chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2

[dependabot]

Bumps actions/upload-artifact from 7.0.1 to 7.0.2.

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[devin-ai-integration]

E2E review — PR #233 (actions/upload-artifact 7.0.1 → 7.0.2)

Tested head: 733c0a958ec4e0fa2c1ce455fde8c696a4ecb854 · base: ec55a321a6358adf9ad3bfeade01fb735590b8bc · Linux (Ubuntu VM), Bun 1.4.0 (.bun-version), Node 24.21.0 for the action bundle

Verdict: no defects found, no fix PR needed. The only change is the SHA pin of the Upload binary E2E report step in the Node tests job (.github/workflows/ci.yml). No runtime, CLI, SDK, MCP or browser code changed.

What I ran

Journey	Result
Pinned SHA is the real upstream tag: live git ls-remote github.com/actions/upload-artifact → refs/tags/v7.0.2 = cf430e030ddbb5b0abf93d22962f4752f3646cd9 (old pin 043fb46… = v7.0.1)	passed
action.yml is byte-identical between the two SHAs. The inputs the step uses (name, path, include-hidden-files, if-no-files-found) and the node24 runtime are unchanged. The only differences are bundle version 7.0.2 and @actions/artifact ^6.2.0 → ^6.3.1	passed
actionlint 1.7.12 on .github/workflows/*.yml	passed
bun run lint, bun run typecheck, betterwright setup + doctor ("BetterWright is ready.") at the PR head	passed
Real binary E2E: bun run test:e2e --binary bun --binary-arg dist/bin/betterwright.js --require-all produces the .tmp/e2e-report.json that this step uploads	100/102 passed on the first run. The 2 protocol-mcp-browser-* cases failed only because my shell exported DISPLAY with no X auth. Both pass headless, as in CI (4/4 with env -u DISPLAY)
Ran the pinned v7.0.2 bundle (dist/upload/index.js) with the CI step's exact inputs against a disposable local Results/Twirp + blob fixture server. Uploading the real report: exit 0, artifact-id/artifact-digest/artifact-url outputs set, and the uploaded zip unzips to a byte-identical e2e-report.json	passed
Failure path (E2E failed, no report written) with v7.0.2: if-no-files-found: ignore logs a notice and exits 0, so if: always() cannot turn a failure into an upload error	passed
Baseline v7.0.1 bundle, same fixture and inputs: same behavior	passed (parity)
Real GitHub CI on this SHA: all 9 required checks passed. Node tests run 38012339248 ran the v7.0.2 step and published the binary-e2e-report artifact (5.46 KB)	passed

Recording (tested SHA 733c0a9, scenario: pin verification → v7.0.2 upload of the real E2E report → no-file path → v7.0.1 baseline; outcome: all exit 0, content match)

MP4 (46 s): https://app.devin.ai/api/presigned_proxy?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjpudWxsLCJidWNrZXRfbmFtZSI6ImRldmluYXR0YWNobWVudHMiLCJidWNrZXRfa2V5IjoiYXR0YWNobWVudHNfcHJpdmF0ZS9vcmctYmQ0NTliYTUyOTRiNDEyMGJiYWRhNmE1Y2JmODIyZTUvN2M0MGJhYmItZjAxOC00NWI0LTk0MDktNWZkODNhYWUyYWE2IiwiaWF0IjoxNzkxNTk1NTYwLCJvcmdfaWQiOiJvcmctYmQ0NTliYTUyOTRiNDEyMGJiYWRhNmE1Y2JmODIyZTUiLCJmaWxlbmFtZSI6InByMjMzLTczM2MwYTktdXBsb2FkLWFydGlmYWN0LXY3LjAuMi1lMmUubXA0In0.lI8XzqQ7JIPPRbGFgGo7YmFZbnQJuo4ZpyqOP_9IfhI. Limitation: GitHub comments can't take a direct MP4 upload from this tooling, and this link needs a Devin login in the BetterWright org. The animated WebP above is the same recording and is publicly viewable.

Notes / blockers

• Environment limitation: nektos/act 0.2.89's built-in artifact server fails both v7.0.1 and v7.0.2. It rejects the mime_type field in CreateArtifact, which is present in both bundles. That is an emulator gap, not something this PR introduced, so I used the fixture server above.
• Not applicable: browser/CLI/SDK/MCP behavior changes (none in the diff), UI desktop/mobile/light/dark, and released/native artifacts. publish-npm.yml doesn't use upload-artifact.
• Not tested locally: the authenticated GitHub artifact backend itself, which needs a runner token. The real CI run above covers it.
• Stopping at the human merge-approval boundary. Nothing was pushed or merged.

Written by Devin

[devin-ai-integration]

PR #233 at 733c0a9 passed E2E with no defects, so there's no fix PR. The report is posted: #233 (comment)

• Pin: a live git ls-remote shows upstream tag v7.0.2 points to exactly cf430e0. The action's input file (action.yml) is byte-identical to v7.0.1.
• Local run: actionlint, lint, typecheck and setup/doctor all pass at the PR head. The binary E2E suite passed 100 of 102 on the first run. The other 2 MCP cases failed only because my shell had a display variable set without X authorization; both pass headless, which is how CI runs them.
• Upload step: I ran the pinned v7.0.2 action code with the CI step's exact inputs against a throwaway local copy of GitHub's artifact service. It uploaded the real E2E report, and the zip unpacks to an identical file. When no report exists it exits 0 as configured. The old v7.0.1 code behaves the same.
• Real CI: all 9 required checks passed. The Node tests run (https://github.com/BetterWright/betterwright/actions/runs/38012339248) used v7.0.2 and published the binary-e2e-report artifact (5.46 KB).

Limitations:

• Video links: GitHub comments can't take a direct MP4 upload from my tools, so the comment embeds an animated WebP of the same recording. I confirmed GitHub serves that publicly. The MP4 link in the comment needs a Devin login; the MP4 is also attached here.
• Local GitHub Actions runner (act 0.2.89): its built-in artifact server rejects both v7.0.1 and v7.0.2, so the problem is in the emulator, not this PR. That's why I used my own throwaway service instead.
• Not tested: browser, CLI, SDK, MCP and UI behaviour (nothing in the diff touches them), and GitHub's real artifact service from my machine (it needs a runner token). The real CI run covers the latter.

Nothing was pushed or merged; merging is up to you.

This response includes attachments — view them in Devin