From d6cb28c527b03f25449daf6a9703c8e2cc72e3e8 Mon Sep 17 00:00:00 2001 From: fonkamloic Date: Wed, 12 Aug 2026 10:57:05 -0400 Subject: [PATCH 1/3] chore(deps): bump actions/checkout to v7, upload-artifact to v7, setup-java to v5 Replicates dependabot #8/#9/#11, which the branch ruleset blocks from merging (bot-authored PRs never receive the Copilot review the copilot_code_review rule waits for). Same review rationale as noted on those PRs: every usage pins explicit stable inputs; the upload/download-artifact pair stays consistent (download@v8 landed via #7); publish workflows are tag-triggered so the residual risk surfaces only at the next release and is recoverable by re-tag. --- .github/workflows/flutter_compile.yaml | 4 ++-- .github/workflows/intellij_plugin.yaml | 16 ++++++++-------- .github/workflows/vscode_extension.yaml | 6 +++--- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/flutter_compile.yaml b/.github/workflows/flutter_compile.yaml index 92f7e42..536d731 100644 --- a/.github/workflows/flutter_compile.yaml +++ b/.github/workflows/flutter_compile.yaml @@ -34,7 +34,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: ๐Ÿ“š Git Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: ๐ŸŽฏ Setup Dart uses: dart-lang/setup-dart@v1 @@ -72,7 +72,7 @@ jobs: id-token: write steps: - name: ๐Ÿ“š Git Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: ๐ŸŽฏ Setup Dart uses: dart-lang/setup-dart@v1 diff --git a/.github/workflows/intellij_plugin.yaml b/.github/workflows/intellij_plugin.yaml index 59a7361..b66a902 100644 --- a/.github/workflows/intellij_plugin.yaml +++ b/.github/workflows/intellij_plugin.yaml @@ -27,10 +27,10 @@ jobs: runs-on: ubuntu-latest steps: - name: ๐Ÿ“š Git Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: โ˜• Setup JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: distribution: temurin java-version: "17" @@ -42,7 +42,7 @@ jobs: run: ./gradlew buildPlugin - name: ๐Ÿ“ค Upload Plugin Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: intellij-plugin path: extensions/intellij/build/distributions/*.zip @@ -52,14 +52,14 @@ jobs: timeout-minutes: 30 steps: - name: ๐Ÿ“š Git Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: ๐Ÿงน Free Runner Disk Space run: sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc working-directory: / - name: โ˜• Setup JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: distribution: temurin java-version: "17" @@ -72,7 +72,7 @@ jobs: - name: ๐Ÿ“ค Upload Verifier Reports if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: plugin-verifier-reports path: extensions/intellij/build/reports/pluginVerifier @@ -86,10 +86,10 @@ jobs: contents: write steps: - name: ๐Ÿ“š Git Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: โ˜• Setup JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: distribution: temurin java-version: "17" diff --git a/.github/workflows/vscode_extension.yaml b/.github/workflows/vscode_extension.yaml index 0d6d039..b3d466c 100644 --- a/.github/workflows/vscode_extension.yaml +++ b/.github/workflows/vscode_extension.yaml @@ -27,7 +27,7 @@ jobs: runs-on: ubuntu-latest steps: - name: ๐Ÿ“š Git Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: ๐ŸŸข Setup Node uses: actions/setup-node@v7 @@ -49,7 +49,7 @@ jobs: run: npx @vscode/vsce package --no-git-tag-version - name: ๐Ÿ“ค Upload VSIX - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: vsix path: extensions/vscode/*.vsix @@ -62,7 +62,7 @@ jobs: contents: write steps: - name: ๐Ÿ“š Git Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: ๐ŸŸข Setup Node uses: actions/setup-node@v7 From f6cba52671e8c01ab3b4b5d33f58b3282fc4c1a1 Mon Sep 17 00:00:00 2001 From: fonkamloic Date: Wed, 12 Aug 2026 11:10:24 -0400 Subject: [PATCH 2/3] Review Medium: match the artifact pair at v8, fail release on empty dist upload-artifact goes v8 (not v7) so the tag-only upload/download pair shares a major, and the GitHub release step now fails when dist/*.zip matches nothing instead of silently publishing a release without the plugin. --- .github/workflows/intellij_plugin.yaml | 8 ++++++-- .github/workflows/vscode_extension.yaml | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/intellij_plugin.yaml b/.github/workflows/intellij_plugin.yaml index b66a902..96bf521 100644 --- a/.github/workflows/intellij_plugin.yaml +++ b/.github/workflows/intellij_plugin.yaml @@ -42,7 +42,7 @@ jobs: run: ./gradlew buildPlugin - name: ๐Ÿ“ค Upload Plugin Artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v8 with: name: intellij-plugin path: extensions/intellij/build/distributions/*.zip @@ -72,7 +72,7 @@ jobs: - name: ๐Ÿ“ค Upload Verifier Reports if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v8 with: name: plugin-verifier-reports path: extensions/intellij/build/reports/pluginVerifier @@ -115,4 +115,8 @@ jobs: uses: softprops/action-gh-release@v2 with: files: dist/*.zip + # An empty dist/ must fail the release, not publish one with no + # plugin attached (the upload/download pair only runs on tags, + # so PR CI can never catch that). + fail_on_unmatched_files: true generate_release_notes: true diff --git a/.github/workflows/vscode_extension.yaml b/.github/workflows/vscode_extension.yaml index b3d466c..cd8c081 100644 --- a/.github/workflows/vscode_extension.yaml +++ b/.github/workflows/vscode_extension.yaml @@ -49,7 +49,7 @@ jobs: run: npx @vscode/vsce package --no-git-tag-version - name: ๐Ÿ“ค Upload VSIX - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v8 with: name: vsix path: extensions/vscode/*.vsix From 8ab86d7c041f6f4204ce438a934d9c37c37b43b1 Mon Sep 17 00:00:00 2001 From: fonkamloic Date: Wed, 12 Aug 2026 11:19:20 -0400 Subject: [PATCH 3/3] =?UTF-8?q?upload-artifact=20back=20to=20v7=20?= =?UTF-8?q?=E2=80=94=20v8=20does=20not=20exist=20for=20the=20upload=20acti?= =?UTF-8?q?on?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The upload/download majors are simply offset (upload latest is v7, download latest is v8, both on the shared v4+ artifact backend), which is exactly the pairing dependabot proposed. fail_on_unmatched_files stays: an empty dist/ must fail the release. --- .github/workflows/intellij_plugin.yaml | 4 ++-- .github/workflows/vscode_extension.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/intellij_plugin.yaml b/.github/workflows/intellij_plugin.yaml index 96bf521..e3d20c2 100644 --- a/.github/workflows/intellij_plugin.yaml +++ b/.github/workflows/intellij_plugin.yaml @@ -42,7 +42,7 @@ jobs: run: ./gradlew buildPlugin - name: ๐Ÿ“ค Upload Plugin Artifact - uses: actions/upload-artifact@v8 + uses: actions/upload-artifact@v7 with: name: intellij-plugin path: extensions/intellij/build/distributions/*.zip @@ -72,7 +72,7 @@ jobs: - name: ๐Ÿ“ค Upload Verifier Reports if: always() - uses: actions/upload-artifact@v8 + uses: actions/upload-artifact@v7 with: name: plugin-verifier-reports path: extensions/intellij/build/reports/pluginVerifier diff --git a/.github/workflows/vscode_extension.yaml b/.github/workflows/vscode_extension.yaml index cd8c081..b3d466c 100644 --- a/.github/workflows/vscode_extension.yaml +++ b/.github/workflows/vscode_extension.yaml @@ -49,7 +49,7 @@ jobs: run: npx @vscode/vsce package --no-git-tag-version - name: ๐Ÿ“ค Upload VSIX - uses: actions/upload-artifact@v8 + uses: actions/upload-artifact@v7 with: name: vsix path: extensions/vscode/*.vsix