x15904151985/iptvnator
1
0 Fork 0
mirror of https://github.com/4gray/iptvnator.git synced 2026-10-10 18:36:15 -08:00
Code Issues Packages Projects Releases Wiki Activity

ci(deps): bump checkout/upload-artifact/download-artifact majors

Browse Source 
Supersedes the three individual Dependabot PRs (#1249, #1245, #1247) so the
pinned-SHA contract stays consistent in one commit.

actions/checkout v4 -> v7, actions/upload-artifact v4 -> v7 and
actions/download-artifact v4 -> v8 across every workflow. docker.yml moves
from checkout v6 to v7 with the rest.

publish-snap.yaml keeps full-commit pins, so the three new SHAs are updated
there and in the packaging policy tests that assert them
(snap-workflow-policy.test-helpers.mjs, publish-snap-workflow.test.mjs,
release-snap-assets.test.mjs). Each SHA was checked against the upstream tag
refs: checkout 3d3c42e5 = v7.0.1, upload-artifact 043fb46d = v7.0.1,
download-artifact 3e5f45b2 = v8.0.1. BUILD_ACTION_ALLOWLIST follows the
unpinned bumps in build-and-make.yaml.

download-artifact v8 changes two behaviours that matter for the Snap publish
path, both in our favour: an artifact digest mismatch now fails the run
instead of logging a warning, and the action only unzips responses whose
Content-Type says zip. The publish job downloads a normal upload-artifact
artifact by name, so decompression is unchanged, and it re-verifies the
receipt digest itself regardless.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
4grayandClaude Opus 5 committed 2026-07-26 02:24:52 +02:00
1 parent 7e8c2ccce1
commit 319a0404aa
10 files changed
+39 -39
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/build-and-make.yaml
+12 -12
View File
@@ -56,7 +56,7 @@ jobs:
steps: steps:
- name: Checkout code - name: Checkout code
uses: actions/checkout@v4 uses: actions/checkout@v7
- name: Setup Node.js - name: Setup Node.js
uses: actions/setup-node@v4 uses: actions/setup-node@v4
@@ -322,7 +322,7 @@ jobs:
test -s "${RUNTIME_ROOT}/source-archive-binding.json" test -s "${RUNTIME_ROOT}/source-archive-binding.json"
- name: Upload staged Linux runtime - name: Upload staged Linux runtime
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7
with: with:
name: linux-embedded-mpv-runtime name: linux-embedded-mpv-runtime
path: vendor/embedded-mpv/linux-x64 path: vendor/embedded-mpv/linux-x64
@@ -330,7 +330,7 @@ jobs:
retention-days: 7 retention-days: 7
- name: Upload Linux runtime source compliance - name: Upload Linux runtime source compliance
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7
with: with:
name: linux-frame-copy-runtime-sources name: linux-frame-copy-runtime-sources
path: dist/compliance/linux-frame-copy-runtime-sources.tar.xz path: dist/compliance/linux-frame-copy-runtime-sources.tar.xz
@@ -370,7 +370,7 @@ jobs:
steps: &electron-build-steps steps: &electron-build-steps
- name: Checkout code - name: Checkout code
uses: actions/checkout@v4 uses: actions/checkout@v7
- name: Install pnpm - name: Install pnpm
uses: pnpm/action-setup@v4 uses: pnpm/action-setup@v4
@@ -424,7 +424,7 @@ jobs:
- name: Download pinned Linux Embedded MPV runtime - name: Download pinned Linux Embedded MPV runtime
if: matrix.os == 'linux' if: matrix.os == 'linux'
uses: actions/download-artifact@v4 uses: actions/download-artifact@v8
with: with:
name: linux-embedded-mpv-runtime name: linux-embedded-mpv-runtime
path: vendor/embedded-mpv/linux-x64 path: vendor/embedded-mpv/linux-x64
@@ -1187,7 +1187,7 @@ jobs:
- name: Upload artifacts (macOS) - name: Upload artifacts (macOS)
if: matrix.os == 'macos' if: matrix.os == 'macos'
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7
with: with:
name: macos-${{ matrix.arch }}-artifacts name: macos-${{ matrix.arch }}-artifacts
path: | path: |
@@ -1199,7 +1199,7 @@ jobs:
- name: Upload system-runtime Linux artifacts - name: Upload system-runtime Linux artifacts
if: matrix.os == 'linux' && matrix.linux_profile == 'system' if: matrix.os == 'linux' && matrix.linux_profile == 'system'
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7
with: with:
name: linux-system-artifacts name: linux-system-artifacts
path: | path: |
@@ -1211,7 +1211,7 @@ jobs:
- name: Upload portable-runtime Linux artifacts - name: Upload portable-runtime Linux artifacts
if: matrix.os == 'linux' && matrix.linux_profile == 'portable' if: matrix.os == 'linux' && matrix.linux_profile == 'portable'
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7
with: with:
name: linux-portable-artifacts name: linux-portable-artifacts
path: | path: |
@@ -1223,7 +1223,7 @@ jobs:
- name: Upload Flatpak-runtime Linux artifacts - name: Upload Flatpak-runtime Linux artifacts
if: matrix.os == 'linux' && matrix.linux_profile == 'flatpak' if: matrix.os == 'linux' && matrix.linux_profile == 'flatpak'
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7
with: with:
name: linux-flatpak-artifacts name: linux-flatpak-artifacts
path: | path: |
@@ -1232,7 +1232,7 @@ jobs:
- name: Upload artifacts (Windows) - name: Upload artifacts (Windows)
if: matrix.os == 'windows' if: matrix.os == 'windows'
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7
with: with:
name: windows-artifacts name: windows-artifacts
path: | path: |
@@ -1294,10 +1294,10 @@ jobs:
steps: steps:
- name: Checkout code - name: Checkout code
uses: actions/checkout@v4 uses: actions/checkout@v7
- name: Download all artifacts - name: Download all artifacts
uses: actions/download-artifact@v4 uses: actions/download-artifact@v8
with: with:
path: artifacts path: artifacts
.github/workflows/ci.yml
+5 -5
View File
@@ -29,7 +29,7 @@ jobs:
steps: steps:
- name: Checkout code - name: Checkout code
uses: actions/checkout@v4 uses: actions/checkout@v7
# Image pinned by digest (tag 1.7.12). False positives are # Image pinned by digest (tag 1.7.12). False positives are
# suppressed in .github/actionlint.yaml; shellcheck runs at # suppressed in .github/actionlint.yaml; shellcheck runs at
@@ -53,7 +53,7 @@ jobs:
steps: steps:
- name: Checkout code - name: Checkout code
uses: actions/checkout@v4 uses: actions/checkout@v7
# The gate scripts are dependency-free Node, so this job skips # The gate scripts are dependency-free Node, so this job skips
# pnpm install entirely and stays cheap. # pnpm install entirely and stays cheap.
@@ -92,7 +92,7 @@ jobs:
steps: steps:
- name: Checkout code - name: Checkout code
uses: actions/checkout@v4 uses: actions/checkout@v7
with: with:
# nx affected needs the merge-base with the PR target branch. # nx affected needs the merge-base with the PR target branch.
fetch-depth: 0 fetch-depth: 0
@@ -133,7 +133,7 @@ jobs:
steps: steps:
- name: Checkout code - name: Checkout code
uses: actions/checkout@v4 uses: actions/checkout@v7
- name: Install pnpm - name: Install pnpm
uses: pnpm/action-setup@v4 uses: pnpm/action-setup@v4
@@ -167,7 +167,7 @@ jobs:
- name: Upload unit coverage artifact - name: Upload unit coverage artifact
if: always() if: always()
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7
with: with:
name: unit-coverage name: unit-coverage
path: | path: |
.github/workflows/codeql-analysis.yml
+1 -1
View File
@@ -38,7 +38,7 @@ jobs:
steps: steps:
- name: Checkout repository - name: Checkout repository
uses: actions/checkout@v4 uses: actions/checkout@v7
# Initializes the CodeQL tools for scanning. PR runs analyze the merge # Initializes the CodeQL tools for scanning. PR runs analyze the merge
# commit checked out above (the modern default); JavaScript is # commit checked out above (the modern default); JavaScript is
.github/workflows/deploy-website.yml
+1 -1
View File
@@ -24,7 +24,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Checkout code - name: Checkout code
uses: actions/checkout@v4 uses: actions/checkout@v7
- name: Install pnpm - name: Install pnpm
uses: pnpm/action-setup@v4 uses: pnpm/action-setup@v4
.github/workflows/docker.yml
+1 -1
View File
@@ -42,7 +42,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@v7
- name: Prepare Docker metadata - name: Prepare Docker metadata
id: docker-meta id: docker-meta
.github/workflows/e2e-tests.yaml
+4 -4
View File
@@ -49,7 +49,7 @@ jobs:
os: [ubuntu-latest, macos-latest, windows-latest] os: [ubuntu-latest, macos-latest, windows-latest]
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v7
- name: Install pnpm - name: Install pnpm
uses: pnpm/action-setup@v4 uses: pnpm/action-setup@v4
@@ -87,7 +87,7 @@ jobs:
- name: Upload Electron Test Results - name: Upload Electron Test Results
if: always() if: always()
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7
with: with:
name: playwright-report-electron-${{ matrix.os }} name: playwright-report-electron-${{ matrix.os }}
path: | path: |
@@ -103,7 +103,7 @@ jobs:
NX_SKIP_NX_CACHE: true NX_SKIP_NX_CACHE: true
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v7
- name: Install pnpm - name: Install pnpm
uses: pnpm/action-setup@v4 uses: pnpm/action-setup@v4
@@ -131,7 +131,7 @@ jobs:
- name: Upload Web Test Results - name: Upload Web Test Results
if: always() if: always()
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7
with: with:
name: playwright-report-web-ubuntu name: playwright-report-web-ubuntu
path: | path: |
.github/workflows/publish-snap.yaml
+3 -3
View File
@@ -21,7 +21,7 @@ jobs:
steps: steps:
- name: Checkout released tooling - name: Checkout released tooling
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with: with:
ref: ${{ github.event.release.tag_name }} ref: ${{ github.event.release.tag_name }}
persist-credentials: false persist-credentials: false
@@ -121,7 +121,7 @@ jobs:
printf 'receipt-sha256=%s\n' "${RECEIPT_SHA256}" >> "${GITHUB_OUTPUT}" printf 'receipt-sha256=%s\n' "${RECEIPT_SHA256}" >> "${GITHUB_OUTPUT}"
- name: Transfer verified release assets - name: Transfer verified release assets
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
with: with:
name: verified-snap-release-assets name: verified-snap-release-assets
path: /var/lib/iptvnator-snap-release/assets path: /var/lib/iptvnator-snap-release/assets
@@ -139,7 +139,7 @@ jobs:
steps: steps:
- name: Download verified release assets - name: Download verified release assets
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
with: with:
name: verified-snap-release-assets name: verified-snap-release-assets
path: ${{ runner.temp }}/verified-snap-release-assets path: ${{ runner.temp }}/verified-snap-release-assets
tools/packaging/publish-snap-workflow.test.mjs
+3 -3
View File
@@ -174,13 +174,13 @@ test('isolates released verification from the fresh credentialed upload runner',
assert.deepEqual( assert.deepEqual(
verifyJob.steps.filter((step) => step.uses).map((step) => step.uses), verifyJob.steps.filter((step) => step.uses).map((step) => step.uses),
[ [
'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5', 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1',
'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02', 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a',
] ]
); );
assert.deepEqual( assert.deepEqual(
publishJob.steps.filter((step) => step.uses).map((step) => step.uses), publishJob.steps.filter((step) => step.uses).map((step) => step.uses),
['actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'] ['actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c']
); );
const bindingStep = verifyJob.steps.find( const bindingStep = verifyJob.steps.find(
tools/packaging/release-snap-assets.test.mjs
+3 -3
View File
@@ -1563,7 +1563,7 @@ test('publish workflow installs the source verifier and binds the release tag re
); );
assert.equal( assert.equal(
checkoutStep.uses, checkoutStep.uses,
'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
); );
assert.equal(snapcraftStep.uses, undefined); assert.equal(snapcraftStep.uses, undefined);
assert.match( assert.match(
@@ -1594,11 +1594,11 @@ test('publish workflow installs the source verifier and binds the release tag re
); );
assert.equal( assert.equal(
transferStep.uses, transferStep.uses,
'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
); );
assert.equal( assert.equal(
artifactDownloadStep.uses, artifactDownloadStep.uses,
'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093' 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
); );
assert.ok( assert.ok(
publishJob.steps.indexOf(artifactDownloadStep) < publishJob.steps.indexOf(artifactDownloadStep) <
tools/packaging/snap-workflow-policy.test-helpers.mjs
+6 -6
View File
@@ -2,11 +2,11 @@ import assert from 'node:assert/strict';
import { parse } from 'yaml'; import { parse } from 'yaml';
const PINNED_CHECKOUT_ACTION = const PINNED_CHECKOUT_ACTION =
'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'; 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1';
const PINNED_UPLOAD_ARTIFACT_ACTION = const PINNED_UPLOAD_ARTIFACT_ACTION =
'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'; 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a';
const PINNED_DOWNLOAD_ARTIFACT_ACTION = const PINNED_DOWNLOAD_ARTIFACT_ACTION =
'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'; 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c';
const PUBLISH_ACTION_ALLOWLIST = Object.freeze([ const PUBLISH_ACTION_ALLOWLIST = Object.freeze([
PINNED_CHECKOUT_ACTION, PINNED_CHECKOUT_ACTION,
PINNED_DOWNLOAD_ARTIFACT_ACTION, PINNED_DOWNLOAD_ARTIFACT_ACTION,
@@ -16,10 +16,10 @@ const BUILD_ACTION_ALLOWLIST = Object.freeze([
'actions/cache/restore@v4', 'actions/cache/restore@v4',
'actions/cache/save@v4', 'actions/cache/save@v4',
'actions/cache@v4', 'actions/cache@v4',
'actions/checkout@v4', 'actions/checkout@v7',
'actions/download-artifact@v4', 'actions/download-artifact@v8',
'actions/setup-node@v4', 'actions/setup-node@v4',
'actions/upload-artifact@v4', 'actions/upload-artifact@v7',
'pnpm/action-setup@v4', 'pnpm/action-setup@v4',
'softprops/action-gh-release@v2', 'softprops/action-gh-release@v2',
]); ]);