build(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2

.github/workflows/mutants.yml

@@ -61,7 +61,7 @@ jobs:
 
       - name: Upload mutants.out
         if: ${{ !cancelled() && steps.rust-diff.outputs.needed == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: mutants-incremental.out
           path: mutants.out

.github/workflows/nightly-recovery.yml

@@ -244,7 +244,7 @@ jobs:
           echo "origin=$origin" >>"$GITHUB_OUTPUT"
           echo "release_id=$release_id" >>"$GITHUB_OUTPUT"; echo "date=$date" >>"$GITHUB_OUTPUT"; echo "version=$version" >>"$GITHUB_OUTPUT"
           echo "origin_manifest_sha256=$origin_manifest" >>"$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: nightly-recovery-plan, path: nightly-recovery-plan.json, retention-days: 90}
 
   build:
@@ -290,7 +290,7 @@ jobs:
           bash scripts/package-nightly.sh
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: 'target/nightly/codex-warp-${{ inputs.tag }}-${{ matrix.target }}.*'}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: 'nightly-recovery-build-${{ matrix.target }}', path: target/nightly/, if-no-files-found: error}
 
   collect:
@@ -315,7 +315,7 @@ jobs:
           jq -r '.artifacts[]|[.archiveSha256,.archive]|@tsv' candidate/codex-warp-nightly-manifest.json | sed $'s/\t/  /' >candidate/sha256.sum
           rm "${evidence[@]}"
           bash scripts/check-nightly-assets.sh candidate candidate/codex-warp-nightly-manifest.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: nightly-recovery-candidate, path: candidate/, if-no-files-found: error}
 
   load-origin:
@@ -362,7 +362,7 @@ jobs:
           NIGHTLY_MANIFEST_SCHEMA_PATH="$PWD/release-source/tools/nightly-manifest.schema.json" bash scripts/check-nightly-assets.sh candidate candidate/codex-warp-nightly-manifest.json "$PWD/release-source"
           jq -e --arg tag "$TAG" --arg sha "$SOURCE_SHA" --arg workflow "https://github.com/${{ github.repository }}/actions/runs/$ORIGIN_RUN_ID" '.tag==$tag and .sourceSha==$sha and .workflow==$workflow' candidate/codex-warp-nightly-manifest.json >/dev/null
           for archive in candidate/*.tar.xz candidate/*.zip; do bash scripts/verify-nightly-attestation.sh "$archive" candidate/codex-warp-nightly-manifest.json; done
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: nightly-recovery-candidate, path: candidate/, if-no-files-found: error}
 
   mutate-release:
@@ -446,7 +446,7 @@ jobs:
           candidate_assets="$({ while IFS= read -r file; do jq -n --arg name "$(basename "$file")" --arg digest "$(bash scripts/sha256-file.sh "$file")" '{name:$name,sha256:$digest}'; done < <(find candidate -maxdepth 1 -type f -print | sort); } | jq -sc '.')"
           branch_sha="$(git ls-remote --heads origin refs/heads/nightly | awk '{print $1}')"
           jq -n --arg operation "$OPERATION" --arg tag "$TAG" --arg source "$SOURCE_SHA" --argjson release_id "$release_id" --argjson release_state "$release_state" --argjson remote_assets "$remote_assets" --argjson candidate_assets "$candidate_assets" --arg manifest "$(bash scripts/sha256-file.sh candidate/codex-warp-nightly-manifest.json)" --arg plan "$(bash scripts/sha256-file.sh retained-plan/nightly-recovery-plan.json)" --arg tag_sha "$(git rev-parse "refs/tags/$TAG^{}")" --arg branch "$branch_sha" --arg workflow "${{ github.workflow_sha }}" --arg origin_run "$ORIGIN_RUN_ID" --arg origin_attempt "$ORIGIN_RUN_ATTEMPT" --argjson run "${{ github.run_id }}" --argjson attempt "${{ github.run_attempt }}" '{schemaVersion:1,operation:$operation,tag:$tag,sourceSha:$source,releaseId:$release_id,releaseState:$release_state,remoteAssets:$remote_assets,candidateAssets:$candidate_assets,manifestSha256:$manifest,planSha256:$plan,tagSha:$tag_sha,branchSha:(if ($branch|length)>0 then $branch else null end),controlWorkflowSha:$workflow,originRunId:(if ($origin_run|length)>0 then ($origin_run|tonumber) else null end),originRunAttempt:(if ($origin_attempt|length)>0 then ($origin_attempt|tonumber) else null end),runId:$run,runAttempt:$attempt}' >nightly-orphan-recovery-intent.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: nightly-orphan-recovery-intent, path: nightly-orphan-recovery-intent.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: nightly-orphan-recovery-intent.json}
@@ -499,7 +499,7 @@ jobs:
           live_releases="$(gh api --paginate "repos/${{ github.repository }}/releases?per_page=100" | jq -sc 'add // []')"
           [ "$(jq --arg tag "$TAG" --argjson id "$RELEASE_INPUT" '[.[] | select(.id==$id or .tag_name==$tag)] | length' <<<"$live_releases")" -eq 0 ]
           jq -n --arg tag "$TAG" --arg source "$SOURCE_SHA" --arg intent "$(bash scripts/sha256-file.sh nightly-orphan-recovery-intent.json)" --argjson release_id "$RELEASE_INPUT" --argjson run "${{ github.run_id }}" --argjson attempt "${{ github.run_attempt }}" '{schemaVersion:1,tag:$tag,sourceSha:$source,deletedReleaseId:$release_id,intentSha256:$intent,runId:$run,runAttempt:$attempt}' >nightly-deletion-receipt.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: inputs.operation == 'replace-unpublished-draft'
         with: {name: nightly-deletion-receipt, path: nightly-deletion-receipt.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2

.github/workflows/nightly.yml

@@ -136,7 +136,7 @@ jobs:
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: target/nightly/codex-warp-${{ needs.prepare.outputs.tag }}-${{ matrix.target }}.*
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nightly-${{ matrix.target }}
           path: target/nightly/
@@ -180,7 +180,7 @@ jobs:
           jq -r '.artifacts[] | [.archiveSha256,.archive] | @tsv' nightly-assets/codex-warp-nightly-manifest.json | sed $'s/\t/  /' >nightly-assets/sha256.sum
           rm "${evidence[@]}"
           SOURCE_DIR="$PWD" bash scripts/check-nightly-assets.sh nightly-assets nightly-assets/codex-warp-nightly-manifest.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nightly-release-candidate
           path: nightly-assets/
@@ -224,7 +224,7 @@ jobs:
             --argjson inventory "$(find nightly-assets -maxdepth 1 -type f -printf '%f\n' | sort | jq -Rsc 'split("\n")[:-1]')" \
             '{schemaVersion:1,operation:"fresh-nightly",repository:$repository,tag:$tag,sourceSha:$source,priorBranchSha:(if ($branch|length)>0 then $branch else null end),tagAbsent:true,releaseAbsent:true,workflowSha:$workflow_sha,runId:$run_id,runAttempt:$attempt,manifestSha256:$manifest,inventory:$inventory}' >nightly-intent.json
       - id: upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nightly-publication-intent
           path: nightly-intent.json
@@ -297,7 +297,7 @@ jobs:
           WORKFLOW_SHA: ${{ github.workflow_sha }}
         run: bash scripts/create-nightly-tag.sh
       - id: receipt
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: nightly-tag-creation-receipt, path: nightly-tag-receipt.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: nightly-tag-receipt.json}

.github/workflows/release-recovery.yml

@@ -146,7 +146,7 @@ jobs:
           echo "resume=$resume" >>"$GITHUB_OUTPUT"
           echo "remote=$remote" >>"$GITHUB_OUTPUT"
           echo "matrix=$matrix" >>"$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: official-recovery-plan
           path: official-recovery-plan.json
@@ -193,7 +193,7 @@ jobs:
       - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: target/distrib/codex-warp-${{ matrix.target }}.*
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: official-recovery-build-${{ matrix.target }}
           path: target/distrib/
@@ -255,7 +255,7 @@ jobs:
           jq -n --argjson publishable true --arg repository "${{ github.repository }}" --arg source "$SOURCE_SHA" --arg version "${TAG#v}" --arg lock "$(bash scripts/sha256-file.sh release-source/Cargo.lock)" --arg toolchain "$(bash scripts/sha256-file.sh release-source/rust-toolchain.toml)" --arg channel "$(sed -n 's/^channel = "\([^"]*\)"/\1/p' release-source/rust-toolchain.toml)" --arg rustc "$(rustc -Vv)" --arg cargo "$(cargo -Vv)" --arg contract "$(bash scripts/sha256-file.sh release-source/tools/release-contract.json)" --arg workflow_sha "${{ github.workflow_sha }}" --arg tag "$TAG" --argjson release_id "$RELEASE_ID" --arg schema "$(bash scripts/sha256-file.sh release-source/tools/dist-manifest.schema.json)" --argjson runners "$runners" --argjson recipe "$recipe_sha" '{publishable:$publishable,repository:$repository,sourceSha:$source,cargoVersion:$version,cargoLockSha256:$lock,rustToolchain:{fileSha256:$toolchain,channel:$channel,rustcVv:$rustc,cargoVv:$cargo},releaseContractSha256:$contract,workflow:{name:"Release Recovery",runId:${{ github.run_id }},runAttempt:${{ github.run_attempt }},workflowSha:$workflow_sha},dist:{version:"0.32.0",manifestSchemaSha256:$schema},runners:$runners,tag:$tag,peeledTagSha:$source,releaseId:$release_id,pullRequest:null,recovery:{controlWorkflowSha:$workflow_sha,recipeSha256:$recipe}}' >identity.json
           RELEASE_CONTRACT_PATH="$PWD/release-source/tools/release-contract.json" DIST_MANIFEST_SCHEMA_PATH="$PWD/release-source/tools/dist-manifest.schema.json" bash scripts/assemble-official-candidate.sh release-source/target/distrib identity.json dist-manifest.json candidate
           SOURCE_DIR="$PWD/release-source" RELEASE_CONTRACT_PATH="$PWD/release-source/tools/release-contract.json" DIST_MANIFEST_SCHEMA_PATH="$PWD/release-source/tools/dist-manifest.schema.json" RELEASE_METADATA_SCHEMA_PATH="$PWD/release-source/tools/release-metadata.schema.json" bash scripts/check-release-contract.sh official-publication candidate candidate/codex-warp-release-metadata.json candidate/dist-manifest.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: official-recovery-candidate, path: candidate/, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: candidate/codex-warp-release-metadata.json}
@@ -306,7 +306,7 @@ jobs:
           jq -e --arg tag "$TAG" --arg sha "$SOURCE_SHA" --argjson id "$RELEASE_ID" --argjson run "$ORIGIN_RUN_ID" --argjson attempt "$ORIGIN_RUN_ATTEMPT" '.tag == $tag and .sourceSha == $sha and .releaseId == $id and .workflow.runId == $run and .workflow.runAttempt == $attempt' candidate/codex-warp-release-metadata.json >/dev/null
           SOURCE_DIR="$PWD/release-source" RELEASE_CONTRACT_PATH="$PWD/release-source/tools/release-contract.json" DIST_MANIFEST_SCHEMA_PATH="$PWD/release-source/tools/dist-manifest.schema.json" RELEASE_METADATA_SCHEMA_PATH="$PWD/release-source/tools/release-metadata.schema.json" bash scripts/check-release-contract.sh official-publication candidate candidate/codex-warp-release-metadata.json candidate/dist-manifest.json
           for subject in candidate/*.tar.xz candidate/*.zip candidate/codex-warp-release-metadata.json; do bash scripts/verify-official-attestation.sh "$subject" candidate/codex-warp-release-metadata.json; done
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: official-recovery-candidate, path: candidate/, if-no-files-found: error}
 
   load-remote:
@@ -356,7 +356,7 @@ jobs:
           SOURCE_DIR="$PWD/release-source" RELEASE_CONTRACT_PATH="$PWD/release-source/tools/release-contract.json" DIST_MANIFEST_SCHEMA_PATH="$PWD/release-source/tools/dist-manifest.schema.json" RELEASE_METADATA_SCHEMA_PATH="$PWD/release-source/tools/release-metadata.schema.json" bash scripts/check-release-contract.sh official-publication candidate candidate/codex-warp-release-metadata.json candidate/dist-manifest.json
           jq -e --arg tag "$TAG" --arg sha "$SOURCE_SHA" --argjson id "$RELEASE_ID" '.tag == $tag and .sourceSha == $sha and .releaseId == $id' candidate/codex-warp-release-metadata.json >/dev/null
           for subject in candidate/*.tar.xz candidate/*.zip candidate/codex-warp-release-metadata.json; do bash scripts/verify-official-attestation.sh "$subject" candidate/codex-warp-release-metadata.json; done
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: official-recovery-candidate, path: candidate/, if-no-files-found: error}
 
   mutate:
@@ -443,7 +443,7 @@ jobs:
           jq -s '.' candidate-assets.jsonl >candidate-assets.json
           jq -n --arg operation "$OPERATION" --arg tag "$TAG" --arg source "$SOURCE_SHA" --argjson release_id "$RELEASE_ID" --arg workflow "${{ github.workflow_sha }}" --argjson run "${{ github.run_id }}" --argjson attempt "${{ github.run_attempt }}" --argjson existing "$(cat existing.json)" --argjson expected "$(cat candidate-assets.json)" --arg plan "$(bash scripts/sha256-file.sh retained-plan/official-recovery-plan.json)" --argjson recipe "$recipe_sha" '{schemaVersion:1,operation:$operation,tag:$tag,sourceSha:$source,releaseId:$release_id,controlWorkflowSha:$workflow,runId:$run,runAttempt:$attempt,planSha256:$plan,recipeSha256:$recipe,existingAssets:$existing,expectedAssets:$expected,expectedInventory:[$expected[].name],deleteAssetIds:[$existing[]|select(.matches|not)|.id]}' >official-recovery-intent.json
           echo "delete_count=$(jq '.deleteAssetIds|length' official-recovery-intent.json)" >>"$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: {name: official-recovery-intent, path: official-recovery-intent.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: {subject-path: official-recovery-intent.json}
@@ -481,7 +481,7 @@ jobs:
           remaining="$(gh api --paginate "repos/${{ github.repository }}/releases/$RELEASE_ID/assets" | jq -sc '[.[][] | .id]')"
           while IFS= read -r id; do jq -e --argjson id "$id" 'index($id)==null' <<<"$remaining" >/dev/null; done < <(jq -r '.deleteAssetIds[]' official-recovery-intent.json)
           jq -n --arg intent "$(bash scripts/sha256-file.sh official-recovery-intent.json)" --argjson ids "$(jq '.deleteAssetIds' official-recovery-intent.json)" --argjson run "${{ github.run_id }}" '{schemaVersion:1,intentSha256:$intent,deletedAssetIds:$ids,runId:$run}' >official-recovery-delete-receipt.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: inputs.operation == 'replace-unpublished-assets' && steps.preflight.outputs.delete_count != '0'
         with: {name: official-recovery-delete-receipt, path: official-recovery-delete-receipt.json, retention-days: 90, if-no-files-found: error}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2

.github/workflows/release.yml

@@ -74,7 +74,7 @@ jobs:
         shell: bash
         run: bash scripts/install-pinned-dist.sh
       - name: Cache dist
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/dist
@@ -90,7 +90,7 @@ jobs:
           cat plan-dist-manifest.json
           echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: artifacts-plan-dist-manifest
           path: plan-dist-manifest.json
@@ -196,7 +196,7 @@ jobs:
             --arg cargo "$(cargo -Vv)" \
             '{target:$target,runnerLabel:$label,runnerImage:$image,nativeTools:{observed:$native},rustcVv:$rustc,cargoVv:$cargo}' >"$evidence"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: artifacts-build-local-${{ join(matrix.targets, '_') }}
           path: |
@@ -244,7 +244,7 @@ jobs:
 
           cp dist-manifest.json "$BUILD_MANIFEST_NAME"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: artifacts-build-global
           path: |
@@ -304,7 +304,7 @@ jobs:
       - name: Assemble and validate exact proof asset set
         shell: bash
         run: bash scripts/assemble-pr-upload-proof.sh target/distrib identity.json pr-upload-proof
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pr-upload-proof-candidate
           path: pr-upload-proof/
@@ -427,7 +427,7 @@ jobs:
         run: |
           bash scripts/assemble-official-candidate.sh target/distrib identity.json dist-manifest.json release-assets
           SOURCE_DIR="$PWD" bash scripts/check-release-contract.sh official-publication release-assets release-assets/codex-warp-release-metadata.json release-assets/dist-manifest.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: official-release-candidate
           path: release-assets/