Bump actions/upload-artifact from 6 to 7 by dependabot[bot] · Pull Request #353 · senzing-garage/sz-python-tools

dependabot · 2026-03-18T22:54:41Z

Bumps actions/upload-artifact from 6 to 7.

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in actions/upload-artifact#754

Upgrade the module to ESM and bump dependencies by @danwkennedy in actions/upload-artifact#762

Support direct file uploads by @danwkennedy in actions/upload-artifact#764

New Contributors

@Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

Commits

bbbca2d Support direct file uploads (#764)
589182c Upgrade the module to ESM and bump dependencies (#762)
47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
02a8460 Add proxy integration test
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Resolves #764
Resolves #762
Resolves #754
Resolves actions/upload-artifact#754
Resolves actions/upload-artifact#762
Resolves actions/upload-artifact#764

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v6...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-03-18T22:55:31Z

🤖 Claude Code Review

PR Code Review

This PR upgrades actions/upload-artifact from v6 to v7 across three CI workflow files.

Code Quality

✅ Style guide: No application code changes; workflow files follow existing patterns.
✅ No commented-out code
✅ Meaningful variable names: N/A
✅ DRY principle: The same version bump is applied consistently across all three workflow files.
✅ Defects: No logic errors or bugs introduced. This is a straightforward dependency version bump.
✅ CLAUDE.md: No issues with the project configuration.

Testing

✅ Unit/integration tests: N/A — no application code changed.
✅ Edge cases: N/A
✅ Test coverage: N/A

Documentation

✅ README: No update needed.
✅ API docs: N/A
✅ Inline comments: N/A
✅ CHANGELOG.md: Not updated, but acceptable for a minor CI dependency bump.
✅ Markdown formatting: N/A

Security

✅ No hardcoded credentials
✅ No sensitive data
✅ No license files (.lic) checked in
⚠️ Action version pinning: The actions are pinned to a major version tag (@v7) rather than a full commit SHA. For improved supply chain security, consider pinning to a specific commit SHA (e.g., actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08). This is a best practice but not a blocker.

Summary

This is a clean, minimal PR. The only note worth considering is pinning to a commit SHA for supply chain security hardness, but the major version pin (`@v7`) is a common and acceptable practice. Approved.

Automated code review analyzing defects and coding standards

github-actions · 2026-03-18T22:57:19Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

…ifact-7

github-actions · 2026-03-19T16:19:12Z

🤖 Claude Code Review

PR Code Review

This PR updates actions/upload-artifact from v6 to v7 across three CI workflow files.

Code Quality

✅ Style guide: Simple version bump, no style concerns.
✅ No commented-out code
✅ Meaningful variable names: N/A
✅ DRY principle: The same change is made consistently across all three workflow files.
✅ Defects: No logic errors. The change is a straightforward dependency version bump with no behavioral concerns for this usage pattern (upload-artifact@v7 is backward-compatible for basic artifact uploads).
✅ CLAUDE.md: No issues with the project memory configuration.

Testing

✅ Unit/integration tests: N/A — CI configuration change only.
✅ Edge cases: N/A
✅ Test coverage: N/A

Documentation

✅ README: No update needed.
✅ API docs: N/A
✅ Inline comments: N/A
✅ CHANGELOG.md: Not updated, but acceptable for a minor dependency bump in CI infrastructure.
✅ Markdown formatting: N/A — YAML files only.

Security

✅ No hardcoded credentials
✅ Input validation: N/A
✅ Error handling: N/A
✅ No sensitive data in logs
✅ No license files

Summary: Clean, minimal PR. The upgrade from `upload-artifact@v6` to `v7` is applied consistently across all three platform workflows (darwin, linux, windows). No issues found. ✅ Approved.

Automated code review analyzing defects and coding standards

github-actions · 2026-03-19T16:21:19Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

dependabot Bot assigned kernelsam Mar 18, 2026

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 18, 2026

dependabot Bot requested a review from a team as a code owner March 18, 2026 22:54

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 18, 2026

kernelsam approved these changes Mar 19, 2026

View reviewed changes

Merge branch 'main' into dependabot/github_actions/actions/upload-art…

72f6d6e

…ifact-7

kernelsam enabled auto-merge (squash) March 19, 2026 16:18

kernelsam merged commit f213327 into main Mar 19, 2026
75 checks passed

kernelsam deleted the dependabot/github_actions/actions/upload-artifact-7 branch March 19, 2026 16:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump actions/upload-artifact from 6 to 7#353

Bump actions/upload-artifact from 6 to 7#353
kernelsam merged 2 commits intomainfrom
dependabot/github_actions/actions/upload-artifact-7

dependabot Bot commented on behalf of github Mar 18, 2026 •

edited by github-actions Bot

Loading

Uh oh!

github-actions Bot commented Mar 18, 2026

Uh oh!

github-actions Bot commented Mar 18, 2026

Uh oh!

github-actions Bot commented Mar 19, 2026

Uh oh!

github-actions Bot commented Mar 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Mar 18, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.0

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

Uh oh!

github-actions Bot commented Mar 18, 2026

🤖 Claude Code Review

PR Code Review

Code Quality

Testing

Documentation

Security

Summary

This is a clean, minimal PR. The only note worth considering is pinning to a commit SHA for supply chain security hardness, but the major version pin (@v7) is a common and acceptable practice. Approved.

Uh oh!

github-actions Bot commented Mar 18, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Mar 19, 2026

🤖 Claude Code Review

PR Code Review

Code Quality

Testing

Documentation

Security

Summary: Clean, minimal PR. The upgrade from upload-artifact@v6 to v7 is applied consistently across all three platform workflows (darwin, linux, windows). No issues found. ✅ Approved.

Uh oh!

github-actions Bot commented Mar 19, 2026

Super-linter summary

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Mar 18, 2026 •

edited by github-actions Bot

Loading

This is a clean, minimal PR. The only note worth considering is pinning to a commit SHA for supply chain security hardness, but the major version pin (`@v7`) is a common and acceptable practice. Approved.

Summary: Clean, minimal PR. The upgrade from `upload-artifact@v6` to `v7` is applied consistently across all three platform workflows (darwin, linux, windows). No issues found. ✅ Approved.