Repository navigation
build(deps): bump actions/upload-pages-artifact from 3 to 5 - #198
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM, straightforward dependency version bump.
What was reviewed: the single-line change in .github/workflows/docs.yml bumping actions/upload-pages-artifact from v3 to v5. Confirmed no other lines in the workflow (permissions, inputs, job structure) were touched, and the action's inputs (path: website/build) remain compatible with the new major version per its release notes.
Extended reasoning...
The only change is a one-line version bump of a GitHub Actions dependency (actions/upload-pages-artifact v3 to v5) in the docs publishing workflow, a dependabot PR. No security-sensitive surface (auth, permissions, secrets) is touched, the action's with: block is unchanged, and this is a standard mechanical dependency update with no design decisions involved.
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
No issues found by static checks — no coupling regressions or blocking issues in the code graph. That is not the same as safe to merge: see what was not checked.
Not checked: tests were not run; no formal proof of the changed code.
Graphify review — findings
Bumps actions/upload-pages-artifact from v3 to v5 in the docs build job, so the Pages artifact built from website/build is packaged by the newer major version before the deploy step publishes it. The jump skips a major version, and the new packaging may exclude dotfiles from the uploaded site, which would change what gets served.
No blocking issues surfaced. 2 lower-confidence candidates did not survive cross-model review.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 3 functions depend on the 3 functions this change touches.
Health — grade A; no new coupling hotspots.
Verification — 3 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 3 function(s) in the blast radius were not formally verified this run
Bumps [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) from 3 to 5. - [Release notes](https://github.com/actions/upload-pages-artifact/releases) - [Commits](actions/upload-pages-artifact@v3...v5) --- updated-dependencies: - dependency-name: actions/upload-pages-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
b549e14 to
aee1368
Compare
Bumps actions/upload-pages-artifact from 3 to 5.
Release notes
Sourced from actions/upload-pages-artifact's releases.
Commits
fc324d3Merge pull request #139 from Tom-van-Woudenberg/patch-1fe9d4b7Merge branch 'main' into patch-10ca1617Merge pull request #137 from jonchurch/include-hidden-files57f0e84Update action.yml4a90348v7 --> hash56f665aUpdate upload-artifact action to version 7f7615f5Addinclude-hidden-filesinput7b1f4a7Merge pull request #127 from heavymachinery/pin-sha4cc19c7Pinactions/upload-artifactto SHA2d163beMerge pull request #107 from KittyChiu/main