Skip to content

build(deps): bump actions/upload-artifact from 4 to 7 - #4

Merged
IamCoder18 merged 1 commit into
mainfrom
dependabot/github_actions/actions/upload-artifact-7
Sep 15, 2026
Merged

IamCoder18 merged 1 commit into
mainfrom
dependabot/github_actions/actions/upload-artifact-7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •

Copy link
Copy Markdown
Contributor

Bumps actions/upload-artifact from 4 to 7.

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot changed the title Bump actions/upload-artifact from 4 to 7 build(deps): bump actions/upload-artifact from 4 to 7 Sep 7, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions/upload-artifact-7 branch from bdd7fd7 to b55d2c0 Compare September 7, 2026 02:09
@IamCoder18
IamCoder18 force-pushed the dependabot/github_actions/actions/upload-artifact-7 branch from b55d2c0 to 80fe9dc Compare September 15, 2026 02:14
@coderabbitai

coderabbitai Bot commented Sep 15, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d070a0ae-a200-42af-8a23-f0bcf182ed66

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@IamCoder18
IamCoder18 force-pushed the dependabot/github_actions/actions/upload-artifact-7 branch from 80fe9dc to 2e884cd Compare September 15, 2026 02:20
@IamCoder18
IamCoder18 merged commit 936dfd4 into main Sep 15, 2026
6 checks passed
@IamCoder18
IamCoder18 deleted the dependabot/github_actions/actions/upload-artifact-7 branch September 15, 2026 02:22
IamCoder18 added a commit that referenced this pull request Sep 25, 2026
… nil-error wrap

- cmd/content: fetchTocWithTimeout now passes a deadline-aware context
  through a new content.FetchTocWithContext helper, which in turn
  propagates it via httpclient.FetchOptions.Context so the in-flight
  HTTP request is cancelled when the timeout fires. The goroutine
  no longer keeps running after the deadline; the call returns the
  timeout error directly. httpclient.Fetch uses
  http.NewRequestWithContext when FetchOptions.Context is set, and
  falls back to context.Background for the existing callers.

- internal/dupdata.CourseOrgIDsCSV: bumped pageSize from 20 to 200
  and added bookmark-pagination handling for the manageCourses
  widget. The function now follows PagingInfo.HasMoreItems chains
  (capped at 25 pages) so a student with more than 20 enrollments
  sees every course. The first page already includes the entire
  bookmark URL, which we extract for the next request.

- cmd/archive: the res.Ref.Topic == nil branch in runArchiveShow was
  using fmt.Errorf("%w (try: ...)", err) with an err that was
  guaranteed nil by the preceding Resolve success check, producing
  %!w(<nil>) in the output. The branch now formats res.Kind, res.BlobID
  and res.BlobPath directly into the error message.

- CHANGELOG: removed contradictions between the [Unreleased] section
  and the rest of the document (mentions of removed commands,
  KNOWN_ISSUES #4 vs #5/#20, the systemd LEGACY suffix that lived
  on Status.UnitPath).

Lint clean (golangci-lint v2.13.2). go build / go vet / go test -race
all clean.
IamCoder18 added a commit that referenced this pull request Sep 27, 2026
… prune (#12)

* feat(archive): redesign archive CLI around user jobs; fix destructive prune

Implements the archive UX redesign documented in ARCHIVE_UX_PLAN.md and
resolves the P0 prune --dry-run bug, plus several related correctness
and UX issues uncovered while implementing it.

P0 — destructive commands now print a plan first
  - 'archive prune' is plan-only by default; --delete applies. The old
    top-level 'prune --dry-run' (and 'cmd/prune.go' entirely) was
    documented as a preview but actually called archive.Prune and
    removed files. New: archive.PrunePlan (read-only) and archive.Prune
    (destructive, gated on the explicit --delete flag).
  - 'archive update --dry-run' replaces the old --diff flag. Diff no
    longer calls SaveIndex or creates directories — it is a pure
    in-memory preview. The TOC persistence that lived in Diff (KNOWN_
    ISSUES #2) is superseded; TOC timestamps now land only after a
    real update pass.

P0 — prune now keeps body blobs and trims dangling index records
  - collectLiveKeys (the new live-set builder) walks every courses/<id>/
    index.json on disk and unions current metadata UUIDs with current
    body SHAs. The previous collectLiveUUIDs only collected metadata
    UUIDs and never matched .bin blob names, so every body blob was
    deleted by any prune run — including the live CurrentBody of
    every File topic.
  - trimDanglingRecords rewrites every per-course index in the same
    pass: versions and bodyVersions entries that point at deleted
    blobs are dropped. SchemaVersion bumps 3 → 4 so older binaries
    can detect the new shape.

P1 — update converges
  - Body downloads now run for: (a) new/modified File topics, (b) File
    topics with no CurrentBody, (c) File topics whose CurrentBody blob
    is missing on disk. --no-bodies opts out (metadata only). When the
    queued reason is 'body-missing' (cases b/c) the body is always
    re-saved even if the new SHA matches the stored one, so a deleted
    blob is restored.

Command surface (per ARCHIVE_UX_PLAN.md §2)
  - 'archive' (bare) is now status (counts, freshness, missing bodies,
    lock state, 'try next' hints); empty state suggests 'archive update'.
  - 'archive update [courseId...]' is the new mutating pass (was bare
    'archive' + positional). Scope via positional args or repeatable
    --course.
  - 'archive find [query...]' replaces 'archive files': single-load
    in-memory search over the global index + every course index with
    precomputed lowercase haystacks, AND-token matching, --ext/--type/
    --with-bodies/--missing-bodies filters.
  - 'archive show <ref>' replaces 'archive topic'. <ref> auto-detects
    a numeric topicId, 32-hex metadata UUID, or 64-hex body SHA-256;
    --kind forces metadata|body when ambiguous.
  - 'archive cat <ref>' merges 'archive read' + 'archive body': bytes
    to stdout for File topics, pretty JSON for everything else, --meta
    forces the metadata blob.
  - 'archive path <ref>' keeps the old auto-detection; new --kind
    flag is shared with show/cat.
  - 'archive export [ref...] --out DIR [--flat] [--dry-run]' copies
    file bodies out as <CourseCode>/<Sanitized Title>.<ext> with
    collision-safe ' (2)' suffixes.
  - 'archive prune [--delete] [--wait]' replaces the top-level prune.
  - 'archive verify [--deep]' checks pointer resolution, dangling
    version records, missing body blobs, per-course index parse,
    missing course directories, schema-version compatibility, and
    orphan blobs. Exits 0/1; JSON envelope.

Consistency
  - Persistent flags on the 'archive' group: --dir, --json, --plain,
    --quiet/-q, --no-spinner, -v/--verbose, --course (repeatable).
    The -e short flag is gone.
  - JSON envelopes everywhere (collections {count, items}; records a
    single object; summaries flat). --plain TSV on list, find, show,
    export --dry-run for fzf/cut/xargs pipelines.
  - Errors print exactly once: rootCmd.SilenceErrors = true and
    Execute prints a single line. JSON-mode commands emit
    {'error': …} via a typed errJSONShown sentinel that Execute
    detects and does not re-print.
  - systemd service template now invokes 'archive update
    --no-auto-refresh' instead of the bare mutating 'archive'; the
    'no silent reauth' guarantee is preserved via --no-auto-refresh.

Optimized local search
  - 'internal/archive.Store' loads the global index plus every
    per-course index exactly once and serves O(1) topic / metadata-uuid
    / body-sha lookups. archive find/show/cat/path/status/verify/export
    all route through it, so repeated queries never re-read per-course
    indexes. Topic haystacks (lowercased title + url + type) are
    precomputed at Open time so per-query work is just token Contains
    checks.

Also included
  - Prerequisite fixes for KNOWN_ISSUES #1–#20 that were already in
    the working tree (newscripts --body-format, content --timeout,
    doctor token expiry, archive list counts, archive read defaults,
    archive topic reverse lookup, archive files enumeration,
    archive path --kind, etc.). These are landed here as the
    dependency layer the new command surface is built on.
  - Closes KNOWN_ISSUES #4, #5, #6, #17, #18, #20 and supersedes the
    old 'archive --diff persists TOC' fix for #2 (now: update
    --dry-run writes nothing; real update persists TOC).
  - Test coverage: archive_ux_test.go covers prune plan (no writes),
    body blob preservation, dangling record trimming, shared body
    safety, ref grammar, store search, verify, export (incl. dry-run),
    LoadStatus missing-body counts, and the two body-convergence
    cases (missing field + missing blob).

go build ./..., go vet ./..., go test -race ./... all clean. New code
is gofmt-clean. Backwards compatibility with the old archive surface
is explicitly out of scope (per the plan).

* fix(archive): address CodeRabbit review findings on archive-UX redesign

Resolves the actionable review comments left on PR #12:

- archive lock: truncate PID file in Release() before LOCK_UN and drop
  the post-flock PID-alive check, since a successful flock already
  proves exclusive access. The old check spuriously rejected callers
  whenever the recorded PID happened to still be alive (PID reuse),
  making --wait fail immediately after the previous holder released.
- archive cat --meta: require a topic reference and read the metadata
  UUID from the topic's Current pointer, not the resolved body SHA.
- archive cat body: drop the topic-reference and !archiveCatMeta guards
  so body blobs load for any ref that resolves to a body kind.
- archive find TSV: replace tabwriter with tsvWriteLine that sanitises
  embedded tabs/newlines (tabwriter with tabwidth=0 ate separators; a
  positive tabwidth emitted alignment tabs that broke | cut -f1).
- archive list TSV: same tabwriter -> tsvWriteLine swap.
- archive show TSV: same swap.
- archive export TSV: same swap.
- archive list help: point users at bare `archive` for freshness and
  missing-body status; drop the unregistered `archive status` mention.
- archive export: return an error when a ref fails to resolve instead
  of silently dropping it; missing body blobs are recorded as
  skipped-missing-body in both dry-run and real runs; copyFile now
  propagates Close() errors so close-time write failures don't get
  reported as successful copies.
- archive export sanitizeFilename: truncate by runes (was byte-truncating
  UTF-8) and reject dot-only results so CourseCode == '..' cannot escape
  the --out directory.
- archive update --dry-run: run before acquireLock so dry runs neither
  create nor hold the archive lock; pass DownloadFiles: !archiveUpdateNoBodies
  so body counts match a real update pass.
- archive update: stamp idx.Version = SchemaVersion on every successful
  SaveIndex so existing v3 stores converge to v4 and verify no longer
  flags them as schema-version-older indefinitely.
- archive prune: same SchemaVersion bump after trimDanglingRecords.
- archive find --missing-bodies: skip non-File topics so the count
  matches LoadStatus.
- archive update body convergence: when reason == 'body-missing' and the
  fetched SHA equals the stored CurrentBody, refresh on-disk without
  appending a duplicate BodyVersions entry.
- Locked status probe (loadStatus.lockHeldAt): read the lock file
  read-only instead of opening archive.lock and creating its parent
  directory just to read state.
- news list: register shared flags via registerNewsFlags on every
  subcommand (cobra AddFlagSet on a different command does not rebind
  package variables, so --course silently dropped before).
- news list cross-course: track whether at least one per-course fetch
  succeeded and return an error if every fetch failed.
- news list until: filter results locally with withinRange() because
  D2L's `until` parameter is not honoured on every endpoint.
- news list OrgUnitId / HasAttachment: derive from the requested course
  ID and from len(n.Attachments) > 0 respectively, since the D2L schema
  does not include those fields on the news response.
- token --refresh --json: emit only the token record as JSON and skip
  the human-readable line.
- token --refresh: treat an empty cookiejar the same as a missing
  session.json, so the saved jar no longer pretends to be a working
  session.
- doctor: separate SAML-credential validity from Brightspace-token
  validity; `token --refresh` is only suggested when both the session
  is valid and a RefreshToken is recorded.
- Execute() error printing: also suppress on errors.Is(err, errJSONShown)
  so JSON-mode commands that emit their own envelope don't get a
  duplicate 'Error: ... shown in JSON envelope' line on stderr.
- content --tree --depth N: prune modules by depth before rendering so
  the tree stops at N; url.Parse(...).Path is used for the file extension
  label so query strings and fragments don't leak into [File.<ext>].
- systemd Query: detect pre-redesign ExecStart lines and append
  [LEGACY - run `schooltools systemd install --force`] to the unit
  path so the migration warning is visible.
- tests: TestRepro_Issue20_BodyAndMetaPathDistinct now actually
  asserts Resolve("42", "") returns Kind=body and the body SHA,
  and Resolve("42", "metadata") returns Kind=metadata and the
  saved metadata UUID. TestRepro_Issue4 replaces t.Skip with
  t.Fatalf when BodiesFetched == 0, so a missing-body regression
  fails the test instead of being silently skipped.

Lint clean (golangci-lint v2.13.2). go build / go vet / go test -race
all clean.

* fix(archive): address follow-up CodeRabbit review findings

- content --depth: reject negative values with an explicit error
  instead of silently treating them as 'no limit'.
- news list withinRange: compare parsed timestamps (RFC3339Nano,
  RFC3339) so timestamps with fractional seconds or non-Z offsets
  filter correctly; fall back to string compare only on unparseable
  values.
- news list flattenBody: HTML-only items no longer leak raw HTML into
  the default text-body field; the text field is empty and the user
  can pass --body-format html/both to see the HTML.
- token --refresh: probe the saved jar against /d2l/home and the OAuth
  token endpoint, which is where the session cookies are actually
  scoped. The previous probe against ua.D2LBase / ua.LoginEndpoint
  reported a populated jar as empty for some saved sessions.
- archive prune: return a contextual error when LoadIndex fails after
  the apply pass (and after the missing-blobs-dir branch), so a failed
  read no longer leaves the schema-version bump un-done in silence.
  The missing-blobs-dir branch now also bumps idx.Version, so the
  schema converges to v4 on stores that never created a blobs dir.
- archive export: uniqueDest now seeds its collision map from disk
  (os.Stat), and copyFile opens with O_EXCL, so an existing file at
  the chosen destination is treated as a collision instead of being
  silently overwritten.
- systemd Query: move the LEGACY warning out of Status.UnitPath into
  a new Status.Warnings []string field. UnitPath is now always a real
  filesystem path. legacyExecStart parses ExecStart= lines explicitly
  (skipping comments and unrelated directives) so a mention of
  'archive update' in a Description= line cannot suppress the warning.

Lint clean (golangci-lint v2.13.2). go build / go vet / go test -race
all clean.

* fix(archive): cancel TOC HTTP on timeout; paginate manageCourses; fix nil-error wrap

- cmd/content: fetchTocWithTimeout now passes a deadline-aware context
  through a new content.FetchTocWithContext helper, which in turn
  propagates it via httpclient.FetchOptions.Context so the in-flight
  HTTP request is cancelled when the timeout fires. The goroutine
  no longer keeps running after the deadline; the call returns the
  timeout error directly. httpclient.Fetch uses
  http.NewRequestWithContext when FetchOptions.Context is set, and
  falls back to context.Background for the existing callers.

- internal/dupdata.CourseOrgIDsCSV: bumped pageSize from 20 to 200
  and added bookmark-pagination handling for the manageCourses
  widget. The function now follows PagingInfo.HasMoreItems chains
  (capped at 25 pages) so a student with more than 20 enrollments
  sees every course. The first page already includes the entire
  bookmark URL, which we extract for the next request.

- cmd/archive: the res.Ref.Topic == nil branch in runArchiveShow was
  using fmt.Errorf("%w (try: ...)", err) with an err that was
  guaranteed nil by the preceding Resolve success check, producing
  %!w(<nil>) in the output. The branch now formats res.Kind, res.BlobID
  and res.BlobPath directly into the error message.

- CHANGELOG: removed contradictions between the [Unreleased] section
  and the rest of the document (mentions of removed commands,
  KNOWN_ISSUES #4 vs #5/#20, the systemd LEGACY suffix that lived
  on Status.UnitPath).

Lint clean (golangci-lint v2.13.2). go build / go vet / go test -race
all clean.

* fix(archive): address re-review findings (HTML-only body, date validation, export collisions, bookmark pagination, systemd warnings)

- cmd/per_course_rare flattenBody: HTML-only bodies now go through a
  conservative htmlToText conversion (tag strip, whitespace collapse,
  common-entity decode) so the default 'text' body-format keeps a
  readable representation instead of dropping the content entirely.

- cmd/per_course_rare runNewsList: new validateNewsBounds step
  rejects malformed --since / --until up front so withinRange never
  silently includes out-of-range items behind a successful result.

- internal/archive/export uniqueDest: now stat-checks each suffixed
  candidate against the filesystem until it finds an unused name,
  so a leftover 'report (2).pdf' from an earlier run no longer
  collides with copyFile's O_EXCL open and aborts the whole export
  partway through.

- internal/dupdata CourseOrgIDsCSV: the bookmark walker now uses the
  PagingInfo.Bookmark returned by the manageCourses response instead
  of trying to read it off the previous URL (the widget doesn't
  echo it there). An unchanged bookmark is rejected, so a stuck
  cursor is caught immediately instead of failing at page 25.

- cmd/systemd printSystemdStatus: Status.Warnings is now rendered as
  a separate 'Warnings:' block in human output and as a 'warnings'
  field in the JSON envelope, so the LEGACY ExecStart warning
  reaches the user.

Lint clean (golangci-lint v2.13.2). go build / go vet / go test -race
all clean.

* fix(archive): HTML entity decoding; export collision reservations; bookmark validation

- cmd/per_course_rare htmlToText: pass the result through
  html.UnescapeString after the existing manual replacements so
  standard named and numeric entities (\u0026amp; \u0026lt;
  \u0026#39; etc.) decode to their characters in the default text
  body instead of appearing as raw escape sequences.

- internal/archive uniqueDest: keep a dedicated reserved set of every
  destination path it has returned in the current export run, and
  refuse to hand out a path already in that set. Previously a dry
  run could pick "report (2).pdf" for a topic, and a later topic
  titled "Report (2)" could then also pick "report (2).pdf" since
  os.Stat couldn't see the dry-run reservation. The function also
  now returns unexpected Stat errors (anything other than NotExist)
  to the caller so a permission problem can't silently loop the
  suffix counter.

- internal/dupdata fetchManageCoursesPage: when PagingInfo reports
  HasMoreItems=true with an empty Bookmark, return an error instead
  of silently treating the response as the last page. A malformed
  pagination response previously truncated the course list without
  surfacing the problem.

Lint clean (golangci-lint v2.13.2). go build / go vet / go test -race
all clean.

* fix(archive): treat dangling symlinks as occupied export destinations

uniqueDest used os.Stat, which reports a dangling symlink's target as
absent, so the suffix search picked that filename and copyFile's
O_CREATE|O_EXCL open then aborted the export. Switch the destination
check to os.Lstat so dangling symlinks bump the suffix like any other
occupied destination. Add a unit test that plants a dangling symlink at
the candidate filename and asserts the suffix advances.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant