build(deps): bump actions/upload-pages-artifact from 4 to 5

[dependabot]

Bumps actions/upload-pages-artifact from 4 to 5.

Release notes

Sourced from actions/upload-pages-artifact's releases.

v5.0.0

Changelog

• Update upload-artifact action to version 7 @​Tom-van-Woudenberg (#139)
• feat: add include-hidden-files input @​jonchurch (#137)

See details of all code changes since previous release.

Commits

• fc324d3 Merge pull request #139 from Tom-van-Woudenberg/patch-1
• fe9d4b7 Merge branch 'main' into patch-1
• 0ca1617 Merge pull request #137 from jonchurch/include-hidden-files
• 57f0e84 Update action.yml
• 4a90348 v7 --> hash
• 56f665a Update upload-artifact action to version 7
• f7615f5 Add include-hidden-files input
• See full diff in compare view

[Claudius-Maginificent]

Security Review — actions/upload-pages-artifact v4 → v5

Verdict: SAFE to merge. Recommend approval once CI clears.

Standing orders say trust nothing, verify twice. So I did.

What changed

Single-line bump in .github/workflows/github-pages.yml (line 48). Build-time CI action only — publishes rustdoc to GitHub Pages. No runtime code path, no production surface.

Supply-chain verification

• Publisher: actions/ org — first-party GitHub. High trust.
• Tag integrity: v5 and v5.0.0 both resolve to commit fc324d3547104276b827a68afc52ff2a11cc49c9. Commit signature verified by GitHub. Authored by tsusdere@github.com (Fabian), committed 2026-04-08.
• Nested pin: upload-pages-artifact v5 pins its internal actions/upload-artifact@v7 dependency to a SHA (see PR build(deps): bump docker/build-push-action from 6.15.0 to 6.16.0 #139 in the upstream repo). No floating reference downstream.
• CVE search: OSV.dev, NVD, GHSA — no known vulnerabilities for actions/upload-pages-artifact (any version) or the wrapped actions/upload-artifact@v7.

v5.0.0 changes reviewed

1. Bumps wrapped actions/upload-artifact from v6 to v7 (Node 24 runtime — supported on ubuntu-latest).
2. Adds include-hidden-files input, defaults to false — matches prior v4 behaviour. No change for us.

Breaking-change impact on our usage

Our call site passes only path: "target/doc". The path input default is unchanged (_site/). We do not rely on dotfiles being packaged; rustdoc output under target/doc needs no .nojekyll because the pages pipeline serves the tar artifact via actions/deploy-pages@v4 rather than through Jekyll. Companion actions (actions/configure-pages@v5, actions/deploy-pages@v4) remain on versions compatible with upload-pages-artifact v5.

No behavioural regression expected.

Notes

• CI red is pre-existing (fmt + test-all), unrelated to this bump; expected to clear after rebase once build(deps): update zip requirement from 7.0 to 8.5 #193 merges.
• I verified the v5 tag points to the same SHA documented in the dependabot PR body. Consistent. No tag-moving shenanigans.

🍬 Findings this run: 0 vulnerabilities, 1 clean supply-chain chain-of-custody verified.

Carry on.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[lklimek]

@dependabot rebase