[dependabot]

Bumps actions/download-artifact from 8.0.1 to 8.0.2.

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

• Update the readme by @​danwkennedy in actions/download-artifact#473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in actions/download-artifact#492
• Prepare download-artifact v8.0.2 by @​tunc-d in actions/download-artifact#493

New Contributors

• @​tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

• 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
• e455989 Prepare download-artifact v8.0.2
• a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
• 29bb7ce Update @​actions/artifact to 6.3.1
• 484a0b5 Update the readme (#473)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[harshsaver]

🤖 Agentbox PR audit: ready to merge

What this PR changes

• What it does: Updates GitHub’s helper for transferring build files between release and publishing jobs from version 8.0.1 to 8.0.2. Five references change across two pipeline definitions.
• What changes in the product: Nothing visible. The CLI, SDK, web workspace and installed binaries are unchanged.
• Why it exists: Dependabot’s monthly check found a newer release. It improves retries when GitHub’s artifact service is busy and includes bundled dependency and packaging fixes. Upstream release.
• Why merge (or why not yet): Both reviewers found the update consistent with its description and the repository’s pin policy. The helper keeps the same inputs, defaults and Node runtime. No product or design decision is needed.
• What to expect after merging: Watch the first release, npm publication and stable-promotion runs that use the updated pipeline. These are where the helper executes; green PR CI does not test these downloads. No additional implementation work is required.

Full audit (Claude (fable, xhigh) × Codex (gpt-6-astra, xhigh), 2 turns, commit ad7728b)

PR audit: #169 — chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2

Head: ad7728b

Sign-off

• Claude (fable, xhigh): ✅ satisfied — five identical SHA swaps, new SHA verified as the signed v8.0.2 release commit, action interface unchanged, follows the repo's pin policy and precedent.
• Codex (gpt-6-astra, xhigh): ✅ satisfied — independently verified the pins, interface, workflow consumers, upstream changes and policy; no blockers, only non-material corrections to the explanation and verification limits.

Decision

merge — verified patch bump with no blocking findings; all eleven CI checks pass, with the required maintainer/code-owner approval still outstanding.

What changes (plain language)

• What it does: Updates GitHub’s helper for transferring build files between release and publishing jobs from version 8.0.1 to 8.0.2. Five references change across two pipeline definitions.
• What changes in the product: Nothing visible. The CLI, SDK, web workspace and installed binaries are unchanged.
• Why it exists: Dependabot’s monthly check found a newer release. It improves retries when GitHub’s artifact service is busy and includes bundled dependency and packaging fixes. Upstream release.
• Why merge (or why not yet): Both reviewers found the update consistent with its description and the repository’s pin policy. The helper keeps the same inputs, defaults and Node runtime. No product or design decision is needed.
• What to expect after merging: Watch the first release, npm publication and stable-promotion runs that use the updated pipeline. These are where the helper executes; green PR CI does not test these downloads. No additional implementation work is required.

Findings

Blocking

• None.

Non-blocking

• .github/workflows/release.yml:180, .github/workflows/release.yml:227, .github/workflows/publish-npm-prerelease.yml:115, .github/workflows/publish-npm-prerelease.yml:164, .github/workflows/publish-npm-prerelease.yml:211 — comments remain # v8 instead of identifying the exact patch version. This is a pre-existing documentation convention, not a floating dependency: the executable reference is a fixed commit SHA. The comment remains accurate even if upstream moves its v8 tag. No change required for this PR.
• .github/workflows/ci.yml:3, .github/workflows/release.yml:3, .github/workflows/publish-npm-prerelease.yml:3 — all eleven PR checks pass, but none executes download-artifact. The changed steps run on release-tag pushes or explicit npm workflow dispatches. Ordinary publication also does not exercise the separate cross-run download in the latest promotion job at .github/workflows/publish-npm-prerelease.yml:211. Observe that step when stable promotion next uses the updated workflow. This is a coverage limitation, not a demonstrated regression.

Fix plan

n/a

Message to the developer

n/a

Questions for Harsh

n/a

Verification

• PR and discussion: Attempted the requested gh pr view 169 -R october-dev/october-bus --comments; the installed CLI failed on its deprecated Projects Classic query. Successfully read the description, comments, reviews, requested reviewer, changed files, head SHA and checks using explicit --json fields, and inspected the PR page. There are no discussion comments or submitted reviews. The description links upstream release work, with no additional product issue identified.

• Exact diff and checkout: Read git diff b5bc072a8d2adab5fad32252c6c8621225a9fb9e...HEAD in full. Exactly five substitutions replace 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with 9000827ccba6bdab643e8b6fd33ac0654aef8333; no other tokens change. Repository search found exactly five new references and no old references. git diff --check passed, HEAD matches the requested commit, and the checkout remained clean.

• Surrounding workflows: Read both touched workflows and ci.yml in full. Traced the uploads at .github/workflows/release.yml:151 and .github/workflows/publish-npm-prerelease.yml:97 to their downloads. Names, destinations, pattern matching, merged extraction, job dependencies, permissions and publication gates are unchanged. The five consumers use only name, path, pattern, merge-multiple, run-id and github-token.

• Release identity: Independently followed the release-to-commit links: v8.0.1 identifies the old full SHA, and v8.0.2 identifies the new full SHA. GitHub marks the new release commit’s signature verified. This establishes release identity; it is not a substitute for checking behavior.

• Interface and action source: Compared all 53 rendered lines of action.yml at both immutable commits; they match. All ten inputs and defaults, the output, runs.using: node24, and main: dist/index.js are unchanged. Also compared all 233 rendered lines of src/download-artifact.ts; they match, including artifact selection, destination handling and digest-mismatch failure behavior. Sources: old metadata, new metadata, old source, new source.

• Upstream scope: Reviewed the linked README, dependency and release-preparation changes. The manifests and lockfiles move @actions/artifact from resolved 6.2.1 to 6.3.1, with regenerated bundle and licence metadata. This includes the dependency refresh from toolkit 6.2.2 as well as 6.3.0’s retry changes and 6.3.1’s production RPC dependency fix; the original audit’s explanation omitted that intermediate refresh. The new lockfile declares @protobuf-ts/runtime-rpc as a production dependency. Sources: old lockfile, new lockfile, toolkit release notes.

• Retry behavior red-team: Read the changed internal service client and relevant upstream tests. Positive-integer Retry-After values are honored on HTTP 429, including invalid-JSON responses; unsupported values use backoff starting at eight seconds. Five total attempts remain the limit. The 120-second bound applies to accumulated retry sleep for an individual service request, not total download or workflow duration. A requested sleep exceeding the remaining budget causes failure before sleeping. Tests cover malformed headers, budget boundaries, mixed failures and no sleep after the final attempt. Sources: client, tests. These tests were inspected, not executed locally.

• Cross-run promotion: .github/workflows/publish-npm-prerelease.yml:176 grants actions: read; line 211 supplies the selected run ID and GitHub token. scripts/candidate-run.mjs:6 validates the original run’s repository, main branch, workflow, event and successful completion. The unchanged action forwards token-based lookups through findBy, which selects the toolkit’s public API path. The new internal-service retry policy should therefore not be described as applying identically to this promotion path. Toolkit client routing.

• Upload compatibility and upstream validation: The upload pin 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a is v7.0.1. Upstream’s test workflow exercises archived uploads from v4, direct uploads from v7, and single/pattern/merged downloads on Linux, macOS and Windows. This supports compatibility but does not establish an exact run of our pinned upload/download pair or promotion workflow. PR #492 shows two approving reviews and 14 passing checks; PR #493 reports rebuilding the bundle twice without differences.

• Policy and ruleset: Read CONTRIBUTING.md, docs/dependencies.md, docs/releases.md, .github/CODEOWNERS and .github/dependabot.yml. docs/dependencies.md:5 identifies workflow files as the action pin record, satisfying CONTRIBUTING.md:62. Git history confirms PR chore(deps): bump anchore/sbom-action from 006b7ce8314066bdf1765b4500370d40fa6917a3 to 3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 #148 (d33aeab) used the same workflow-only approach. The PR reuses the established dependency, adds no compatibility layer, configuration, abstraction or architectural change, and introduces no visible product behavior. The simplicity, modularity, dependency-reuse and long-term-design rules require no additional work here.

• Merge gates: GitHub reports MERGEABLE, BLOCKED and REVIEW_REQUIRED, with eleven completed successful checks and a review request for Harsh. CONTRIBUTING.md:58 requires maintainer approval for external contributions; line 59 requires code-owner review, and .github/CODEOWNERS:10 assigns these files to Harsh. The merge recommendation does not replace that approval.

• Limits and execution: No contributor code, installs, tests, builds or scripts were executed, as instructed. No GitHub state or checkout files were changed. No actionlint/zizmor configuration or invocation was found. Some upstream API/compare requests were unavailable; release pages, individual changes and immutable source files supplied the verification above. The browser rejected the generated bundle because it exceeds its size limit, so Codex did not independently inspect or reproduce the entire shipped bundle. The audit is returned here without filesystem writes.

Audit log

• Turn 1 (Claude (fable, xhigh)): Read the full diff and all three workflows plus policy docs; verified tag→SHA, action.yml, package.json/lockfile, toolkit release notes, upstream PR #492 reviews and upstream interop tests via github.com pages (gh api denied in sandbox); confirmed pin-record policy and merge precedent in git history; no blocking findings; decision merge.
• Turn 2 (Codex (gpt-6-astra, xhigh)): Independently checked the diff, workflows, CI, release identities, unchanged metadata/source, dependency records, retry implementation/tests, promotion permissions and repository policy. Retained merge with no blockers. Corrected the retry-budget scope, noted the intermediate dependency refresh, clarified upstream coverage and fixed-pin comments, removed speculative follow-up wording, and documented verification limits. No material changes.

Final checks

Not run here: this PR is from an outside contributor, so its code is never executed on this machine. Rely on CI before merging.

_{Automated review by Harsh's agentbox: two AI reviewers audited this PR against the project ruleset and agreed on it.}