chore(deps): update actions/upload-artifact action to v7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/upload-artifact	action	major	v4 → v7

---

Release Notes

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

• Update the readme with direct upload details by @​danwkennedy in #​795
• Readme: bump all the example versions to v7 by @​danwkennedy in #​796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in #​797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in #​754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in #​762
• Support direct file uploads by @​danwkennedy in #​764

New Contributors

• @​Link- made their first contribution in #​754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v7

Compare Source

v6.0.0

Compare Source

v6 - What's new

[!IMPORTANT]
actions/upload-artifact@​v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

• Upload Artifact Node 24 support by @​salmanmkc in #​719
• fix: update @​actions/artifact for Node.js 24 punycode deprecation by @​salmanmkc in #​744
• prepare release v6.0.0 for Node.js 24 support by @​salmanmkc in #​745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v6

Compare Source

v5.0.0

Compare Source

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

• Update README.md by @​GhadimiR in #​681
• Update README.md by @​nebuk89 in #​712
• Readme: spell out the first use of GHES by @​danwkennedy in #​727
• Update GHES guidance to include reference to Node 20 version by @​patrikpolyak in #​725
• Bump @actions/artifact to v4.0.0
• Prepare v5.0.0 by @​danwkennedy in #​734

New Contributors

• @​GhadimiR made their first contribution in #​681
• @​nebuk89 made their first contribution in #​712
• @​danwkennedy made their first contribution in #​727
• @​patrikpolyak made their first contribution in #​725

Full Changelog: actions/upload-artifact@v4...v5.0.0

v5

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[anitrend]

OpenCode Dependabot Risk Review

Schema: local-stack.dependabot-risk.v1

Decision: NEUTRAL
Risk: MEDIUM
Automerge allowed: false
Update type: semver-major
Ecosystem: github-actions

Summary

Renovate PR updates actions/upload-artifact from v4 to v7 in .github/workflows/ci.yml. This is a semver-major bump for a GitHub Actions dependency spanning multiple breaking releases: v5 (Node 24 support), v6 (Node.js 24 runtime, requires Actions Runner >= 2.327.1 for self-hosted runners), and v7 (ESM migration and new direct-upload mode). The change is limited to the CI workflow file; no runtime services, stacks, secrets, or deployment files are affected. Per the decision policy, a major github-actions update combined with a .github/workflows/* file change returns neutral and must not be auto-merged.

Changed runtime artifacts

No runtime image changes detected.

Runtime impact

CI workflow only; no runtime service impact. Artifact upload behavior may change subtly due to ESM migration and the new direct-upload option.

Breaking change assessment

Major version bump v4 -> v7 includes breaking changes: v5/v6 move the action to a Node.js 24 runtime (minimum Actions Runner version 2.327.1 for self-hosted runners), and v7 migrates the action to ESM and adds a new direct-upload mode (archive=false). No breaking config migration for runtime services was found.

Required checks

• CI workflow run (lint/validate) with actions/upload-artifact@v7

Manual follow-up

• Confirm the Actions runner version satisfies the Node.js 24 requirement (>= 2.327.1) if self-hosted runners are used
• Verify artifact upload/download behavior is unchanged for existing workflow consumers

Sources checked

• Dependabot metadata
• PR diff
• Release notes in PR body

[anitrend]

OpenCode risk gate: neutral. Manual review required. Risk: medium. Reason: Renovate PR updates actions/upload-artifact from v4 to v7 in .github/workflows/ci.yml. This is a semver-major bump for a GitHub Actions dependency spanning multiple breaking releases: v5 (Node 24 support), v6 (Node.js 24 runtime, requires Actions Runner >= 2.327.1 for self-hosted runners), and v7 (ESM migration and new direct-upload mode). The change is limited to the CI workflow file; no runtime services, stacks, secrets, or deployment files are affected. Per the decision policy, a major github-actions update combined with a .github/workflows/* file change returns neutral and must not be auto-merged.

[anitrend]

OpenCode risk gate: changes requested. Risk: high. Reason: Renovate PR updates actions/upload-artifact from v4 to v7 (major). Changed files include .github/workflows/ci.yml and three generated stack files (stacks/infrastructure.yml, stacks/observability.yml, stacks/platform.yml) without any matching source Compose or fragment changes. This is a semver major update in the github-actions ecosystem, a workflow file is modified, and generated stacks are changed without corresponding source changes — all of which independently trigger non-approve conditions.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Owner-authorized manual promotion after reviewing the current head, workflow change, generated stack consistency, and passing required checks.

[wax911]

Reviewed the current Renovate head, upload-artifact major-version workflow change, generated stack consistency, and passing required CI checks. Owner-authorized manual promotion.