From 61375ba8b0a6e2f1d86b1e9c08077b72871563bf Mon Sep 17 00:00:00 2001 From: Simon Axelsson Date: Tue, 11 Aug 2026 13:46:36 +0200 Subject: [PATCH] fix(ci): use actions/upload-artifact@v3, not v4, on this Gitea runner Verified empirically by pushing and inspecting the real run (git.siax.io/sax3l/0pt/actions/runs/4788): v4 (pinned SHA) failed with conclusion=failure on both upload steps. continue-on-error already kept this from breaking the build, but the artifacts silently weren't being saved. v3.2.2 is the known-compatible version for self-hosted Gitea's artifact backend; re-verify after push. --- .gitea/workflows/security.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml index af90e0c..2c453c2 100644 --- a/.gitea/workflows/security.yml +++ b/.gitea/workflows/security.yml @@ -48,7 +48,7 @@ jobs: - name: Upload SBOM if: always() continue-on-error: true # informational artifact; must never block the blocking scan above - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf # v3.2.2 (Gitea Actions runner rejects v4 artifacts -- verified empirically 2026-08-11) with: name: sbom-cyclonedx path: sbom.cdx.json @@ -86,7 +86,7 @@ jobs: run: | pnpm licenses list --json > licenses.json || true pnpm licenses list - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf # v3.2.2 (Gitea Actions runner rejects v4 artifacts -- verified empirically 2026-08-11) continue-on-error: true # informational artifact; must never block CI with: name: license-inventory