From c8225b4909cbf65c2a950290078e9d5992ca4aad Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 16:20:28 +0000
Subject: [PATCH] chore(actions): bump actions/upload-artifact from 7.0.1 to
 7.0.2

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.1 to 7.0.2.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/_attestation-check.yaml     |  4 ++--
 .github/workflows/_fleet-acceptance.yaml      | 10 +++++-----
 .github/workflows/_fleet-reconcile.yaml       |  2 +-
 .github/workflows/_release-candidate.yaml     | 20 +++++++++----------
 .github/workflows/_siteops-distribution.yaml  |  4 ++--
 .../workflows/_workspace-distribution.yaml    |  4 ++--
 .github/workflows/ci.yaml                     |  2 +-
 .github/workflows/e2e-test.yaml               | 12 +++++------
 .github/workflows/integration-test.yaml       |  2 +-
 9 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/_attestation-check.yaml b/.github/workflows/_attestation-check.yaml
index 70c73998..3ba746ed 100644
--- a/.github/workflows/_attestation-check.yaml
+++ b/.github/workflows/_attestation-check.yaml
@@ -80,7 +80,7 @@ jobs:
 
       - name: Upload the non-release evidence
         id: upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: runner-attestation-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/attestation-check
@@ -251,7 +251,7 @@ jobs:
 
       - name: Retain cryptographically verified observations
         if: ${{ always() && steps.verify.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: runner-attestation-verification-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/attestation-check-verification.json
diff --git a/.github/workflows/_fleet-acceptance.yaml b/.github/workflows/_fleet-acceptance.yaml
index 3b22c1d5..5d8577b9 100644
--- a/.github/workflows/_fleet-acceptance.yaml
+++ b/.github/workflows/_fleet-acceptance.yaml
@@ -207,7 +207,7 @@ jobs:
       - name: Retain resource ownership
         id: ownership
         timeout-minutes: 5
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fleet-ownership-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/fleet/ownership.json
@@ -364,7 +364,7 @@ jobs:
             --logs "$RUNNER_TEMP/fleet/readiness-private" --output "$RUNNER_TEMP/fleet/readiness.json"
       - name: Retain host readiness
         timeout-minutes: 5
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fleet-readiness-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.slot }}
           path: ${{ runner.temp }}/fleet/readiness.json
@@ -564,7 +564,7 @@ jobs:
       - name: Retain controller outcome
         timeout-minutes: 5
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fleet-deployment-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/fleet/deployment.json
@@ -655,7 +655,7 @@ jobs:
       - name: Retain cleanup outcome
         timeout-minutes: 5
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fleet-cleanup-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/fleet/cleanup.json
@@ -726,7 +726,7 @@ jobs:
           set -euo pipefail
           "$PYTHON" -B scripts/aggregate-fleet-results.py --root "$RUNNER_TEMP/fleet-results" \
             --output "$RUNNER_TEMP/fleet-acceptance.json"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fleet-acceptance-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/fleet-acceptance.json
diff --git a/.github/workflows/_fleet-reconcile.yaml b/.github/workflows/_fleet-reconcile.yaml
index e03e9f6b..10cdc969 100644
--- a/.github/workflows/_fleet-reconcile.yaml
+++ b/.github/workflows/_fleet-reconcile.yaml
@@ -143,7 +143,7 @@ jobs:
             --private-logs "$RUNNER_TEMP/fleet/reconcile-private" --output "$RUNNER_TEMP/fleet/reconciled.json"
       - name: Retain reconciliation outcome
         if: always() && steps.ownership.outputs.ownership-id != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ inputs.kind == 'site' && format('site-reconciliation-{0}-{1}-{2}', github.run_id, github.run_attempt, matrix.slot) || format('fleet-reconciliation-{0}-{1}', github.run_id, github.run_attempt) }}
           path: ${{ runner.temp }}/fleet/reconciled.json
diff --git a/.github/workflows/_release-candidate.yaml b/.github/workflows/_release-candidate.yaml
index 66d9e7e0..041adf1b 100644
--- a/.github/workflows/_release-candidate.yaml
+++ b/.github/workflows/_release-candidate.yaml
@@ -299,7 +299,7 @@ jobs:
       - name: Retain the declaration and notes
         id: upload
         if: steps.plan.outputs.active == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-plan-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/release-plan
@@ -503,7 +503,7 @@ jobs:
 
       - name: Retain verified workspace assets
         id: upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: workspace-release-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/workspace-release
@@ -658,7 +658,7 @@ jobs:
 
       - name: Retain selected engine inputs
         id: upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: workspace-engine-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/selected-engine
@@ -669,7 +669,7 @@ jobs:
 
       - name: Retain the engine reference subject
         id: reference-upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: engine-reference-subject-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/engine-reference/siteops-engine.json
@@ -781,7 +781,7 @@ jobs:
 
       - name: Retain signed engine reference
         id: upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: engine-reference-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/engine-reference-attested
@@ -928,7 +928,7 @@ jobs:
           fi
 
       - name: Retain workspace qualification result
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: workspace-qualification-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.platform }}-${{ matrix.python }}
           path: ${{ runner.temp }}/workspace-qualification.json
@@ -1605,7 +1605,7 @@ jobs:
       - name: Retain the complete publication payload
         id: payload-upload
         if: needs.prepare.outputs.bundle == 'true' || needs.prepare.outputs.workspaces == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-payload-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/release-payload
@@ -1626,7 +1626,7 @@ jobs:
 
       - name: Retain the final release notes
         id: notes-upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-notes-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/publish-notes.md
@@ -1636,7 +1636,7 @@ jobs:
 
       - name: Retain the frozen asset list
         id: assets-upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-assets-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/final-release-assets/release-assets.json
@@ -1798,7 +1798,7 @@ jobs:
 
       - name: Retain the admission receipt
         id: upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: candidate-admission-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/candidate-admission/receipt.json
diff --git a/.github/workflows/_siteops-distribution.yaml b/.github/workflows/_siteops-distribution.yaml
index d65ebacd..9cbb8c0c 100644
--- a/.github/workflows/_siteops-distribution.yaml
+++ b/.github/workflows/_siteops-distribution.yaml
@@ -304,7 +304,7 @@ jobs:
 
       - name: Upload the build artifacts
         id: upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: siteops-install-build-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.build.outputs.staging-path }}
@@ -470,7 +470,7 @@ jobs:
 
       - name: Upload the attested assets
         id: stage
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ steps.names.outputs.staging-artifact-name }}
           path: ${{ runner.temp }}/siteops-staging
diff --git a/.github/workflows/_workspace-distribution.yaml b/.github/workflows/_workspace-distribution.yaml
index ed8cc812..e99d286d 100644
--- a/.github/workflows/_workspace-distribution.yaml
+++ b/.github/workflows/_workspace-distribution.yaml
@@ -242,7 +242,7 @@ jobs:
 
       - name: Retain the unsigned workspace assets
         id: upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: workspace-build-${{ github.run_id }}-${{ github.run_attempt }}-${{ inputs.slot }}
           path: ${{ runner.temp }}/workspace-assets
@@ -422,7 +422,7 @@ jobs:
           '
 
       - name: Upload the attested workspace
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: workspace-attested-${{ github.run_id }}-${{ github.run_attempt }}-${{ inputs.slot }}
           path: ${{ runner.temp }}/workspace-attested
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index bdd0b636..4a7338d2 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -239,7 +239,7 @@ jobs:
 
       - name: Upload coverage report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-report
           path: coverage.xml
diff --git a/.github/workflows/e2e-test.yaml b/.github/workflows/e2e-test.yaml
index 3b570449..86ac07a0 100644
--- a/.github/workflows/e2e-test.yaml
+++ b/.github/workflows/e2e-test.yaml
@@ -1091,7 +1091,7 @@ jobs:
       - name: Retain Site ownership
         if: env.CANDIDATE_MODE == 'true'
         timeout-minutes: 5
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: site-ownership-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.secret-sync-mode }}
           path: ${{ runner.temp }}/fleet/ownership.json
@@ -2284,13 +2284,13 @@ jobs:
           )
           PY
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always() && needs.prep.outputs.published-mode != 'true'
         with:
           name: e2e-results-${{ matrix.aio-release }}-secretsync-${{ matrix.secret-sync-mode }}-opcua-${{ matrix.opcua-mode }}
           path: e2e-results-${{ matrix.aio-release }}-secretsync-${{ matrix.secret-sync-mode }}-opcua-${{ matrix.opcua-mode }}.xml
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always() && needs.prep.outputs.published-mode == 'true' && env.CANDIDATE_MODE != 'true'
         with:
           name: published-e2e-${{ matrix.aio-release }}-${{ matrix.secret-sync-mode }}-${{ needs.prep.outputs.published-journey }}
@@ -2347,7 +2347,7 @@ jobs:
           pytest $PYTEST_PATHS -v -m integration --tb=long \
             --junitxml="e2e-results-${AIO_RELEASE_FROM}-to-${AIO_RELEASE_TO}-secretsync-${SECRET_SYNC_MODE}-opcua-${E2E_OPCUA_MODE}.xml"
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always() && needs.prep.outputs.upgrade-to != '' && needs.prep.outputs.upgrade-to != matrix.aio-release
         with:
           name: e2e-results-${{ matrix.aio-release }}-to-${{ needs.prep.outputs.upgrade-to }}-secretsync-${{ matrix.secret-sync-mode }}-opcua-${{ matrix.opcua-mode }}
@@ -2644,7 +2644,7 @@ jobs:
       - name: Retain the Site case outcome
         if: always() && env.CANDIDATE_MODE == 'true' && steps.select.outcome == 'success'
         timeout-minutes: 5
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: site-outcome-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.secret-sync-mode }}
           path: ${{ runner.temp }}/site-acceptance/outcome.json
@@ -2807,7 +2807,7 @@ jobs:
             echo "::error::Aggregation wrote no receipt, so this run records a failing result."
           fi
       # A failing receipt is retained too, so a newer failed run governs publication.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always() && steps.bind.outcome == 'success'
         with:
           name: release-acceptance-${{ github.run_id }}-${{ github.run_attempt }}-${{ steps.bind.outputs.admission-sha }}
diff --git a/.github/workflows/integration-test.yaml b/.github/workflows/integration-test.yaml
index 7298387f..b522895d 100644
--- a/.github/workflows/integration-test.yaml
+++ b/.github/workflows/integration-test.yaml
@@ -119,7 +119,7 @@ jobs:
           --junitxml=integration-results.xml
 
       - name: Publish test results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: integration-test-results