search

Contrast-Security-OSS / contrast-sca-action

Contrast SCA GitHub Action
Apache License 2.0
10 stars 3 forks source link

upload-artifact@v3 deprecation #33

Closed tough-griff closed 2 weeks ago

tough-griff commented 2 months ago

This action uses actions/upload-artifact@v3, which is deprecated.

Deprecation notice: v1, v2, and v3 of the artifact actions The following artifacts were uploaded using a version of actions/upload-artifact that is scheduled for deprecation: "fingerPrint.log", "fingerPrintInfo.json", "package-lock.json.contrast.log". Please update your workflow to use v4 of the artifact actions. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/

From the link above, this action will no longer be usable starting November 30, 2024.

Starting November 30, 2024, GitHub Actions customers will no longer be able to use v3 of actions/upload-artifact or actions/download-artifact. Customers should update workflows to begin using v4 of the artifact actions as soon as possible. While v4 of the artifact actions improves upload and download speeds by up to 98% and includes several new features, there are key differences from previous versions that may require updates to your workflows. Please see the documentation in the project repositories for guidance on how to migrate your workflows.

This will cause workflow failures for anyone leveraging this action.

tough-griff commented 2 months ago

v4 does have the breaking change where you can no longer upload multiple artifacts of the same name. Since our internal workflows calling this action (at least the NodeJS ones I've seen) use the action in a matrix, the uploaded files should probably attach some sort of prefix.

wrngrn commented 2 weeks ago

Closed out with v3 of this action we are now using upload action@v4. A random suffix will be generated to support the matrix run and prevent uploading with the same name. The user can set this to a determinate string by passing --modifier