Bump actions/download-artifact from 7 to 8

[dependabot]

Bumps actions/download-artifact from 7 to 8.

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to false.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Don't attempt to un-zip non-zipped downloads by @​danwkennedy in actions/download-artifact#460
• Add a setting to specify what to do on hash mismatch and default it to error by @​danwkennedy in actions/download-artifact#461

Full Changelog: actions/download-artifact@v7...v8.0.0

Commits

• 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
• f258da9 Add change docs
• ccc058e Fix linting issues
• bd7976b Add a setting to specify what to do on hash mismatch and default it to error
• ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
• 15999bf Add note about package bumps
• 974686e Bump the version to v8 and add release notes
• fbe48b1 Update test names to make it clearer what they do
• 96bf374 One more test fix
• b8c4819 Fix skip decompress test
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
.github/workflows/run-all-tests.yml	0% smaller

[what-the-diff]

PR Summary

• Upgrade of 'actions/download-artifact' version in GitHub workflow
  The system has been updated to use a newer version (v8 instead of v7) of 'actions/download-artifact', a component used in GitHub workflows. This change will make downloading packages for our project more effective by improving overall performance and reliability.

[github-actions]

Preparing review...

[github-actions]

Preparing review...

[github-actions]

Failed to generate code suggestions for PR

[greptile-apps]

Greptile Summary

Updated actions/download-artifact from v7 to v8 in the test-publish and publish jobs.

Key Changes in v8:

• Improved security: digest mismatch now defaults to error instead of warning
• Smarter unzipping: checks Content-Type headers before attempting to unzip artifacts
• Internal upgrade to ESM

Impact Assessment:
The changes are safe for this workflow. Both usages download standard GitHub Actions artifacts (Python packages built by hynek/build-and-inspect-python-package@v2) which will work correctly with v8's new behavior. The stricter digest checking is a security improvement that should not cause issues for artifacts created within the same workflow run.

Confidence Score: 5/5

• Safe to merge - straightforward dependency update with enhanced security
• This is a standard dependency update from Dependabot that updates actions/download-artifact from v7 to v8. The v8 changes (stricter digest validation, smarter unzipping) are security improvements that align well with this workflow's usage of downloading artifacts created within the same GitHub Actions run. No configuration changes are needed.
• No files require special attention

Important Files Changed

Filename	Overview
.github/workflows/run-all-tests.yml	Updated actions/download-artifact from v7 to v8 in two publish jobs - straightforward version bump with improved security

_{Last reviewed commit: 346c4bb}

[greptile-apps]

_{1 file reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[llamapreview]

Auto Pull Request Review from LlamaPReview

Review Status: Automated Review Skipped

Dear contributor,

Thank you for your Pull Request. LlamaPReview has analyzed your changes and determined that this PR does not require an automated code review.

Analysis Result:

PR contains only a dependency version bump for actions/download-artifact from v7 to v8, with no substantive code changes or logic modifications

We're continuously improving our PR analysis capabilities. Have thoughts on when and how LlamaPReview should perform automated reviews? Share your insights in our GitHub Discussions.

Best regards,
LlamaPReview Team