build(deps): bump actions/upload-artifact from 4 to 6#150
Conversation
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 6. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v6) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the
Comment |
|
@coderabbitai is there any changes we should perform in our actions to support the new upload action? |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain
🏁 Script executed: Length of output: 1039 Let me get a complete view of all upload-artifact usages in your workflows: 🏁 Script executed: Length of output: 1352 🏁 Script executed: Length of output: 1156 🌐 Web query: 💡 Result: upload-artifact v6 vs v4: breaking changes + API diffs1) Primary breaking change in v6 (vs v4): runtime/runner requirements
2) “API” (inputs/outputs) differences: effectively none
3) Behavioral breaking changes introduced in v4 (still apply in v6)If you’re upgrading from v4 → v6, these are not new—but they’re the big behavior constraints to keep in mind:
Sources: [1] actions/upload-artifact README (v6 + v4 notes) (github.com), [2] v4 Citations:
Looking at your current usage in - name: Upload FIT artifacts
uses: actions/upload-artifact@v6
with:
name: FIT-images
path: python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/data/*.itbThis is perfectly compatible with v6. The only breaking change is that v6 runs on Node.js 24 and requires GitHub Actions Runner version 2.327.1 or higher. What you need to verify:
Your workflow configuration itself requires no modifications! 🎉 (\_/) |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/build-oci-bundle.yaml:
- Line 22: The workflow uses actions/upload-artifact@v6 which requires
self-hosted runners to be Actions Runner v2.327.1 or higher; update the
self-hosted runner labelled ubuntu-24.04-arm to v2.327.1+ before merging or
alternatively revert the workflow to a compatible upload action (e.g., pin to an
earlier supported tag like actions/upload-artifact@v3) to avoid failure at the
uses: actions/upload-artifact@v6 line.
|
|
||
| - name: Upload FIT artifacts | ||
| uses: actions/upload-artifact@v4 | ||
| uses: actions/upload-artifact@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/build-oci-bundle.yamlRepository: jumpstarter-dev/jumpstarter
Length of output: 1304
🌐 Web query:
actions/upload-artifact v6 minimum github actions runner version requirement changelog
💡 Result:
- Minimum GitHub Actions runner version for
actions/upload-artifact@v6:2.327.1(relevant for self-hosted runners; GitHub-hosted runners are managed by GitHub).v6also switches the action runtime to Node.js 24 (runs.using: node24). [1][2] - Changelog / release notes:
v6.0.0(released Dec 12, 2025) documents the Node.js 24 runtime change and the minimum runner version requirement; the “Full Changelog” comparison isv5.0.0...v6.0.0. [2]
Sources:
[1] actions/upload-artifact repository (“v6 – What’s new”)
[2] actions/upload-artifact GitHub Releases (v6.0.0)
🌐 Web query:
actions/upload-artifact v6 breaking changes from v4 migration guide
💡 Result:
actions/upload-artifact: v4 → v6 migration (breaking changes)
1) Runtime / runner requirements (new in v5/v6)
- v5.0.0 is marked as a breaking change because it adds Node.js 24 support (the project treated this as breaking even though behavior may be unchanged for most users). [1]
- v6.0.0 changes the default runtime to Node.js 24 (
runs.using: node24) and requires GitHub Actions Runner >= 2.327.1 (important for self-hosted runners). [1]
2) v4 behavioral “gotchas” you must already be compatible with (still apply in v6)
- You cannot upload to the same artifact name multiple times within a workflow run (common failure in matrix jobs); artifact names must be unique, or you must upload once / merge via other means. [2]
- Hidden files are excluded by default (from v4.4+), to reduce accidental secret uploads; opt back in with
include-hidden-files: trueif you rely on dotfiles. [2][3] - Artifact-per-job limit: max 500 artifacts per job. [2]
- Self-hosted runners may need extra firewall rules for the v4+ backend. [2]
- Version compatibility: if you upload with
actions/upload-artifact@v4+, you should also download withactions/download-artifact@v4+(don’t mix v3 with v4+). [4] - GHES:
upload-artifact@v4+is not supported on GitHub Enterprise Server (per the action docs); you’d need v3/v3-node20 there. [2]
3) Minimal migration change
Change:
- uses: actions/upload-artifact@v4to:
- uses: actions/upload-artifact@v6…and if you use self-hosted runners, ensure they’re updated to Runner 2.327.1+ before upgrading. [1]
Self-hosted runner must be updated to Actions Runner version 2.327.1+ before merging.
The upgrade to actions/upload-artifact@v6 requires GitHub Actions Runner 2.327.1 or higher on self-hosted runners. Since ubuntu-24.04-arm is a self-hosted runner, this workflow will fail at line 22 unless the runner is updated to meet this minimum version requirement. This is a blocker for deployment.
🤖 Prompt for AI Agents
In @.github/workflows/build-oci-bundle.yaml at line 22, The workflow uses
actions/upload-artifact@v6 which requires self-hosted runners to be Actions
Runner v2.327.1 or higher; update the self-hosted runner labelled
ubuntu-24.04-arm to v2.327.1+ before merging or alternatively revert the
workflow to a compatible upload action (e.g., pin to an earlier supported tag
like actions/upload-artifact@v3) to avoid failure at the uses:
actions/upload-artifact@v6 line.
dependabot
Bot
deleted the
dependabot/github_actions/actions/upload-artifact-6
branch
1 participant
Bumps actions/upload-artifact from 4 to 6.
Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
b7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEddc45eddocs: update README to correct action name for Node.js 24 support615b319chore: release v6.0.0 for Node.js 24 support017748bMerge pull request #744 from actions/fix-storage-blob38d4c79chore: rebuild dist7d27270chore: add missing license cache files for@actions/core,@actions/io, and mi...5f643d3chore: update license files for@actions/artifact@5.0.1 dependencies1df1684chore: update package-lock.json with@actions/artifact@5.0.1b5b1a91fix: update@actions/artifactto ^5.0.0 for Node.js 24 punycode fixDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.