Bump actions/upload-artifact from 4 to 7
What the developer wrote
Authored by dependabot[bot]
Bump actions/upload-artifact from 4 to 7
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine automated update by Dependabot that changes the version of a GitHub Actions helper used to store build outputs. There is no indication this change fixes or introduces a security problem in the firmware itself.
No security action required. Review the upstream actions/upload-artifact v7 release notes for any breaking changes before merging, as with any major-version dependency update.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit bumps actions/upload-artifact from v4 to v7 in .github/workflows/build.yaml. The diff is purely a version-string replacement across artifact upload steps for firmware ELFs, signed/unsigned binaries, hashes, and the bootloader. No workflow logic, secrets handling, artifact retention, or permission scopes are changed. The commit message and metadata are the standard Dependabot dependency-update template and do not describe any security relevance.
Changed components
.github/workflows/build.yamlInspect captured patch +8 / −8
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index ec982e0..90117e5 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -58,43 +58,43 @@ jobs:
SIGNING_KEY: ${{ secrets.UserSigningKey }}
- name: Upload firmware ELF
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7
with:
name: v${{env.version}}${{ matrix.build.suffix }}.elf
path: ports/stm32/build-Passport/firmware.elf
- name: Upload firmware (unsigned)
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7
with:
name: v${{env.version}}-unsigned${{ matrix.build.suffix }}.bin
path: ports/stm32/build-Passport/firmware-${{ env.SCREEN_MODE }}.bin
- name: Upload firmware (signed)
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7
with:
name: v${{env.version}}-beta${{ matrix.build.suffix }}.bin
path: ports/stm32/build-Passport/v${{env.version}}-beta${{ matrix.build.suffix }}.bin
- name: Upload MD5 Hash
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7
with:
name: v${{env.version}}${{ matrix.build.hash_suffix }}-md5
path: ports/stm32/build-Passport/v${{env.version}}-beta${{ matrix.build.hash_suffix }}-md5
- name: Upload Build Hash
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7
with:
name: v${{env.version}}${{ matrix.build.hash_suffix }}-build-hash
path: ports/stm32/build-Passport/v${{env.version}}-beta${{ matrix.build.hash_suffix }}-build-hash
- name: Upload SHA256 Hash
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7
with:
name: v${{env.version}}${{ matrix.build.hash_suffix }}-sha256
path: ports/stm32/build-Passport/v${{env.version}}-beta${{ matrix.build.hash_suffix }}-sha256
- name: Upload Hashes Markdown
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7
with:
name: v${{env.version}}${{ matrix.build.hash_suffix }}-hashes.md
path: ports/stm32/build-Passport/v${{env.version}}-beta${{ matrix.build.hash_suffix }}-hashes.md
@@ -146,7 +146,7 @@ jobs:
run: just build-bootloader color ${{ matrix.build.colorway }}
- name: Upload bootloader
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v7
with:
name: bootloader-COLOR-${{ env.COLORWAY }}.bin
path: ports/stm32/boards/Passport/bootloader/arm/release/bootloader-COLOR-${{ env.COLORWAY }}.bin
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.