[dependabot]

Bumps actions/upload-artifact from 7.0.1 to 7.0.2.

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

[qawatake]

@dependabot rebase

[qawatake]

Update review: actions/upload-artifact v7.0.1 → v7.0.2

Final decision: Proceed
Risk assessment: Medium — axes hit: test coverage (the changed step only runs if: failure(), so this repo's CI does not execute it; coverage relies on upstream CI of the exact commit). All other axes Low.
Review type: Approve
Release/deploy: Not required (no-release) — rationale: the PR only changes .github/workflows/ci.yml. The shipped artifact (main.js + manifest.json) is built locally and attached to GitHub releases; no workflow builds or publishes it, and this action is not on the bundled / emitted / generated path.

Changes reviewed (2.1)

• Primary sources consulted: release notes v7.0.2; compare v7.0.1...v7.0.2 (4 commits: PR #821 bump @actions/artifact to 6.3.1, PR #822 prepare release); upstream toolkit PRs actions/toolkit#2534 (honor Retry-After on HTTP 429, 6.3.0) and #2537 (declare protobuf RPC runtime dependency, 6.3.1).
• Version range reviewed: v7.0.1 → v7.0.2 (no intermediate release).
• Breaking / behavior changes: none documented. Behavior change: retries on HTTP 429 now honor valid Retry-After. Changed files: dist/upload/index.js, dist/merge/index.js, package.json, package-lock.json, .licenses/. action.yml is not changed, so inputs/outputs are identical.

Impact and adequacy of the PR (2.2, 2.3)

Change	Affected location / no impact	Evidence	Is the PR adequate
429 retry / Retry-After handling	ci.yml jobs e2e and test-e2e-tools, failure-only diagnostic upload of test-results/	grep upload-artifact .github/workflows/ci.yml: 2 usages, both if: failure() with name, path, retention-days: 7, if-no-files-found: ignore	Yes (both pins updated, comment # v7.0.2 matches)
@actions/artifact 6.3.1 (dependency declaration fix)	Bundled into the action's dist; no repo-side impact	action.yml unchanged; inputs used here unchanged	Yes

Verification (2.4)

• CI results, and what CI does not cover: this PR was rebased (@dependabot rebase) onto main 599803e after #51 (jdx/mise-action v5.1.1) was merged and its post-merge CI passed. On the new head 6b06276 (parent 599803e, diff still only the two upload-artifact pins, mise-action pins stay at v5.1.1), run 38997989233 — build, e2e, test-e2e-tools all success (e2e 1 passed). Earlier run on the pre-rebase head 834f710: 38944522153, also all success. The log shows the action at cf430e0... was downloaded, but the step was skipped because nothing failed. The changed code path is not exercised by this repo's CI.
• Additional checks I did: upstream checks on commit cf430e0 (Build on ubuntu/macos/windows, which upload and download artifacts, check-dist, Check licenses, CodeQL, test-proxy-upload) all success. Inputs used here are unchanged in action.yml.

Rollback, supply chain, license (2.5, 2.6, 2.7)

• Rollback: revert the SHA pin. No irreversible side effects.
• Supply chain: tag v7.0.2 → commit cf430e030ddbb5b0abf93d22962f4752f3646cd9 (lightweight, matches the pin), identical to actions/upload-artifact main HEAD. Release published 2026-10-07 by tunc-d, whereas v7.0.1 was published by yacaovsnc. Why that is acceptable: both PRs (#821, #822) came from branches inside actions/upload-artifact, so the author has write access there. Both were approved by GhadimiR, a long-time actions maintainer. The author also has merged PRs in actions/toolkit for the same @actions/artifact change. @actions/artifact@6.3.1 itself is published via npm trusted publishing with provenance. Neither v7.0.1 nor v7.0.2 is an immutable release, but this repo pins by commit SHA, so a re-pointed tag cannot reach this workflow. No issues opened in actions/upload-artifact since 2026-10-06. Published 10 days ago.
• License: MIT → MIT (unchanged).

Blocking conditions

• Hit: none. The verification for this change is upstream's CI on the exact commit plus an unchanged action.yml interface. I classify the lack of in-repo execution as a known constraint. If this step breaks, the only effect is a missing diagnostic artifact on a run that has already failed.

Requests

• None.

Unverified items / notes for other reviewers (2.9)

• Evidence reused across the rebase: release notes, compare, tag → SHA, upstream checks and license were collected for the same pinned commit cf430e0, which did not change with the rebase. Diff, CI and labels were re-checked on the new head.
• Unverified: this step running in this repo with v7.0.2. It will run the next time an e2e job fails. If the upload then errors, revert this pin.
• Unverified: whether tunc-d is a member of the actions org (membership is not public). The trust argument above rests on repository write access and maintainer approval, not on membership.