From 9b316983286ec07e27e8f2a0d054bcb773968341 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 15:48:06 +0000 Subject: [PATCH 1/3] Bump actions/upload-artifact from 6 to 7 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- action.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/action.yml b/action.yml index de871fa..6ceee5b 100644 --- a/action.yml +++ b/action.yml @@ -611,7 +611,7 @@ runs: - name: Upload terraform artifacts if: steps.safety.outputs.should_deploy == 'true' continue-on-error: true - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: terraform-artifacts-${{ steps.resolve-env.outputs.environment }} path: terraform/plans @@ -777,7 +777,7 @@ runs: - name: Upload terraform plans if: steps.plan-summary.outputs.has_changes == 'true' continue-on-error: true - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: terraform-plans-${{ steps.resolve-env.outputs.environment }} path: terraform/plans/*.tfplan From 171bf598a082ec516d1884833e682b6de5d85e8e Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Mon, 24 Aug 2026 21:05:24 +0300 Subject: [PATCH 2/3] Validate upload-artifact v7 --- tests/run-merge-tests.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/run-merge-tests.sh b/tests/run-merge-tests.sh index b579fa1..2c41be3 100755 --- a/tests/run-merge-tests.sh +++ b/tests/run-merge-tests.sh @@ -107,8 +107,8 @@ assert_eq "$(yq -r '.inputs | has("gcp_service_account")' "$PROJECT_ROOT/action. assert_eq "$(yq -r '.inputs | has("aws_role_arn")' "$PROJECT_ROOT/action.yml")" "false" "AWS role input is not accepted" assert_eq "$(yq -r '.inputs | has("aws_region")' "$PROJECT_ROOT/action.yml")" "false" "AWS region input is not accepted" assert_eq "$(yq -r '.inputs.state_backend.required' "$PROJECT_ROOT/action.yml")" "false" "State backend input is optional" -assert_eq "$(yq -r '.runs.steps[] | select(.name == "Upload terraform artifacts") | .uses' "$PROJECT_ROOT/action.yml")" "actions/upload-artifact@v6" "Artifact upload uses Node.js 24 action runtime" -assert_eq "$(yq -r '.runs.steps[] | select(.name == "Upload terraform plans") | .uses' "$PROJECT_ROOT/action.yml")" "actions/upload-artifact@v6" "Plan upload uses Node.js 24 action runtime" +assert_eq "$(yq -r '.runs.steps[] | select(.name == "Upload terraform artifacts") | .uses' "$PROJECT_ROOT/action.yml")" "actions/upload-artifact@v7" "Artifact upload uses Node.js 24 action runtime" +assert_eq "$(yq -r '.runs.steps[] | select(.name == "Upload terraform plans") | .uses' "$PROJECT_ROOT/action.yml")" "actions/upload-artifact@v7" "Plan upload uses Node.js 24 action runtime" assert_eq "$(yq -r '[.runs.steps[] | select(.uses == "google-github-actions/auth@v3" or .uses == "aws-actions/configure-aws-credentials@v6")] | length' "$PROJECT_ROOT/action.yml")" "0" "Action does not configure cloud credentials" assert_eq "$(grep -c 'Authenticate with Google Cloud before invoking github-rabbit-action' "$PROJECT_ROOT/action.yml")" "1" "Action requires caller-provided GCP credentials" assert_eq "$(grep -c 'AWS credentials configured by the caller workflow' "$PROJECT_ROOT/action.yml")" "1" "Action forwards caller AWS credentials" From beed83d4cab56b1984cdd596142a4224561ff888 Mon Sep 17 00:00:00 2001 From: Dmytro Smirnov Date: Mon, 24 Aug 2026 21:08:37 +0300 Subject: [PATCH 3/3] Clarify artifact version checks --- tests/run-merge-tests.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/run-merge-tests.sh b/tests/run-merge-tests.sh index 2c41be3..93eb463 100755 --- a/tests/run-merge-tests.sh +++ b/tests/run-merge-tests.sh @@ -107,8 +107,8 @@ assert_eq "$(yq -r '.inputs | has("gcp_service_account")' "$PROJECT_ROOT/action. assert_eq "$(yq -r '.inputs | has("aws_role_arn")' "$PROJECT_ROOT/action.yml")" "false" "AWS role input is not accepted" assert_eq "$(yq -r '.inputs | has("aws_region")' "$PROJECT_ROOT/action.yml")" "false" "AWS region input is not accepted" assert_eq "$(yq -r '.inputs.state_backend.required' "$PROJECT_ROOT/action.yml")" "false" "State backend input is optional" -assert_eq "$(yq -r '.runs.steps[] | select(.name == "Upload terraform artifacts") | .uses' "$PROJECT_ROOT/action.yml")" "actions/upload-artifact@v7" "Artifact upload uses Node.js 24 action runtime" -assert_eq "$(yq -r '.runs.steps[] | select(.name == "Upload terraform plans") | .uses' "$PROJECT_ROOT/action.yml")" "actions/upload-artifact@v7" "Plan upload uses Node.js 24 action runtime" +assert_eq "$(yq -r '.runs.steps[] | select(.name == "Upload terraform artifacts") | .uses' "$PROJECT_ROOT/action.yml")" "actions/upload-artifact@v7" "Artifact upload uses upload-artifact v7" +assert_eq "$(yq -r '.runs.steps[] | select(.name == "Upload terraform plans") | .uses' "$PROJECT_ROOT/action.yml")" "actions/upload-artifact@v7" "Plan upload uses upload-artifact v7" assert_eq "$(yq -r '[.runs.steps[] | select(.uses == "google-github-actions/auth@v3" or .uses == "aws-actions/configure-aws-credentials@v6")] | length' "$PROJECT_ROOT/action.yml")" "0" "Action does not configure cloud credentials" assert_eq "$(grep -c 'Authenticate with Google Cloud before invoking github-rabbit-action' "$PROJECT_ROOT/action.yml")" "1" "Action requires caller-provided GCP credentials" assert_eq "$(grep -c 'AWS credentials configured by the caller workflow' "$PROJECT_ROOT/action.yml")" "1" "Action forwards caller AWS credentials"