From 51e6b0e40bd10815ef3c64ea90e672eaa43d4706 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Tue, 12 Aug 2025 10:13:46 +0200 Subject: [PATCH] workflows: fix actions/download-artifact hashes The Dependabot update change the hashes to the latest main branch commit instead of the v5.0.0 tag - also it didn't adjust the tags in the comments accordingly. Last but not least, one of the references used a `@v5` reference instead of the commit hash. The latter is probably what Dependabot tripped on. --- .github/workflows/eval.yml | 4 ++-- .github/workflows/reviewers.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml index dc9889545857..835fa4c43d99 100644 --- a/.github/workflows/eval.yml +++ b/.github/workflows/eval.yml @@ -125,7 +125,7 @@ jobs: GH_TOKEN: ${{ github.token }} run: gh api /rate_limit | jq - - uses: actions/download-artifact@v5 + - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0 if: steps.targetRunId.outputs.targetRunId with: run-id: ${{ steps.targetRunId.outputs.targetRunId }} @@ -171,7 +171,7 @@ jobs: pinnedFrom: trusted - name: Download output paths and eval stats for all systems - uses: actions/download-artifact@de96f4613b77ec03b5cf633e7c350c32bd3c5660 # v4.1.8 + uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0 with: pattern: diff-* path: diff diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml index 2cddb17a1018..58c201724273 100644 --- a/.github/workflows/reviewers.yml +++ b/.github/workflows/reviewers.yml @@ -96,7 +96,7 @@ jobs: run: gh api /rate_limit | jq - name: Download the comparison results - uses: actions/download-artifact@de96f4613b77ec03b5cf633e7c350c32bd3c5660 # v4.1.8 + uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0 with: run-id: ${{ steps.eval.outputs.run-id }} github-token: ${{ github.token }}