[dependabot]

Bumps the actions group with 3 updates: actions/upload-artifact, aquaproj/aqua-installer and actions/download-artifact.

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

Updates aquaproj/aqua-installer from 4.0.5 to 4.1.0

Release notes

Sourced from aquaproj/aqua-installer's releases.

v4.1.0

aquaproj/aqua-installer@v4.0.5...v4.1.0

SHA256 Checksum

4d3e513d42f425609c1ead6ecd40b9c62492011979dfe23d7012428a59efbe82  aqua-installer

Features

#951 Add the packages input to install only specified packages

aqua >= v2.64.0 is required.

- uses: aquaproj/aqua-installer@82d0e83878a8657c4a6f2ff1755d3bfbfc67f329 # v4.1.0
  with:
    aqua_version: v2.64.0
    packages: |
      ghalint # Command names
      suzuki-shunsuke/tfcmt # Package names
- run: ghalint run

By default, aqua-installer runs aqua i -l, so tools are installed by lazy install when they are first run. This has some problems:

1. Without a GitHub access token, lazy install can fail because of the GitHub API rate limit
2. Lazy install logs are mixed into the command output and become noise. This is confusing especially when a tool such as github-comment posts the output of a failed command to the pull request
3. If a GitHub access token is passed to avoid the rate limit, the token is also passed to commands that don't need it, which increases the risk of leaking it

A common workaround is to run each command with --version first to trigger lazy install, but the token is still passed to the command, it's hard to understand why the command is run, and you have to add a step for every command.

With the packages input, only the specified packages are installed up front rather than by lazy install, so you don't need to pass a GitHub access token when running them.

• Names are separated by whitespace or newlines
• Empty lines and text after # are ignored
• If packages is set and aqua_opts is the default value -l, -l isn't passed to aqua i, because -l skips installing packages

Others

#954 Update the bootstrap version to v2.64.0

Commits

• 82d0e83 chore: update the bootstrap version to v2.64.0 (#954)
• ff5d3c5 chore: update ubuntu-24.04 to ubuntu-26.04 (#953)
• 894cc7d feat: add the packages input to install only specified packages (#951)
• 98cc446 chore(deps): update dependency aquaproj/aqua to v2.64.0 (#952)
• 0efbed3 ci: replace renovate-config-validator-workflow with github-action-renovate-co...
• 7c175ff chore(deps): update suzuki-shunsuke/actionlint-action action to v0.2.1 (#948)
• 6d5ae97 chore(deps): update dependency aquaproj/aqua to v2.63.0 (#947)
• f1b80ae chore(deps): update dorny/paths-filter action to v4.0.3 (#946)
• 15ff1eb chore(deps): update dependency aquaproj/aqua to v2.62.3 (#945)
• 7559830 chore(deps): update dependency aquaproj/aqua to v2.62.2 (#944)
• Additional commits viewable in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

• Update the readme by @​danwkennedy in actions/download-artifact#473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in actions/download-artifact#492
• Prepare download-artifact v8.0.2 by @​tunc-d in actions/download-artifact#493

New Contributors

• @​tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

• 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
• e455989 Prepare download-artifact v8.0.2
• a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
• 29bb7ce Update @​actions/artifact to 6.3.1
• 484a0b5 Update the readme (#473)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.