ci: upgrade upload-artifact action to v4 in scorecard workflow #367
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes: bpfman#348. Upgrade from actions/upload-artifact@v3-node20 (previously referenced as "v3.pre.node20" in the existing comment) to v4. Determine the previous and v4 commit SHAs: $ git tag --contains 97a0fba1372883ab732affbe8f94b823f91727db v3-node20 v3.2.0-node20 v3.2.1-node20 $ git ls-remote https://github.com/actions/upload-artifact.git refs/tags/v4 65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 refs/tags/v4 $ git tag --contains 65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 v4 v4.6.0 Bump straight to v4 after reviewing the migration documentation[1] because: - The workflow uploads a single artefact once, so v4’s restriction on multiple uploads to the same name and its new merging behaviour do not affect our usage. - The retention-days input remains unchanged in v4. While neither v3 nor v4 explicitly define a default in their action.yml, GitHub’s documentation[2] states that artifacts default to 90 days unless overridden in repository settings. Since v4 does not specify a new default, it continues using GitHub’s 90-day retention policy, as before. - Hidden files are not relevant to this artefact, so their exclusion (introduced in v4.4) has no impact. Since v4.6.0 maintains this behaviour, upgrading does not introduce any changes affecting this workflow. [1] https://github.com/actions/upload-artifact/blob/main/docs/MIGRATION.md [2] https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/storing-and-sharing-data-from-a-workflow Signed-off-by: Andrew McDermott <amcdermo@redhat.com>
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #367 +/- ##
=======================================
Coverage 28.12% 28.12%
=======================================
Files 128 128
Lines 11207 11207
=======================================
Hits 3152 3152
Misses 7773 7773
Partials 282 282
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
anfredette
approved these changes
Jan 31, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes: #348.
Upgrade from actions/upload-artifact@v3-node20 (previously referenced as "v3.pre.node20" in the existing comment) to v4.
Determine the previous and v4 commit SHAs:
Bump straight to v4 after reviewing the migration documentation because:
The workflow uploads a single artefact once, so v4’s restriction on multiple uploads to the same name and its new merging behaviour do not affect our usage.
The retention-days input remains unchanged in v4. While neither v3 nor v4 explicitly define a default in their action.yml, GitHub’s documentation states that artifacts default to 90 days unless overridden in repository settings. Since v4 does not specify a new default, it continues using GitHub’s 90-day retention policy, as before.
Hidden files are not relevant to this artefact, so their exclusion (introduced in v4.4) has no impact. Since v4.6.0 maintains this behaviour, upgrading does not introduce any changes affecting this workflow.