[dependabot]

Bumps actions/upload-artifact from 7.0.1 to 7.0.2.

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[harshsaver]

🤖 Agentbox PR audit: ready to merge

What this PR changes

• What it does: Updates GitHub’s artifact upload action from 7.0.1 to 7.0.2 in three places across the release and npm publication workflows.
• What changes in the product: Nothing visible. No application, binary, SDK or UI source changes.
• Why it exists: Monthly dependency maintenance brings in improved handling when GitHub’s artifact service asks requests to slow down. The shared request handling also serves artifact creation and finalization during uploads. Upstream upload implementation.
• Why merge (or why not yet): The new revision matches the official release, and our existing upload settings remain supported. No blocking regression or ruleset violation was found.
• What to expect after merging: No immediate product effect. Watch uploads during the first tagged release containing this update or the next new npm package publication. Requests may wait longer during service trouble. Ordinary PR checks do not exercise these uploads; complete the usual owner review before merging.

Full audit (Claude (fable, xhigh) × Codex (gpt-6-astra, xhigh), 2 turns, commit 227b6b3)

PR audit: #176 — chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2

Head: 227b6b3

Sign-off

• Claude (fable, xhigh): ✅ satisfied — three identical SHA swaps, verified against the upstream v7.0.2 tag; no interface or workflow change, no blocking findings.
• Codex (gpt-6-astra, xhigh): ✅ satisfied — independently confirmed merge; corrected non-blocking timing, dependency and release-policy claims.

Decision

merge — verified official release pin with compatible inputs and 11 passing checks; normal maintainer/code-owner approval remains required.

What changes (plain language)

• What it does: Updates GitHub’s artifact upload action from 7.0.1 to 7.0.2 in three places across the release and npm publication workflows.
• What changes in the product: Nothing visible. No application, binary, SDK or UI source changes.
• Why it exists: Monthly dependency maintenance brings in improved handling when GitHub’s artifact service asks requests to slow down. The shared request handling also serves artifact creation and finalization during uploads. Upstream upload implementation.
• Why merge (or why not yet): The new revision matches the official release, and our existing upload settings remain supported. No blocking regression or ruleset violation was found.
• What to expect after merging: No immediate product effect. Watch uploads during the first tagged release containing this update or the next new npm package publication. Requests may wait longer during service trouble. Ordinary PR checks do not exercise these uploads; complete the usual owner review before merging.

Findings

Blocking

• None.

Non-blocking

• Release-only coverage — .github/workflows/release.yml:151, .github/workflows/publish-npm-prerelease.yml:97, :145: the 11 passing checks do not execute the changed upload steps. ci.yml contains no upload-artifact invocation. Native uploads require a v* tag; npm uploads require a dispatch on main with channel next or candidate (publish-npm-prerelease.yml:34). A latest promotion skips these upload jobs. Acceptable for this dependency update, but CI is not an upload integration test.

• Retry behavior and timing correction — same three upload steps: the shared artifact client honors positive integer Retry-After seconds on HTTP 429, raises initial fallback delay from 3 to 8 seconds, retains at most five attempts, and caps accumulated retry sleep at 120 seconds per request. Creation and finalization are separate requests; this is not a two-minute limit on the entire upload step. Requests fail without another retry if the next delay would exceed the budget. Upstream retry implementation. The affected jobs omit timeout-minutes, which means GitHub’s default 360-minute timeout, not unlimited execution. The previous “cannot time a job out” claim was incorrect; no specific timeout conflict is demonstrated here. GitHub workflow reference.

• Version comment — same three lines: the preserved # v7 comment identifies the major version, while the full SHA controls execution. It is compatible with v7.0.2 and does not introduce floating execution. Matching checkout’s more detailed comment style is optional and does not justify changing this PR.

• Existing approval policy — CONTRIBUTING.md:58 requires approving maintainer/code-owner review; GitHub currently reports REVIEW_REQUIRED, with Harsh requested. Separately, scripts/release-policy.mjs:12 checks the PR whose merge commit equals the selected release/evidence SHA. Its independent-review route requires approval of that PR’s final head before merge (:28); an explicit release by a human repository administrator is another supported route (:4, :51). Unresolved trusted change requests block both routes (:25). This does not mean every subsequent release checks this PR’s approval merely because it is an ancestor. Approve the final head under the normal merge policy; this audit is not a GitHub approval.

• Sibling updates — inspected local refs for PR chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 #169 (download-artifact) and chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 #174 (setup-node). Their workflow edits affect different lines from this PR, with no overlapping edits identified. No ordering dependency was found. Any resulting rebase must still receive the normal final-head checks and review.

Fix plan

n/a

Message to the developer

n/a

Questions for Harsh

n/a

Verification

• Read the complete git diff b5bc072a8d2adab5fad32252c6c8621225a9fb9e...HEAD, both affected workflows in full, and surrounding CI/release policy. Exactly two files and three identical replacements: 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a → cf430e030ddbb5b0abf93d22962f4752f3646cd9. Inputs, triggers, permissions, artifact names, paths and downstream download pins are unchanged. git diff --check passed; the checkout remains clean.

• Attempted the requested gh pr view 176 -R october-dev/october-bus --comments; it failed on the CLI’s deprecated Projects-classic GraphQL field. Successfully read the description, comments, reviews, requested reviewers, files, commits, head and checks through gh pr view --json. Returned comments and reviews were empty. No linked product issue appeared in the description; followed the upstream release and implementation references.

• Independently verified both release-to-commit mappings through the official release pages and their full commit links: v7.0.1 and v7.0.2. Read both pinned action manifests: inputs, defaults, outputs and Node 24 entry point match. The default remains zipped uploads, preserving the existing downstream download usage. Old manifest, new manifest. No action-output consumers or merge-action uses were found in .github/.

• Checked both pinned lockfiles. Resolved versions change for @actions/artifact 6.2.0 → 6.3.1, @actions/core 3.0.0 → 3.0.1, @actions/github 9.0.0 → 9.1.1 and @actions/http-client 4.0.0 → 4.0.1. Azure storage remains 12.31.0, protobuf RPC runtime remains 2.11.1, and the resolved undici remains 6.23.0. Therefore the previous dependency explanation was incomplete. Old lockfile, new lockfile. GitHub library 9.1.0 also adds a conditional orchestration identifier to its user-agent; artifact 6.3.1 explicitly declares its protobuf RPC runtime dependency. GitHub changelog, artifact packaging fix.

• Statically reviewed the retry implementation, upload creation/finalization call sites, and upstream tests covering malformed headers/bodies, five-attempt exhaustion and the sleep-budget boundary. These support the corrected behavior description. Toolkit change and tests. Upstream reports 31 action tests and reproducible bundle regeneration; these were not reproduced locally. Upload-action update.

• Checked every ruleset category against the scope. The PR reuses the established official dependency without adding compatibility layers, obsolete paths, abstractions, configuration or architectural changes. Product behavior, modularity and delivery layering are unaffected. The public pin-record requirement at CONTRIBUTING.md:62 is satisfied: docs/dependencies.md:5 explicitly makes workflow files the action pin record. .github/CODEOWNERS:10 assigns workflow ownership to Harsh. Also verified the cited PR chore(deps): bump anchore/sbom-action from 006b7ce8314066bdf1765b4500370d40fa6917a3 to 3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 #148 precedent.

• GitHub reports all 11 checks successful, with none failing or pending, in CI run 41340268691. Their job names match ci.yml, covering the runtime platforms, SDK, Node compatibility, npm platforms, interoperability, hosted behavior, workspace UI and vulnerabilities.

• Limits: No contributor code, installs, tests, builds or scripts were executed. No GitHub mutations occurred. The upstream compare endpoint was unavailable, so constituent PRs #821/#822 and pinned manifests/lockfiles were inspected instead. The full generated upload bundle exceeded the web tool’s size limit; only the rendered merge-bundle changes and underlying library source were reviewable. Bundle reproducibility and signatures were not independently verified. Release workflows were not dispatched. The workspace is read-only, so the updated audit is returned here without writing checkout files.

Audit log

• Turn 1 (Claude (fable, xhigh)): Read diff, both workflow files, ci.yml, dependabot.yml, CODEOWNERS, CONTRIBUTING.md, docs/dependencies.md, docs/releases.md, scripts/release-policy.mjs. Verified upstream tag→SHA for both pins, action.yml parity, package.json/lockfile deltas, toolkit changelogs, upstream PRs #821/#2534, issue search. Confirmed 11/11 CI checks green and the pin-record precedent. Decision: merge; no blocking findings; five non-blocking notes (CI non-coverage, retry behaviour change, floating # v7 comment, approval-before-merge for release policy, sibling Dependabot PRs).
• Turn 2 (Codex (gpt-6-astra, xhigh)): Independently verified the diff, workflows, policy, PR metadata, CI, release commits, manifests, dependency versions, retry source/tests and sibling edits. Confirmed merge with no blocking findings. Corrected per-request versus whole-step retry timing, default job timeout, omitted dependency behavior, npm promotion coverage and release-policy scope. No material changes.

Final checks

Not run here: this PR is from an outside contributor, so its code is never executed on this machine. Rely on CI before merging.

_{Automated review by Harsh's agentbox: two AI reviewers audited this PR against the project ruleset and agreed on it.}