Update Artifact GitHub Actions dependencies (#12192)

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | minor | `v4` -> `v4.1.9` | | [actions/upload-artifact](https://redirect.github.com/actions/upload-artifact) | action | minor | `v4` -> `v4.6.1` | --- ### Release Notes <details> <summary>actions/download-artifact (actions/download-artifact)</summary> ### [`v4.1.9`](https://redirect.github.com/actions/download-artifact/releases/tag/v4.1.9) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v4.1.8...v4.1.9) #### What's Changed - Add workflow file for publishing releases to immutable action package by [@Jcambass](https://redirect.github.com/Jcambass) in [https://github.com/actions/download-artifact/pull/354](https://redirect.github.com/actions/download-artifact/pull/354) - docs: small migration fix by [@froblesmartin](https://redirect.github.com/froblesmartin) in [https://github.com/actions/download-artifact/pull/370](https://redirect.github.com/actions/download-artifact/pull/370) - Update MIGRATION.md by [@andyfeller](https://redirect.github.com/andyfeller) in [https://github.com/actions/download-artifact/pull/372](https://redirect.github.com/actions/download-artifact/pull/372) - Update artifact package to 2.2.2 by [@yacaovsnc](https://redirect.github.com/yacaovsnc) in [https://github.com/actions/download-artifact/pull/380](https://redirect.github.com/actions/download-artifact/pull/380) #### New Contributors - [@Jcambass](https://redirect.github.com/Jcambass) made their first contribution in [https://github.com/actions/download-artifact/pull/354](https://redirect.github.com/actions/download-artifact/pull/354) - [@froblesmartin](https://redirect.github.com/froblesmartin) made their first contribution in [https://github.com/actions/download-artifact/pull/370](https://redirect.github.com/actions/download-artifact/pull/370) - [@andyfeller](https://redirect.github.com/andyfeller) made their first contribution in [https://github.com/actions/download-artifact/pull/372](https://redirect.github.com/actions/download-artifact/pull/372) - [@yacaovsnc](https://redirect.github.com/yacaovsnc) made their first contribution in [https://github.com/actions/download-artifact/pull/380](https://redirect.github.com/actions/download-artifact/pull/380) **Full Changelog**: https://github.com/actions/download-artifact/compare/v4...v4.1.9 ### [`v4.1.8`](https://redirect.github.com/actions/download-artifact/releases/tag/v4.1.8) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v4.1.7...v4.1.8) #### What's Changed - Update [@actions/artifact](https://redirect.github.com/actions/artifact) version, bump dependencies by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/download-artifact/pull/341](https://redirect.github.com/actions/download-artifact/pull/341) **Full Changelog**: https://github.com/actions/download-artifact/compare/v4...v4.1.8 ### [`v4.1.7`](https://redirect.github.com/actions/download-artifact/releases/tag/v4.1.7) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v4.1.6...v4.1.7) #### What's Changed - Update [@actions/artifact](https://redirect.github.com/actions/artifact) dependency by [@bethanyj28](https://redirect.github.com/bethanyj28) in [https://github.com/actions/download-artifact/pull/325](https://redirect.github.com/actions/download-artifact/pull/325) **Full Changelog**: https://github.com/actions/download-artifact/compare/v4.1.6...v4.1.7 ### [`v4.1.6`](https://redirect.github.com/actions/download-artifact/releases/tag/v4.1.6) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v4.1.5...v4.1.6) #### What's Changed - updating `@actions/artifact` dependency to v2.1.6 by [@eggyhead](https://redirect.github.com/eggyhead) in [https://github.com/actions/download-artifact/pull/324](https://redirect.github.com/actions/download-artifact/pull/324) **Full Changelog**: https://github.com/actions/download-artifact/compare/v4.1.5...v4.1.6 ### [`v4.1.5`](https://redirect.github.com/actions/download-artifact/releases/tag/v4.1.5) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v4.1.4...v4.1.5) ##### What's Changed - Update readme with v3/v2/v1 deprecation notice by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/download-artifact/pull/322](https://redirect.github.com/actions/download-artifact/pull/322) - Update dependencies `@actions/core` to v1.10.1 and `@actions/artifact` to v2.1.5 **Full Changelog**: https://github.com/actions/download-artifact/compare/v4.1.4...v4.1.5 ### [`v4.1.4`](https://redirect.github.com/actions/download-artifact/releases/tag/v4.1.4) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v4.1.3...v4.1.4) #### What's Changed - Update [@actions/artifact](https://redirect.github.com/actions/artifact) by [@bethanyj28](https://redirect.github.com/bethanyj28) in [https://github.com/actions/download-artifact/pull/307](https://redirect.github.com/actions/download-artifact/pull/307) **Full Changelog**: https://github.com/actions/download-artifact/compare/v4...v4.1.4 ### [`v4.1.3`](https://redirect.github.com/actions/download-artifact/releases/tag/v4.1.3) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v4.1.2...v4.1.3) #### What's Changed - Update release-new-action-version.yml by [@konradpabjan](https://redirect.github.com/konradpabjan) in [https://github.com/actions/download-artifact/pull/292](https://redirect.github.com/actions/download-artifact/pull/292) - Update toolkit dependency with updated unzip logic by [@bethanyj28](https://redirect.github.com/bethanyj28) in [https://github.com/actions/download-artifact/pull/299](https://redirect.github.com/actions/download-artifact/pull/299) - Update [@actions/artifact](https://redirect.github.com/actions/artifact) by [@bethanyj28](https://redirect.github.com/bethanyj28) in [https://github.com/actions/download-artifact/pull/303](https://redirect.github.com/actions/download-artifact/pull/303) #### New Contributors - [@bethanyj28](https://redirect.github.com/bethanyj28) made their first contribution in [https://github.com/actions/download-artifact/pull/299](https://redirect.github.com/actions/download-artifact/pull/299) **Full Changelog**: https://github.com/actions/download-artifact/compare/v4...v4.1.3 ### [`v4.1.2`](https://redirect.github.com/actions/download-artifact/releases/tag/v4.1.2) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v4.1.1...v4.1.2) - Bump [@actions/artifacts](https://redirect.github.com/actions/artifacts) to latest version to include [updated GHES host check](https://redirect.github.com/actions/toolkit/pull/1648) ### [`v4.1.1`](https://redirect.github.com/actions/download-artifact/releases/tag/v4.1.1) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v4.1.0...v4.1.1) - Fix transient request timeouts [https://github.com/actions/download-artifact/issues/249](https://redirect.github.com/actions/download-artifact/issues/249) - Bump `@actions/artifacts` to latest version ### [`v4.1.0`](https://redirect.github.com/actions/download-artifact/releases/tag/v4.1.0) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v4...v4.1.0) #### What's Changed - Some cleanup by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/download-artifact/pull/247](https://redirect.github.com/actions/download-artifact/pull/247) - Fix default for run-id by [@stchr](https://redirect.github.com/stchr) in [https://github.com/actions/download-artifact/pull/252](https://redirect.github.com/actions/download-artifact/pull/252) - Support pattern matching to filter artifacts & merge to same directory by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/download-artifact/pull/259](https://redirect.github.com/actions/download-artifact/pull/259) #### New Contributors - [@stchr](https://redirect.github.com/stchr) made their first contribution in [https://github.com/actions/download-artifact/pull/252](https://redirect.github.com/actions/download-artifact/pull/252) **Full Changelog**: https://github.com/actions/download-artifact/compare/v4...v4.1.0 </details> <details> <summary>actions/upload-artifact (actions/upload-artifact)</summary> ### [`v4.6.1`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.6.1) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.6.0...v4.6.1) #### What's Changed - Update to use artifact 2.2.2 package by [@yacaovsnc](https://redirect.github.com/yacaovsnc) in [https://github.com/actions/upload-artifact/pull/673](https://redirect.github.com/actions/upload-artifact/pull/673) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4...v4.6.1 ### [`v4.6.0`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.6.0) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.5.0...v4.6.0) ##### What's Changed - Expose env vars to control concurrency and timeout by [@yacaovsnc](https://redirect.github.com/yacaovsnc) in [https://github.com/actions/upload-artifact/pull/662](https://redirect.github.com/actions/upload-artifact/pull/662) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4...v4.6.0 ### [`v4.5.0`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.5.0) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.4.3...v4.5.0) ##### What's Changed - fix: deprecated `Node.js` version in action by [@hamirmahal](https://redirect.github.com/hamirmahal) in [https://github.com/actions/upload-artifact/pull/578](https://redirect.github.com/actions/upload-artifact/pull/578) - Add new `artifact-digest` output by [@bdehamer](https://redirect.github.com/bdehamer) in [https://github.com/actions/upload-artifact/pull/656](https://redirect.github.com/actions/upload-artifact/pull/656) ##### New Contributors - [@hamirmahal](https://redirect.github.com/hamirmahal) made their first contribution in [https://github.com/actions/upload-artifact/pull/578](https://redirect.github.com/actions/upload-artifact/pull/578) - [@bdehamer](https://redirect.github.com/bdehamer) made their first contribution in [https://github.com/actions/upload-artifact/pull/656](https://redirect.github.com/actions/upload-artifact/pull/656) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4.4.3...v4.5.0 ### [`v4.4.3`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.4.3) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.4.2...v4.4.3) #### What's Changed - Undo indirect dependency updates from [#627](https://redirect.github.com/actions/upload-artifact/issues/627) by [@joshmgross](https://redirect.github.com/joshmgross) in [https://github.com/actions/upload-artifact/pull/632](https://redirect.github.com/actions/upload-artifact/pull/632) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4.4.2...v4.4.3 ### [`v4.4.2`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.4.2) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.4.1...v4.4.2) #### What's Changed - Bump `@actions/artifact` to 2.1.11 by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/upload-artifact/pull/627](https://redirect.github.com/actions/upload-artifact/pull/627) - Includes fix for relative symlinks not resolving properly **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4.4.1...v4.4.2 ### [`v4.4.1`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.4.1) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.4.0...v4.4.1) #### What's Changed - Add a section about hidden files by [@joshmgross](https://redirect.github.com/joshmgross) in [https://github.com/actions/upload-artifact/pull/607](https://redirect.github.com/actions/upload-artifact/pull/607) - Add workflow file for publishing releases to immutable action package by [@Jcambass](https://redirect.github.com/Jcambass) in [https://github.com/actions/upload-artifact/pull/621](https://redirect.github.com/actions/upload-artifact/pull/621) - Update [@actions/artifact](https://redirect.github.com/actions/artifact) to latest version, includes symlink and timeout fixes by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/upload-artifact/pull/625](https://redirect.github.com/actions/upload-artifact/pull/625) #### New Contributors - [@Jcambass](https://redirect.github.com/Jcambass) made their first contribution in [https://github.com/actions/upload-artifact/pull/621](https://redirect.github.com/actions/upload-artifact/pull/621) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4.4.0...v4.4.1 ### [`v4.4.0`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.4.0) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.3.6...v4.4.0) #### Notice: Breaking Changes ⚠️ We will no longer include hidden files and folders by default in the `upload-artifact` action of this version. This reduces the risk that credentials are accidentally uploaded into artifacts. Customers who need to continue to upload these files can use a new option, `include-hidden-files`, to continue to do so. See ["Notice of upcoming deprecations and breaking changes in GitHub Actions runners"](https://github.blog/changelog/2024-08-19-notice-of-upcoming-deprecations-and-breaking-changes-in-github-actions-runners/) changelog and [this issue](https://redirect.github.com/actions/upload-artifact/issues/602) for more details. #### What's Changed - Exclude hidden files by default by [@joshmgross](https://redirect.github.com/joshmgross) in [https://github.com/actions/upload-artifact/pull/598](https://redirect.github.com/actions/upload-artifact/pull/598) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4.3.6...v4.4.0 ### [`v4.3.6`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.3.6) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.3.5...v4.3.6) #### What's Changed - Revert to [@actions/artifact](https://redirect.github.com/actions/artifact) 2.1.8 by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/upload-artifact/pull/594](https://redirect.github.com/actions/upload-artifact/pull/594) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4...v4.3.6 ### [`v4.3.5`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.3.5) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.3.4...v4.3.5) #### What's Changed - Bump [@actions/artifact](https://redirect.github.com/actions/artifact) to v2.1.9 by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/upload-artifact/pull/588](https://redirect.github.com/actions/upload-artifact/pull/588) - Fixed artifact upload chunk timeout logic [#1774](https://redirect.github.com/actions/toolkit/pull/1774) - Use lazy stream to prevent issues with open file limits [#1771](https://redirect.github.com/actions/toolkit/pull/1771) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4.3.4...v4.3.5 ### [`v4.3.4`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.3.4) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.3.3...v4.3.4) #### What's Changed - Update [@actions/artifact](https://redirect.github.com/actions/artifact) version, bump dependencies by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/upload-artifact/pull/584](https://redirect.github.com/actions/upload-artifact/pull/584) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4.3.3...v4.3.4 ### [`v4.3.3`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.3.3) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.3.2...v4.3.3) #### What's Changed - updating `@actions/artifact` dependency to v2.1.6 by [@eggyhead](https://redirect.github.com/eggyhead) in [https://github.com/actions/upload-artifact/pull/565](https://redirect.github.com/actions/upload-artifact/pull/565) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4.3.2...v4.3.3 ### [`v4.3.2`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.3.2) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.3.1...v4.3.2) #### What's Changed - Update release-new-action-version.yml by [@konradpabjan](https://redirect.github.com/konradpabjan) in [https://github.com/actions/upload-artifact/pull/516](https://redirect.github.com/actions/upload-artifact/pull/516) - Minor fix to the migration readme by [@andrewakim](https://redirect.github.com/andrewakim) in [https://github.com/actions/upload-artifact/pull/523](https://redirect.github.com/actions/upload-artifact/pull/523) - Update readme with v3/v2/v1 deprecation notice by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/upload-artifact/pull/561](https://redirect.github.com/actions/upload-artifact/pull/561) - updating `@actions/artifact` dependency to v2.1.5 and `@actions/core` to v1.0.1 by [@eggyhead](https://redirect.github.com/eggyhead) in [https://github.com/actions/upload-artifact/pull/562](https://redirect.github.com/actions/upload-artifact/pull/562) #### New Contributors - [@andrewakim](https://redirect.github.com/andrewakim) made their first contribution in [https://github.com/actions/upload-artifact/pull/523](https://redirect.github.com/actions/upload-artifact/pull/523) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4.3.1...v4.3.2 ### [`v4.3.1`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.3.1) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.3.0...v4.3.1) - Bump [@actions/artifacts](https://redirect.github.com/actions/artifacts) to latest version to include [updated GHES host check](https://redirect.github.com/actions/toolkit/pull/1648) ### [`v4.3.0`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.3.0) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.2.0...v4.3.0) #### What's Changed - Reorganize upload code in prep for merge logic & add more tests by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/upload-artifact/pull/504](https://redirect.github.com/actions/upload-artifact/pull/504) - Add sub-action to merge artifacts by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/upload-artifact/pull/505](https://redirect.github.com/actions/upload-artifact/pull/505) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4...v4.3.0 ### [`v4.2.0`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.2.0) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.1.0...v4.2.0) #### What's Changed - Ability to overwrite an Artifact by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/upload-artifact/pull/501](https://redirect.github.com/actions/upload-artifact/pull/501) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4...v4.2.0 ### [`v4.1.0`](https://redirect.github.com/actions/upload-artifact/releases/tag/v4.1.0) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v4.0.0...v4.1.0) #### What's Changed - Add migrations docs by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/upload-artifact/pull/482](https://redirect.github.com/actions/upload-artifact/pull/482) - Update README.md by [@samuelwine](https://redirect.github.com/samuelwine) in [https://github.com/actions/upload-artifact/pull/492](https://redirect.github.com/actions/upload-artifact/pull/492) - Support artifact-url output by [@konradpabjan](https://redirect.github.com/konradpabjan) in [https://github.com/actions/upload-artifact/pull/496](https://redirect.github.com/actions/upload-artifact/pull/496) - Update readme to reflect new 500 artifact per job limit by [@robherley](https://redirect.github.com/robherley) in [https://github.com/actions/upload-artifact/pull/497](https://redirect.github.com/actions/upload-artifact/pull/497) #### New Contributors - [@samuelwine](https://redirect.github.com/samuelwine) made their first contribution in [https://github.com/actions/upload-artifact/pull/492](https://redirect.github.com/actions/upload-artifact/pull/492) **Full Changelog**: https://github.com/actions/upload-artifact/compare/v4...v4.1.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-03-15 15:11:23 -05:00
parent 4d989b3630
commit 8cf439bc36
5 changed files with 90 additions and 90 deletions
@@ -67,7 +67,7 @@ jobs:
          python -m ${{ env.MODULE_NAME }} --help
          uvx --help
      - name: "Upload sdist"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv-sdist
          path: dist
@@ -84,7 +84,7 @@ jobs:
          ${{ env.MODULE_NAME }}-build --help
          python -m ${{ env.MODULE_NAME }}_build --help
      - name: "Upload sdist uv-build"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv_build-sdist
          path: crates/uv-build/dist
@@ -108,7 +108,7 @@ jobs:
          target: x86_64
          args: --release --locked --out dist --features self-update
      - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv-macos-x86_64
          path: dist
@@ -124,7 +124,7 @@ jobs:
          tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
          shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: artifacts-macos-x86_64
          path: |
@@ -138,7 +138,7 @@ jobs:
          target: x86_64
          args: --profile minimal-size --locked --out crates/uv-build/dist -m crates/uv-build/Cargo.toml
      - name: "Upload wheels uv-build"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv_build-macos-x86_64
          path: crates/uv-build/dist
@@ -168,7 +168,7 @@ jobs:
          python -m ${{ env.MODULE_NAME }} --help
          uvx --help
      - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv-aarch64-apple-darwin
          path: dist
@@ -184,7 +184,7 @@ jobs:
          tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
          shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: artifacts-aarch64-apple-darwin
          path: |
@@ -203,7 +203,7 @@ jobs:
          ${{ env.MODULE_NAME }}-build --help
          python -m ${{ env.MODULE_NAME }}_build --help
      - name: "Upload wheels uv-build"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv_build-aarch64-apple-darwin
          path: crates/uv-build/dist
@@ -244,7 +244,7 @@ jobs:
          python -m ${{ env.MODULE_NAME }} --help
          uvx --help
      - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv-${{ matrix.platform.target }}
          path: dist
@@ -256,7 +256,7 @@ jobs:
          7z a $ARCHIVE_FILE ./target/${{ matrix.platform.target }}/release/uvx.exe
          sha256sum $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: artifacts-${{ matrix.platform.target }}
          path: |
@@ -277,7 +277,7 @@ jobs:
          ${{ env.MODULE_NAME }}-build --help
          python -m ${{ env.MODULE_NAME }}_build --help
      - name: "Upload wheels uv-build"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv_build-${{ matrix.platform.target }}
          path: crates/uv-build/dist
@@ -330,7 +330,7 @@ jobs:
          python -m ${{ env.MODULE_NAME }} --help
          uvx --help
      - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv-${{ matrix.target }}
          path: dist
@@ -347,7 +347,7 @@ jobs:
          tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
          shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: artifacts-${{ matrix.target }}
          path: |
@@ -368,7 +368,7 @@ jobs:
          ${{ env.MODULE_NAME }}-build --help
          python -m ${{ env.MODULE_NAME }}_build --help
      - name: "Upload wheels uv-build"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv_build-${{ matrix.target }}
          path: crates/uv-build/dist
@@ -424,7 +424,7 @@ jobs:
            # python -m ${{ env.MODULE_NAME }} --help
            uvx --help
      - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv-${{ matrix.platform.target }}
          path: dist
@@ -441,7 +441,7 @@ jobs:
          tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
          shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: artifacts-${{ matrix.platform.target }}
          path: |
@@ -473,7 +473,7 @@ jobs:
            # TODO(konsti): Enable this test on all platforms, currently `find_uv_bin` is failing to discover uv here.
            # python -m ${{ env.MODULE_NAME }}_build --help
      - name: "Upload wheels uv-build"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv_build-${{ matrix.platform.target }}
          path: crates/uv-build/dist
@@ -523,7 +523,7 @@ jobs:
            # python -m ${{ env.MODULE_NAME }} --help
            uvx --help
      - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv-${{ matrix.platform.target }}
          path: dist
@@ -540,7 +540,7 @@ jobs:
          tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
          shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: artifacts-${{ matrix.platform.target }}
          path: |
@@ -572,7 +572,7 @@ jobs:
            # TODO(konsti): Enable this test on all platforms, currently `find_uv_bin` is failing to discover uv here.
            # python -m ${{ env.MODULE_NAME }}-build --help
      - name: "Upload wheels uv-build"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv_build-${{ matrix.platform.target }}
          path: crates/uv-build/dist
@@ -635,7 +635,7 @@ jobs:
      #       # python -m ${{ env.MODULE_NAME }} --helppython -m ${{ env.MODULE_NAME }} --help
      #       uvx --help
      - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv-${{ matrix.platform.target }}
          path: dist
@@ -652,7 +652,7 @@ jobs:
          tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
          shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: artifacts-${{ matrix.platform.target }}
          path: |
@@ -676,7 +676,7 @@ jobs:
            fi
      # TODO(charlie): Re-enable testing for PPC wheels.
      - name: "Upload wheels uv-build"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv_build-${{ matrix.platform.target }}
          path: crates/uv-build/dist
@@ -721,7 +721,7 @@ jobs:
            # .venv/bin/python -m ${{ env.MODULE_NAME }} --help
            .venv/bin/uvx --help
      - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv-${{ matrix.target }}
          path: dist
@@ -738,7 +738,7 @@ jobs:
          tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
          shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: artifacts-${{ matrix.target }}
          path: |
@@ -766,7 +766,7 @@ jobs:
            .venv/bin/${{ env.MODULE_NAME }}-build --help
            .venv/bin/python -m ${{ env.MODULE_NAME }}_build --help
      - name: "Upload wheels uv-build"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv_build-${{ matrix.target }}
          path: crates/uv-build/dist
@@ -834,7 +834,7 @@ jobs:
            # python -m ${{ env.MODULE_NAME }} --help
            uvx --help
      - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv-${{ matrix.platform.target }}
          path: dist
@@ -852,7 +852,7 @@ jobs:
          tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
          shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: artifacts-${{ matrix.platform.target }}
          path: |
@@ -899,7 +899,7 @@ jobs:
            # TODO(konsti): Enable this test on all platforms, currently `find_uv_bin` is failing to discover uv here.
            # python -m ${{ env.MODULE_NAME }}_build --help
      - name: "Upload wheels"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: wheels_uv_build-${{ matrix.platform.target }}
          path: crates/uv-build/dist
@@ -112,7 +112,7 @@ jobs:
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digests
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: digests-${{ env.PLATFORM_TUPLE }}
          path: /tmp/digests/*
@@ -135,7 +135,7 @@ jobs:
          password: ${{ secrets.DOCKERHUB_TOKEN_RO }}

      - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          path: /tmp/digests
          pattern: digests-*
@@ -321,7 +321,7 @@ jobs:
          password: ${{ secrets.DOCKERHUB_TOKEN_RO }}

      - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          path: /tmp/digests
          pattern: digests-*
@@ -457,7 +457,7 @@ jobs:
        run: cargo build

      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: uv-linux-libc-${{ github.sha }}
          path: |
@@ -487,7 +487,7 @@ jobs:
        run: cargo build --target x86_64-unknown-linux-musl --bin uv --bin uvx

      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: uv-linux-musl-${{ github.sha }}
          path: |
@@ -511,7 +511,7 @@ jobs:
        run: cargo build --bin uv --bin uvx

      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: uv-macos-aarch64-${{ github.sha }}
          path: |
@@ -535,7 +535,7 @@ jobs:
        run: cargo build --bin uv --bin uvx

      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: uv-macos-x86_64-${{ github.sha }}
          path: |
@@ -569,7 +569,7 @@ jobs:
        run: cargo build --bin uv --bin uvx

      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: uv-windows-x86_64-${{ github.sha }}
          path: |
@@ -607,7 +607,7 @@ jobs:
        run: cargo build --target aarch64-pc-windows-msvc

      - name: "Upload binary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: uv-windows-aarch64-${{ github.sha }}
          path: |
@@ -716,7 +716,7 @@ jobs:
          python-version: ${{ matrix.python }}

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -741,7 +741,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -768,7 +768,7 @@ jobs:
      - uses: actions/checkout@v4

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-musl-${{ github.sha }}

@@ -795,7 +795,7 @@ jobs:
    runs-on: macos-latest
    steps:
      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-macos-x86_64-${{ github.sha }}

@@ -819,7 +819,7 @@ jobs:
    runs-on: windows-latest
    steps:
      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-windows-x86_64-${{ github.sha }}

@@ -839,7 +839,7 @@ jobs:
    runs-on: github-windows-11-aarch64-4
    steps:
      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-windows-aarch64-${{ github.sha }}

@@ -869,7 +869,7 @@ jobs:
          python-version: "3.12"

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -899,7 +899,7 @@ jobs:
          sudo apt-get install python3.9

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -941,7 +941,7 @@ jobs:
          sudo apt-get install python3.13-nogil

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -989,7 +989,7 @@ jobs:

    steps:
      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-windows-x86_64-${{ github.sha }}

@@ -1035,7 +1035,7 @@ jobs:
      - uses: actions/checkout@v4

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -1098,7 +1098,7 @@ jobs:

    steps:
      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-windows-x86_64-${{ github.sha }}

@@ -1163,7 +1163,7 @@ jobs:
          python-version: "graalpy24.1"

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -1231,7 +1231,7 @@ jobs:
          python-version: "graalpy24.1"

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-windows-x86_64-${{ github.sha }}

@@ -1290,7 +1290,7 @@ jobs:
          python-version: "3.12.7"

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -1398,7 +1398,7 @@ jobs:
          python-version: "${{ env.PYTHON_VERSION }}"

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -1438,7 +1438,7 @@ jobs:
          python-version: "${{ env.PYTHON_VERSION }}"

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -1486,7 +1486,7 @@ jobs:
          python-version: "3.12"

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -1508,7 +1508,7 @@ jobs:
      - uses: actions/checkout@v4

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-macos-aarch64-${{ github.sha }}

@@ -1534,7 +1534,7 @@ jobs:
        run: apt-get update && apt-get install -y python3.11 python3-pip python3.11-venv

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-musl-${{ github.sha }}

@@ -1560,7 +1560,7 @@ jobs:
        run: dnf install python3 which -y && python3 -m ensurepip

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -1586,7 +1586,7 @@ jobs:
          python-version: "3.12"

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -1619,7 +1619,7 @@ jobs:
          # The above will not sleep forever due to the job level timeout

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -1659,7 +1659,7 @@ jobs:
          dnf install python3.9 python3.9-pip which -y

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-musl-${{ github.sha }}

@@ -1685,7 +1685,7 @@ jobs:
          python-version: "pypy3.9"

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -1708,7 +1708,7 @@ jobs:
      - uses: actions/checkout@v4

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-musl-${{ github.sha }}

@@ -1734,7 +1734,7 @@ jobs:
        run: apk add --update --no-cache python3 py3-pip

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-musl-${{ github.sha }}

@@ -1756,7 +1756,7 @@ jobs:
      - uses: actions/checkout@v4

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-macos-aarch64-${{ github.sha }}

@@ -1783,7 +1783,7 @@ jobs:
        run: brew install python3

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-macos-aarch64-${{ github.sha }}

@@ -1809,7 +1809,7 @@ jobs:
      - uses: actions/setup-python@v5

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-macos-x86_64-${{ github.sha }}

@@ -1835,7 +1835,7 @@ jobs:
          python-version: "3.10"

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-windows-x86_64-${{ github.sha }}

@@ -1859,7 +1859,7 @@ jobs:
          architecture: "x86"

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-windows-x86_64-${{ github.sha }}

@@ -1883,7 +1883,7 @@ jobs:
          allow-prereleases: true

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-windows-x86_64-${{ github.sha }}

@@ -1908,7 +1908,7 @@ jobs:
          allow-prereleases: true

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-windows-aarch64-${{ github.sha }}

@@ -1925,7 +1925,7 @@ jobs:
      - uses: actions/checkout@v4

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-windows-x86_64-${{ github.sha }}

@@ -1945,7 +1945,7 @@ jobs:
        run: choco install python3 --verbose --version=3.9.13

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-windows-x86_64-${{ github.sha }}

@@ -1983,7 +1983,7 @@ jobs:
          echo "$HOME/.pyenv/shims" >> $GITHUB_PATH

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -2010,7 +2010,7 @@ jobs:
          allow-prereleases: true

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-libc-${{ github.sha }}

@@ -2075,7 +2075,7 @@ jobs:
        run: conda list

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-${{ matrix.target }}-${{ github.sha }}

@@ -2107,7 +2107,7 @@ jobs:
        run: yum install python3 python3-pip -y

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-linux-musl-${{ github.sha }}

@@ -2129,7 +2129,7 @@ jobs:
      - uses: actions/checkout@v4

      - name: "Download binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: uv-windows-x86_64-${{ github.sha }}

@@ -23,7 +23,7 @@ jobs:
    steps:
      - name: "Install uv"
        uses: astral-sh/setup-uv@v5
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          pattern: wheels_uv-*
          path: wheels_uv
@@ -42,7 +42,7 @@ jobs:
    steps:
      - name: "Install uv"
        uses: astral-sh/setup-uv@v5
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          pattern: wheels_uv_build-*
          path: wheels_uv_build
@@ -68,7 +68,7 @@ jobs:
        shell: bash
        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.28.0/cargo-dist-installer.sh | sh"
      - name: Cache dist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: cargo-dist-cache
          path: ~/.cargo/bin/dist
@@ -84,7 +84,7 @@ jobs:
          cat plan-dist-manifest.json
          echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
      - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: artifacts-plan-dist-manifest
          path: plan-dist-manifest.json
@@ -127,14 +127,14 @@ jobs:
        with:
          submodules: recursive
      - name: Install cached dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: cargo-dist-cache
          path: ~/.cargo/bin/
      - run: chmod +x ~/.cargo/bin/dist
      # Get all the local artifacts for the global tasks to use (for e.g. checksums)
      - name: Fetch local artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          pattern: artifacts-*
          path: target/distrib/
@@ -152,7 +152,7 @@ jobs:

          cp dist-manifest.json "$BUILD_MANIFEST_NAME"
      - name: "Upload artifacts"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: artifacts-build-global
          path: |
@@ -177,14 +177,14 @@ jobs:
        with:
          submodules: recursive
      - name: Install cached dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          name: cargo-dist-cache
          path: ~/.cargo/bin/
      - run: chmod +x ~/.cargo/bin/dist
      # Fetch artifacts from scratch-storage
      - name: Fetch artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          pattern: artifacts-*
          path: target/distrib/
@@ -198,7 +198,7 @@ jobs:
          cat dist-manifest.json
          echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
      - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          # Overwrite the previous copy
          name: artifacts-dist-manifest
@@ -237,7 +237,7 @@ jobs:
          submodules: recursive
      # Create a GitHub Release while uploading all files to it
      - name: "Download GitHub Artifacts"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          pattern: artifacts-*
          path: artifacts