ci: pin download-artifact v8.0.2 and assert SHA pinning by shape (supersedes #133)

[karlwaldman]

Problem

Dependabot #133 (actions/download-artifact 8.0.1 -> 8.0.2) is red: tests/release-readiness.test.ts asserts the literal old SHA 3e5f45b2..., so any pin bump fails (run 38280809117, Node 24, 2026-10-12).

Change

• Test now asserts both artifact actions in publish.yml are pinned to a 40-hex commit SHA and never to a @vN tag.
• publish.yml takes the v8.0.2 SHA 9000827ccba6bdab643e8b6fd33ac0654aef8333 (verified: gh api repos/actions/download-artifact/git/ref/tags/v8.0.2).

Verification (local)

• Red: old test + new SHA -> 1 failed (same failure as CI).
• Green: new test + new SHA -> 5/5.
• Negative: new test + download-artifact@v8 tag pin -> 1 failed.
• Full suite: 917 passed, 1 skipped.

Not included: vitest 5 (#135/#136). vitest 5.0.3 requires Node ^22.12.0 || ^24 || >=26; the test matrix runs Node 20 and engines is >=18. The two Dependabot PRs also fail separately because each bumps half of a peer pair (ERESOLVE).

Expected effect: Dependabot artifact-action bumps stop failing the release-readiness test; #133 can be closed as superseded.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QQ7W3CkRKEnBpU5KRQUfUu

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2c73c26c-e5ea-41e2-b756-23ae8169a701

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[karlwaldman]

Adversarial review: APPROVE (head 4a15100)

Pin check:

• gh api repos/actions/download-artifact/git/ref/tags/v8.0.2 returns commit 9000827ccba6bdab643e8b6fd33ac0654aef8333, which matches both pins in publish.yml.
• v8.0.1 returns 3e5f45b2…, the old pin. So this is the 8.0.1 → 8.0.2 bump, as the PR claims.

Test (local worktree):

• tests/release-readiness.test.ts passes 5/5.
• Mutation: replacing the download pin with download-artifact@v8 gives 1 failed / 4 passed. The new tag-pin guard bites.

actionlint: 2 SC2094 info notes at publish.yml:86. The same 2 notes are present on main. Nothing new.

CI: all green (Node 20/22/24, lint, ESM/CJS smoke, snippets, live contract).

Non-blocking:

1. The # v8 comments could say # v8.0.2.
2. toMatch asserts at least one 40-hex pin per action, not every occurrence. The @vN negative check covers the realistic regression.