Bump actions/download-artifact from 2 to 4.1.7 in /.github/workflows - #136
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 2 to 4.1.7. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v2...v4.1.7) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
zakinko
added a commit
to zakinko/diyBMSv4Code
that referenced
this pull request
Aug 12, 2026
CI has not been able to run since 30 June 2024, when GitHub disabled v1 and v2 of the artifact actions. The announcement is explicit that this is a failure and not a warning: "attempting to use a version of the actions after the announced deprecation date will result in a workflow failure". Dependabot opened stuartpittaway#136 in September 2024 to move download-artifact to v4; it covers one of the five call sites and is still open. Everything else here is on the same footing, so all of it moves at once: actions/checkout v2 -> v4 Node 16, removed from the runners actions/cache v2 -> v4 same actions/setup-python v2 -> v5 same actions/upload-artifact v2 -> v4 disabled 2024-06-30 actions/download-artifact v2 -> v4 disabled 2024-06-30 actions/create-release v1 archived 2021-03-04 actions/upload-release-asset v1 archived 2021-03-04 Three things needed more than a version bump: - upload-artifact v4 rejects a second upload under a name it has already seen, where v2 merged them. The controller job uploaded twice under one name, before and after building the filesystem image, so the first upload is dropped and the image is built before the remaining one. - create-release and upload-release-asset are both archived and unmaintained. Replaced with softprops/action-gh-release, which their own READMEs suggest, and which creates the release and attaches the asset in one step. That needs "contents: write", which is now declared on the job - the default token is read-only on repositories created since 2023. - The zip step named artifact members by path. An artifact is rooted at the least common ancestor of the files it was given, so how much of the directory structure survives depends on how many directories matched, which differs between the two jobs. Files are now located by name; --junk-paths was already discarding the directories anyway. Python is pinned to 3.13 rather than left to the runner default. It was the version that exposed the htmlmin breakage fixed in the previous commit, so building on it keeps that from regressing unnoticed.
zakinko
added a commit
to zakinko/diyBMSv4Code
that referenced
this pull request
Aug 12, 2026
There is no dependabot.yml in this repository. stuartpittaway#136 exists because Dependabot security updates run without configuration; version updates do not, which is why five action versions sat at v2 until GitHub disabled them and nothing said so. Monthly rather than weekly - the actions here change a few times a year, and this is not a repository anyone wants a stream of pull requests against. This covers the workflows only. Dependabot has no PlatformIO ecosystem, so the pinned platform, toolchain and libraries are watched by nothing and have to be moved by hand; there is a comment in the file saying so, since the pins are easily mistaken for something being kept up to date automatically.
zakinko
added a commit
to zakinko/diyBMSv4Code
that referenced
this pull request
Aug 12, 2026
CI has not been able to run since 30 June 2024, when GitHub disabled v1 and v2 of the artifact actions. The announcement is explicit that this is a failure and not a warning: "attempting to use a version of the actions after the announced deprecation date will result in a workflow failure". Dependabot opened stuartpittaway#136 in September 2024 to move download-artifact to v4; it covers one of the five call sites and is still open. Everything else here is on the same footing, so all of it moves at once: actions/checkout v2 -> v4 Node 16, removed from the runners actions/cache v2 -> v4 same actions/setup-python v2 -> v5 same actions/upload-artifact v2 -> v4 disabled 2024-06-30 actions/download-artifact v2 -> v4 disabled 2024-06-30 actions/create-release v1 archived 2021-03-04 actions/upload-release-asset v1 archived 2021-03-04 Three things needed more than a version bump: - upload-artifact v4 rejects a second upload under a name it has already seen, where v2 merged them. The controller job uploaded twice under one name, before and after building the filesystem image, so the first upload is dropped and the image is built before the remaining one. - create-release and upload-release-asset are both archived and unmaintained. Replaced with softprops/action-gh-release, which their own READMEs suggest, and which creates the release and attaches the asset in one step. That needs "contents: write", which is now declared on the job - the default token is read-only on repositories created since 2023. - The zip step named artifact members by path. An artifact is rooted at the least common ancestor of the files it was given, so how much of the directory structure survives depends on how many directories matched, which differs between the two jobs. Files are now located by name; --junk-paths was already discarding the directories anyway. Python is pinned to 3.13 rather than left to the runner default. It was the version that exposed the htmlmin breakage fixed in the previous commit, so building on it keeps that from regressing unnoticed.
zakinko
added a commit
to zakinko/diyBMSv4Code
that referenced
this pull request
Aug 12, 2026
There is no dependabot.yml in this repository. stuartpittaway#136 exists because Dependabot security updates run without configuration; version updates do not, which is why five action versions sat at v2 until GitHub disabled them and nothing said so. Monthly rather than weekly - the actions here change a few times a year, and this is not a repository anyone wants a stream of pull requests against. This covers the workflows only. Dependabot has no PlatformIO ecosystem, so the pinned platform, toolchain and libraries are watched by nothing and have to be moved by hand; there is a comment in the file saying so, since the pins are easily mistaken for something being kept up to date automatically.
zakinko
added a commit
to zakinko/diyBMSv4Code
that referenced
this pull request
Aug 12, 2026
CI has not been able to run since 30 June 2024, when GitHub disabled v1 and v2 of the artifact actions. The announcement is explicit that this is a failure and not a warning: "attempting to use a version of the actions after the announced deprecation date will result in a workflow failure". Dependabot opened stuartpittaway#136 in September 2024 to move download-artifact to v4; it covers one of the five call sites and is still open. Everything else here is on the same footing, so all of it moves at once: actions/checkout v2 -> v4 Node 16, removed from the runners actions/cache v2 -> v4 same actions/setup-python v2 -> v5 same actions/upload-artifact v2 -> v4 disabled 2024-06-30 actions/download-artifact v2 -> v4 disabled 2024-06-30 actions/create-release v1 archived 2021-03-04 actions/upload-release-asset v1 archived 2021-03-04 Three things needed more than a version bump: - upload-artifact v4 rejects a second upload under a name it has already seen, where v2 merged them. The controller job uploaded twice under one name, before and after building the filesystem image, so the first upload is dropped and the image is built before the remaining one. - create-release and upload-release-asset are both archived and unmaintained. Replaced with softprops/action-gh-release, which their own READMEs suggest, and which creates the release and attaches the asset in one step. That needs "contents: write", which is now declared on the job - the default token is read-only on repositories created since 2023. - The zip step named artifact members by path. An artifact is rooted at the least common ancestor of the files it was given, so how much of the directory structure survives depends on how many directories matched, which differs between the two jobs. Files are now located by name; --junk-paths was already discarding the directories anyway. Python is pinned to 3.13 rather than left to the runner default. It was the version that exposed the htmlmin breakage fixed in the previous commit, so building on it keeps that from regressing unnoticed.
zakinko
added a commit
to zakinko/diyBMSv4Code
that referenced
this pull request
Aug 12, 2026
There is no dependabot.yml in this repository. stuartpittaway#136 exists because Dependabot security updates run without configuration; version updates do not, which is why five action versions sat at v2 until GitHub disabled them and nothing said so. Monthly rather than weekly - the actions here change a few times a year, and this is not a repository anyone wants a stream of pull requests against. This covers the workflows only. Dependabot has no PlatformIO ecosystem, so the pinned platform, toolchain and libraries are watched by nothing and have to be moved by hand; there is a comment in the file saying so, since the pins are easily mistaken for something being kept up to date automatically.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/download-artifact from 2 to 4.1.7.
Release notes
Sourced from actions/download-artifact's releases.
... (truncated)
Commits
65a9edcMerge pull request #325 from bethanyj28/mainfdd1595licensedc13dba1update@actions/artifactdependency0daa75eMerge pull request #324 from actions/eggyhead/use-artifact-v2.1.69c19ed7Merge branch 'main' into eggyhead/use-artifact-v2.1.63d3ea87updating license89af5dbupdating artifact package v2.1.6b4aefffMerge pull request #323 from actions/eggyhead/update-artifact-v2158caf195package lock updated7a2ec4updating package versionDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.