ci(deps): bump actions/upload-artifact v4.6.2 to v7.0.1 (replaces #22)

[saagpatel]

What

Bump actions/upload-artifact SHA across all 10 references in .github/workflows/:

• Old: ea165f8d65b6e75b540449e92b4886f43607fa02 (v4.6.2)
• New: 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a (v7.0.1)

Affected workflows (6 total):

• ci.yml (2 refs)
• perf-foundation.yml (4 refs)
• quality-gates.yml (1)
• dependency-watch.yml (1)
• osv-scan.yml (1)
• sbom.yml (1)

Why

Supersedes #22 — blocked by branch-name governance. Re-created on a codex branch per docs/SECURITY.md.

Wave 4 (remainder, pre-Wave 5) of the audit remediation plan.

How

Full workflow audit performed before the bump. Key v5+ breaking change is the removal of implicit artifact merging when two uploads in the same run share a name:. Inventory confirmed all 10 artifact names are globally unique within their run contexts:

Workflow	Job	Artifact name
ci.yml	Frontend Unit + Coverage	coverage-frontend
ci.yml	UI Smoke + Visual + A11y + Responsive	playwright-report
quality-gates.yml	quality-gates	test-artifacts
perf-foundation.yml	perf-bundle	perf-foundation-bundle
perf-foundation.yml	perf-build	perf-foundation-build
perf-foundation.yml	perf-memory	perf-foundation-memory
perf-foundation.yml	perf-api	perf-foundation-api
dependency-watch.yml	Weekly Dependency and Advisory Check	dependency-watch-reports
osv-scan.yml	Scan manifests against OSV	osv-scan-report
sbom.yml	Generate and attach CycloneDX SBOMs	sbom-${{ github.event.release.tag_name || github.run_id }}

No actions/download-artifact usage in the repo (no lockstep bump needed).

One commit: ci(deps): bump actions/upload-artifact v4.6.2 to v7.0.1 across workflows. Global sed.

Testing

• Commands run: grep -c across all workflows confirms 10 new references and zero old references
• Results: SHA resolves via gh api repos/actions/upload-artifact/git/ref/tags/v7.0.1
• CI will exercise every workflow on this PR and again on merge-run

Performance impact

• Bundle delta: N/A
• Build time delta: v7 download/upload protocol is slightly faster on average; no measurable CI wall-clock change expected
• Lighthouse delta: none
• API latency delta: none
• DB query delta: none

Risk / Notes

• No behavioral change to any job's artifact shape, retention, or failure mode
• Close build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 #22 after merge

Screenshots (UI only)

• N/A

Lockfile rationale (if lockfile changed)

• No lockfile changes.

🤖 Generated with Claude Code