177,14 +177,11 @@ upload_all:
   runs-on: ubuntu-latest
   if: github.event_name == 'release' && github.event.action == 'published'
   steps:
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@v4
       with:
-        path: all
-
-    - name: Merge files
-      run: |
-        mkdir dist
-        mv all/*/* dist
+        pattern: cibw-*
+        path: dist
+        merge-multiple: true
 
     - uses: pypa/gh-action-pypi-publish@release/v1
 ```
@@ -207,14 +204,11 @@ upload_all:
   runs-on: ubuntu-latest
   if: github.event_name == 'release' && github.event.action == 'published'
   steps:
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@v4
       with:
-        path: all
-
-    - name: Merge files
-      run: |
-        mkdir dist
-        mv all/*/* dist
+        pattern: cibw-*
+        path: dist
+        merge-multiple: true
 
     - uses: pypa/gh-action-pypi-publish@release/v1
       with:

src/sp_repo_review/checks/github.py

@@ -107,6 +107,44 @@ def check(workflows: dict[str, Any]) -> bool:
         return any("workflow_dispatch" in w.get(True, {}) for w in workflows.values())
 
 
+class GH104(GitHub):
+    "Use unique names for upload-artifact"
+
+    requires = {"GH100"}
+    url = mk_url("gha-wheel")
+
+    @staticmethod
+    def check(workflows: dict[str, Any]) -> bool:
+        """
+        Multiple upload-artifact usages _must_ have unique names to be
+        compatible with `v4` (which no longer merge artifacts, but instead
+        errors out). The most general solution is:
+
+        ```yaml
+        - uses: actions/upload-artifact@v4
+          with:
+            name: prefix-${{ github.job }}-${{ strategy.job-index }}
+
+        - uses: actions/download-artifact@v4
+          with:
+            pattern: prefix-*
+            merge-multiple: true
+        ```
+        """
+
+        for workflow in workflows.values():
+            names = [
+                step.get("with", {}).get("name", "")
+                for job in workflow.get("jobs", {}).values()
+                for step in job.get("steps", [])
+                if step.get("uses", "").startswith("actions/upload-artifact")
+            ]
+            names = [n for n in names if "${{" not in n]
+            if len(names) != len(set(names)):
+                return False
+        return True
+
+
 class GH200(GitHub):
     "Maintained by Dependabot"
 

{{cookiecutter.project_name}}/.github/workflows/{% if cookiecutter.__type!='compiled' %}cd.yml{% endif %}

@@ -27,7 +27,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: hynek/build-and-inspect-python-package@v1
+      - uses: hynek/build-and-inspect-python-package@v2
 
   publish:
     needs: [dist]
@@ -39,7 +39,7 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'published'
 
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           name: Packages
           path: dist

{{cookiecutter.project_name}}/.github/workflows/{% if cookiecutter.__type=='compiled' %}cd.yml{% endif %}

@@ -25,9 +25,9 @@ jobs:
       - name: Build SDist
         run: pipx run build --sdist
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: SDist
+          name: cibw-sdist
           path: dist/*.tar.gz
 
   build_wheels:
@@ -46,9 +46,9 @@ jobs:
       - uses: pypa/cibuildwheel@v2.16
 
       - name: Upload wheels
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: Wheel-{% raw %}${{ matrix.os }}{% endraw %}
+          name: cibw-wheels-{% raw %}${{ matrix.os }}-${{ strategy.job-index }}{% endraw %}
           path: wheelhouse/*.whl
 
   upload_all:
@@ -60,14 +60,11 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'published'
 
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
+          pattern: cibw-*
           path: dist
-
-      - name: Merge files
-        run: |
-          mkdir dist
-          mv all/*/* dist
+          merge-multiple: true
 
       - uses: pypa/gh-action-pypi-publish@release/v1
         with: