Driver
Dependabot opened bumps for actions/upload-artifact (v4→v7, #539) and github/codeql-action (v3→v4, #541), but their branches were cut from main and conflict with dev's diverged workflow files; dependabot can't auto-target dev until the target-branch: dev config (merged in #588) reaches main via a release. Apply the two major bumps manually against dev and close the conflicting dependabot PRs.
Scope
Acceptance Criteria
Glossary
| Term |
Definition |
| Major action bump |
Upgrading a pinned GitHub Action across a major version, possibly with breaking changes — validated by the PR's own CI. |
Driver
Dependabot opened bumps for
actions/upload-artifact(v4→v7, #539) andgithub/codeql-action(v3→v4, #541), but their branches were cut frommainand conflict withdev's diverged workflow files; dependabot can't auto-targetdevuntil thetarget-branch: devconfig (merged in #588) reachesmainvia a release. Apply the two major bumps manually againstdevand close the conflicting dependabot PRs.Scope
.github/workflows/: bump everyactions/upload-artifact@v4→@v7(extract-subpacks-on-release.yml, security-scan.yml, scorecard.yml) and everygithub/codeql-action/*@v3→@v4(codeql.yml init+analyze, scorecard.yml upload-sarif).Acceptance Criteria
upload-artifactusages ondevare@v7; allcodeql-actionusages are@v4.Glossary