chore(deps): bump actions/download-artifact from 4 to 5 #6044

dependabot · 2025-09-08T05:35:08Z

Bumps actions/download-artifact from 4 to 5.

Release notes

Sourced from actions/download-artifact's releases.

v5.0.0

What's Changed

Update README.md by @nebuk89 in actions/download-artifact#407

BREAKING fix: inconsistent path behavior for single artifact downloads by ID by @GrantBirki in actions/download-artifact#416

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

By name: name: my-artifact → extracted to path/ (direct)

By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

By name: name: my-artifact → extracted to path/ (unchanged)

By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:

You download artifacts by name

You download multiple artifacts by ID

You already use merge-multiple: true as a workaround

⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):
- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist
# Files were in: dist/my-artifact/
Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):
</tr></table> 

... (truncated)

Commits

634f93c Merge pull request #416 from actions/single-artifact-id-download-path
b19ff43 refactor: resolve download path correctly in artifact download tests (mainly ...
e262cbe bundle dist
bff23f9 update docs
fff8c14 fix download path logic when downloading a single artifact by id
448e3f8 Merge pull request #407 from actions/nebuk89-patch-1
47225c4 Update README.md
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

Chores
- Updated CI workflow to use the latest artifact download action, ensuring compatibility with current GitHub infrastructure.
- Improves reliability and stability of artifact retrieval during automated builds and releases.
- Reduces risk of pipeline failures related to outdated dependencies.
- Streamlines future maintenance by standardizing on current action versions.
- No changes to features, performance, or user experience; this is maintenance-only.

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 5. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v4...v5) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2025-09-08T05:35:15Z

Walkthrough

Bumps the GitHub Actions step in .github/workflows/forest.yml to use actions/download-artifact v5 instead of v4 for the forest-${{ runner.os }} artifact within the calibnet-api-test-stateful job. No other workflow logic or steps were modified.

Changes

Cohort / File(s)	Summary
CI workflow action version bump `.github/workflows/forest.yml`	Updated `uses: actions/download-artifact@v4` to `@v5` for the `forest-${{ runner.os }}` artifact download step in `calibnet-api-test-stateful`.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

chore(deps): bump actions/download-artifact from 4 to 5 #5950 — Also upgrades actions/download-artifact from v4 to v5 in the same forest workflow, mirroring this change.

Suggested reviewers

hanabi1224
sudo-shashank

Warning

Review ran into problems

🔥 Problems

Errors were encountered while retrieving linked issues.

Errors (1)

Failed to retrieve linked issues from the platform client.

✨ Finishing Touches

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch dependabot/github_actions/actions/download-artifact-5

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 0

🧹 Nitpick comments (5)

.github/workflows/forest.yml (5)
394-398: Remove duplicate download step to cut runner time and I/O.

This second actions/download-artifact@v5 call re-downloads the same artifact to the same path immediately after the previous step. It’s redundant and costs minutes.

Apply:
-      - uses: actions/download-artifact@v5
-        with:
-          name: "forest-${{ runner.os }}"
-          path: ~/.cargo/bin
147-155: Duplicate artifact download in calibnet-check.

Two consecutive downloads of the same artifact to the same path. Remove one to save time.
-      - uses: actions/download-artifact@v5
-        with:
-          name: "forest-${{ runner.os }}"
-          path: ~/.cargo/bin
177-185: Duplicate artifact download in calibnet-stateless mode check.

Same redundancy; safe to delete one.
-      - uses: actions/download-artifact@v5
-        with:
-          name: "forest-${{ runner.os }}"
-          path: ~/.cargo/bin
204-211: Duplicate artifact download in calibnet stateless RPC check.

Remove the extra download.
-      - uses: actions/download-artifact@v5
-        with:
-          name: "forest-${{ runner.os }}"
-          path: ~/.cargo/bin
365-372: Duplicate artifact download in calibnet eth mapping check.

Delete the redundant step.
-      - uses: actions/download-artifact@v5
-        with:
-          name: "forest-${{ runner.os }}"
-          path: ~/.cargo/bin

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between aa977cf and c6b7627.

📒 Files selected for processing (1)

.github/workflows/forest.yml (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)

GitHub Check: tests-release
GitHub Check: tests
GitHub Check: All lint checks
GitHub Check: Build forest binaries on Linux AMD64
GitHub Check: Build Ubuntu
GitHub Check: cargo-publish-dry-run
GitHub Check: Build MacOS

🔇 Additional comments (2)

.github/workflows/forest.yml (2)

390-398: Bump to actions/download-artifact@v5 is safe here (download by name).

You download a single artifact by name into a specific path, which retains the same extract-to-path behavior in v5. The v5 breaking change only affects single downloads by ID (now extracted directly to path instead of a nested subdir). No action needed. (github.com)

390-398: All download-artifact@v5 calls use the name/path syntax; no artifact-ids, pattern, or merge-multiple keys detected in any workflow.

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 8, 2025

dependabot bot requested a review from a team as a code owner September 8, 2025 05:35

dependabot bot added the dependencies Pull requests that update a dependency file label Sep 8, 2025

dependabot bot requested review from hanabi1224 and sudo-shashank and removed request for a team September 8, 2025 05:35

coderabbitai bot reviewed Sep 8, 2025

View reviewed changes

hanabi1224 approved these changes Sep 8, 2025

View reviewed changes

LesnyRumcajs approved these changes Sep 8, 2025

View reviewed changes

LesnyRumcajs added this pull request to the merge queue Sep 8, 2025

Merged via the queue into main with commit ed3dd9b Sep 8, 2025
41 of 60 checks passed

LesnyRumcajs deleted the dependabot/github_actions/actions/download-artifact-5 branch September 8, 2025 07:05

coderabbitai bot mentioned this pull request Oct 28, 2025

chore(deps): bump actions/download-artifact from 5 to 6 #6199

Merged

coderabbitai bot mentioned this pull request Dec 15, 2025

chore(deps): bump actions/download-artifact from 6 to 7 #6345

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump actions/download-artifact from 4 to 5 #6044

chore(deps): bump actions/download-artifact from 4 to 5 #6044

Uh oh!

dependabot bot commented on behalf of github Sep 8, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Sep 8, 2025 •

edited

Loading

Review ran into problems

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

chore(deps): bump actions/download-artifact from 4 to 5 #6044

chore(deps): bump actions/download-artifact from 4 to 5 #6044

Uh oh!

Conversation

dependabot bot commented on behalf of github Sep 8, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.0.0

What's Changed

v5.0.0

🚨 Breaking Change

What Changed

Migration Guide

✅ No Action Needed If:

⚠️ Action Required If:

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Review ran into problems

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot bot commented on behalf of github Sep 8, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Sep 8, 2025 •

edited

Loading