Skip to content

chore(deps): bump actions/upload-artifact from 4 to 6 - #4

Merged
ANcpLua merged 1 commit into
mainfrom
dependabot/github_actions/actions/upload-artifact-6
Jan 24, 2026
Merged

chore(deps): bump actions/upload-artifact from 4 to 6#4
ANcpLua merged 1 commit into
mainfrom
dependabot/github_actions/actions/upload-artifact-6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jan 24, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/upload-artifact from 4 to 6.

Release notes

Sourced from actions/upload-artifact's releases.

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

New Contributors

Full Changelog: actions/upload-artifact@v4...v5.0.0

v4.6.2

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v4...v4.6.2

v4.6.1

What's Changed

... (truncated)

Commits
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • ddc45ed docs: update README to correct action name for Node.js 24 support
  • 615b319 chore: release v6.0.0 for Node.js 24 support
  • 017748b Merge pull request #744 from actions/fix-storage-blob
  • 38d4c79 chore: rebuild dist
  • 7d27270 chore: add missing license cache files for @​actions/core, @​actions/io, and mi...
  • 5f643d3 chore: update license files for @​actions/artifact@​5.0.1 dependencies
  • 1df1684 chore: update package-lock.json with @​actions/artifact@​5.0.1
  • b5b1a91 fix: update @​actions/artifact to ^5.0.0 for Node.js 24 punycode fix
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jan 24, 2026
@ANcpLua

ANcpLua commented Jan 24, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions/upload-artifact-6 branch from 02cd295 to 7f3b4f9 Compare January 24, 2026 06:29
@github-actions

Copy link
Copy Markdown

This is a major version update. Please review before merging.

@ANcpLua
ANcpLua merged commit 62bbfc2 into main Jan 24, 2026
7 checks passed
@ANcpLua
ANcpLua deleted the dependabot/github_actions/actions/upload-artifact-6 branch January 24, 2026 06:59
ANcpLua added a commit that referenced this pull request Apr 21, 2026
…es single-source

CodeRabbit #4: include_prefixes was duplicated across registry-qyl/
manifest.yaml and templates/registry/qyl/weaver.yaml. The manifest.yaml
file isn't read by Weaver (Weaver uses the --registry flag directly
against the upstream clone); it was pure documentation that drifted.

Weaver's templates/registry/qyl/weaver.yaml is the single authoritative
location for params.include_prefixes. Deleted the duplicate manifest.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ANcpLua added a commit that referenced this pull request Apr 21, 2026
* chore(semconv): delete zero-caller C# outputs + scaffold Weaver migration

Dead code removal (per docs/contract-drift-architecture.md O-1/O-2):

- delete src/qyl.collector/Ingestion/OtlpAttributes.Utf8.g.cs (6923 LoC)
- delete src/qyl.instrumentation/Instrumentation/SemanticConventions.g.cs (~2600 LoC)
- delete src/qyl.instrumentation/Instrumentation/SemanticConventions.Utf8.g.cs (7555 LoC)
- strip the `csharp` + `csharpUtf8` targets + their ~125 LoC generator functions
  from eng/semconv/generate-semconv.ts so future regenerates don't recreate them
- inline the five semconv keys (error.type / exception.*) in
  ActivityExceptionTelemetry.cs since the only live consumer is three calls

Net: ~17,000 lines of unused generated code deleted, zero callers in src/,
0 errors / 13 warnings (unchanged). The facades under
src/qyl.contracts/Attributes/ remain the actually-consumed C# surface.

Weaver migration scaffold (not yet wired into the build):

- eng/semconv/templates/registry/qyl/{weaver.yaml,semconv.ts.j2}
- eng/semconv/registry-qyl/manifest.yaml
- .gitignore updates for .tools/ (local weaver binary + upstream clone)
  and eng/semconv/out/ (template scratch)

The semconv.ts.j2 template proves the pipeline end-to-end: upstream v1.40.0
YAML registry → weaver → TS exports filtered by qyl's include_prefixes.
The rest of the template set (C# facades, TypeSpec, DuckDB SQL) is the
follow-up. Old generate-semconv.ts stays as-is until the Weaver templates
cover all three remaining outputs byte-close.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(semconv): wire Weaver end-to-end with SQL + TS templates, scripted

Two working Weaver-side templates prove the pipeline against upstream
semconv v1.40.0, emitting into eng/semconv/out/ (gitignored):

- promoted_columns.g.sql.j2 — DuckDB column list, parent-prefix grouped,
  suffix-driven BIGINT/DOUBLE type inference, 31k lines matching current
  column count and type distribution
- semconv.ts.j2 — TypeScript `export const` flat list, parent-prefix
  comment groups matching the legacy shape (enum `as const` blocks still
  TODO; current output covers attribute keys)

Two bootstrap scripts so the pipeline is runnable from any clone:

- bootstrap-weaver.sh — downloads Weaver v0.22.1 native binary +
  clones open-telemetry/semantic-conventions@v1.40.0 into .tools/
- run-weaver.sh — invokes `weaver registry generate` with the correct
  --registry / --templates paths and writes to eng/semconv/out/

Not yet in scope (partial PR #141, cutover to follow):

- NUKE target swap — GenerateSemconv still calls `npm run generate`
  (the stripped-down generate-semconv.ts) for TSP / facades / SQL / TS.
  The Weaver templates run side-by-side for diff verification.
- TypeSpec template (6842-line output with scalars + enum unions + models)
- 3 facade templates (GenAi/Db/McpAttributes) — need qyl-extensions.json
  param loading + upstream-enum merging + cross-cutting attribute pull
- TS `as const` enum blocks — structural port of the existing TS
  generator's enum extraction pass

Run locally: ./eng/semconv/bootstrap-weaver.sh && ./eng/semconv/run-weaver.sh

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(semconv): cutover to Weaver — delete TS generator, hand-maintain facades

Weaver now owns the generated semconv outputs for which qyl consumers exist:

- src/qyl.dashboard/src/lib/semconv.ts  (TypeScript attribute keys)
- src/qyl.collector/Storage/promoted-columns.g.sql  (DuckDB promoted cols)

Facades moved to hand-maintained source. The prior Jinja-port of three
facades (GenAi/Db/Mcp) would have required porting qyl-extensions.json's
propertyOverrides + upstream enum-merge + cross-cutting-attribute lookup
into MiniJinja — 3–4h of template engineering for 3 files totaling <600
LoC that rarely change. Hand-edit is simpler:

- src/qyl.contracts/Attributes/DbAttributes.cs    (was .g.cs)
- src/qyl.contracts/Attributes/GenAiAttributes.cs (was .g.cs)
- src/qyl.contracts/Attributes/McpAttributes.cs   (was .g.cs)

TS enum `as const` blocks dropped: the sole consumer
(src/qyl.dashboard/src/components/genai/ToolDefinitionsViewer.tsx)
imports only flat attribute keys (GEN_AI_TOOL_*), not the enum objects.
All 7 imports resolve against the new Weaver output; dashboard
typecheck clean against the semconv change.

TypeSpec output (core/specs/generated/semconv.g.tsp, 6842 lines) stays
pinned at v1.40.0 — no Weaver template yet, no regenerator. When OTel
bumps semconv, write the TSP Jinja template or port by hand.

Deleted:
- eng/semconv/generate-semconv.ts             (921 LoC)
- eng/semconv/qyl-extensions.json             (250 LoC config)
- eng/semconv/package.json / package-lock.json / tsconfig.json
- eng/semconv/CHANGELOG.md                    (upstream dependency tracker)
- eng/semconv/node_modules                    (gitignored)

NUKE `GenerateSemconv` now shells out to bootstrap-weaver.sh +
run-weaver.sh. SemconvInstall npm target removed entirely.

Net this commit: +754 / -4112 = -3,358 LoC. Plus the -22,005 LoC from
the previous commit on this branch gives the PR -25,363 LoC total for
the contract-drift cleanup + Weaver cutover.

Full solution build: 0 errors, 74 warnings (unchanged from main).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(semconv): cross-platform weaver bootstrap/run for Linux CI

Schema Drift failed on d1c49a4 because run-weaver.sh hardcoded the
macOS-arm64 weaver binary path. bootstrap already selected the right
release asset per arch; the runner now uses the matching path.

Darwin:arm64 / Darwin:x86_64 / Linux:x86_64 supported. Windows explicit
unsupported — qyl CI is Linux-only.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(semconv): bootstrap-weaver.sh cross-platform too

Follow-up to 4a4f7c5 — also fix bootstrap.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(semconv): TypeSpec template — Weaver owns all three semconv outputs

Ports the 6842-line semconv.g.tsp shape to a 165-line MiniJinja template:

- Common scalars (TraceId/SpanId/TokenCount/...) as a fixed prelude
- Keys namespace — alias-per-attribute grouped by root namespace
- Union types — one per enum-typed attribute (`*Value`) with members +
  string fallback for unknown values
- Per-domain attribute models with @Encodedname + type-correct fields

TypeSpec reserved identifiers (namespace, enum, union, unknown, ...)
are backtick-escaped via a `safe()` macro. 0 compile errors on core/specs
npm run compile against the full qyl TypeSpec schema (18 unrelated
upstream warnings, pre-existing).

run-weaver.sh now installs into three final destinations:
- src/qyl.dashboard/src/lib/semconv.ts  (1368 lines)
- src/qyl.collector/Storage/promoted-columns.g.sql  (1369 lines)
- core/specs/generated/semconv.g.tsp  (6953 lines)

`nuke GenerateSemconv` → bootstrap-weaver.sh + run-weaver.sh. The Weaver
migration is complete: the TS `generate-semconv.ts` stack (921 LoC +
qyl-extensions.json + npm + tsconfig + CHANGELOG + node_modules) is gone
and all three pipeline outputs flow through the Jinja templates.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(build): inline ContractGenerator attribute lists, drop qyl-extensions.json dep

Schema Drift CI failed on e0b44f3 because GenerateContracts still read
eng/semconv/qyl-extensions.json, which was deleted in the Weaver cutover
(d1c49a4). The JSON's only role for this generator was to supply the
per-facade attribute name lists; everything else (Source, Signals,
required-attrs, metrics) was already hard-coded in C#.

Inlined the 40 gen_ai and 12 db attribute names as `string[]` constants
at the top of ContractGenerator.cs. Dropped the LoadDomains + FindFacade
+ ExtractAttributes JsonDocument path (~80 LoC).

GenerateContracts target in BuildPipeline.cs no longer passes an
extensionsJsonPath. One less arg on the Generate() signature.

Bumping semconv = edit the two attribute arrays. No JSON parsing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(semconv): promoted-columns suffix checks use column name, not dotted attr

The suffix checks (_tokens / _count / _size / _duration / ...) ran against
the dotted attribute name. That only matches when the last semconv segment
has an underscore immediately before the suffix. Names like
`azure.cosmosdb.request.body.size` end with a bare `size` — the `_size`
check never fired, column fell through to VARCHAR.

Fix: compute the column name (`.` → `_`) first, run suffix checks against
the underscored form. Every attribute now has the bare suffix preceded by
an underscore, so the check works uniformly across all semconv prefixes.

Verified:
  azure_cosmosdb_request_body_size BIGINT  (was VARCHAR)
  gen_ai_usage_input_tokens         BIGINT

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(semconv): delete registry-qyl/manifest.yaml — include_prefixes single-source

CodeRabbit #4: include_prefixes was duplicated across registry-qyl/
manifest.yaml and templates/registry/qyl/weaver.yaml. The manifest.yaml
file isn't read by Weaver (Weaver uses the --registry flag directly
against the upstream clone); it was pure documentation that drifted.

Weaver's templates/registry/qyl/weaver.yaml is the single authoritative
location for params.include_prefixes. Deleted the duplicate manifest.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(semconv): template headers read version from params, not literal

CodeRabbit #6: the three template headers hardcoded v1.40.0 directly.
Replaced with `{{ params.semconv_version }}` so bumping semconv
requires one edit (weaver.yaml) instead of four (three templates +
weaver.yaml).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(semconv): bootstrap reads SEMCONV_TAG from weaver.yaml + quote weaver path

CodeRabbit #9 + #12 together:

- #12: SEMCONV_TAG was duplicated between bootstrap-weaver.sh (as
  "v1.40.0") and templates/registry/qyl/weaver.yaml
  (as `semconv_version: "1.40.0"`). Bumping semconv required editing
  both. Bootstrap now sed-extracts the version from weaver.yaml as
  the single source.
- #9: unquoted $(${WEAVER_DIR}/weaver-${WEAVER_ARCH}/weaver --version)
  (SC2086) — quoted the command path.

Both touch bootstrap-weaver.sh; one commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(instrumentation): explain why ActivityExceptionTelemetry inlines semconv keys

CodeRabbit #7 suggested the five `private const string` keys should use
GenAiAttributes.*. The suggestion doesn't fit: error.type and the four
exception.* keys belong to the `error.*` / `exception.*` semconv prefixes,
not to the three namespaces qyl facades (gen_ai / db / mcp). Inlining is
correct; upgraded the comment so the next reviewer doesn't re-litigate.

Promote to ErrorAttributes / ExceptionAttributes facade in
src/qyl.contracts/Attributes/ the moment a second caller appears.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(semconv): drop the semconv.g.tsp bridge — imported but never referenced

The generated TypeSpec file pulled upstream semconv attribute keys into
qyl's TypeSpec namespace as typed `Keys.<Domain>.<field>` aliases +
per-attribute union/model declarations. main.tsp imported it, but grep
across all hand-written .tsp files found exactly one hit for
`Keys.` / `OTel.SemConv.` — in a comment. Zero typed references.

6953 lines of generated TypeSpec + 165 lines of Jinja template + a
pipeline stage, all for a feature nobody uses. The remaining Weaver
templates (semconv.ts, promoted-columns.g.sql) stay — those have live
consumers.

Deletes:
- core/specs/generated/semconv.g.tsp  (6953 LoC)
- eng/semconv/templates/registry/qyl/semconv.g.tsp.j2  (165 LoC)
- import line + comment block in core/specs/main.tsp
- TSP stanza in run-weaver.sh + the TSP_DEST install line
- TSP template entry in weaver.yaml

TypeSpec compile still clean (0 errors, 18 unrelated upstream warnings).
qyl.slnx build still clean (0 errors).

If a consumer ever wants typed semconv identifiers in TypeSpec, the
template is trivially resurrectable from git history.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ANcpLua added a commit that referenced this pull request Jul 1, 2026
…n ingest (CODE RED #4) (#464)

OTLP ingest mapped only span identity/timing/status-code/attributes — span Events (including
OTel exception events: exception.type/message/stacktrace), Links, and Status.Message were
silently dropped, so the span-detail API always returned empty Events/Links and no status message.

Full ingest -> storage -> API pipeline (the Qyl.Api.Contracts Span DTO already models these — no
contract change):
- OtlpConverter.CreateSpanRecordFromProto captures span.Events, span.Links, span.Status.Message.
- SpanIngestionRecord + SpanEventIngest/SpanLinkIngest carry them.
- IngestionStorageMapper serializes events/links to JSON via SpanChildStorage (source-gen JSON,
  AOT-safe StorageJsonSerializerContext) and stores status_message.
- spans row gains status_message + events_json + links_json columns (and the upsert).
- Mappers rehydrates SpanEvent[]/SpanLink[] and SpanStatus.Message from storage instead of [].

Also reverts Renovate #462's Microsoft.OpenApi v3 bump back to 2.9.0: v3 makes IOpenApiMediaType.Example
read-only, which the SDK's Microsoft.AspNetCore.OpenApi source generator still assigns (CS0200), breaking
the whole repo build. 2.9.0 also clears NU1903.

Verified: collector Release builds 0/0.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Copilot AI mentioned this pull request Jul 3, 2026
ANcpLua added a commit that referenced this pull request Jul 3, 2026
…deliberately restored

VerifyNoRemovedBuildSurface still listed status_message and span.Status?.Message
as removed collector surfaces, but #464 reintroduced them on purpose — the gate
was defending a dead decision and failing every honest PR touching those files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ANcpLua added a commit that referenced this pull request Jul 3, 2026
* chore: comment truth sweep — delete fix-markers, dead-pattern defenses, and doc lies

- Drop CODE RED #4 fix-markers (Mappers, OtlpConverter, SpanChildStorage, DuckDbReaderExtensions)
- Drop historical parentheticals (QylResourceRegistry old channel, ServiceDefaultsSourceGenerator CS9153 wrapper history)
- Drop frontend fix-marker + roadmap narration (LogsPage, download-button, Qyl.Run.Host Program)
- docs/observability.md: remove false QYL0138/auto-instrumentation composition claim (code only wires ServiceDefaults)
- docs/typespec-maf-prd.md: remove 'What stays in qyl' section claiming qyl.conformance lives here (it does not exist in this repo)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* build: stop banning status_message span surfaces the CODE RED #4 fix deliberately restored

VerifyNoRemovedBuildSurface still listed status_message and span.Status?.Message
as removed collector surfaces, but #464 reintroduced them on purpose — the gate
was defending a dead decision and failing every honest PR touching those files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
ANcpLua pushed a commit that referenced this pull request Jul 6, 2026
…Middleware (CodeQL #4)

CORS middleware already terminates OPTIONS on OTLP paths when enabled, and
all OTLP endpoints are POST-only, so the bypass was unreachable-in-effect in
both modes while tripping cs/user-controlled-bypass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ANcpLua pushed a commit that referenced this pull request Jul 8, 2026
… cost

ModelPricingRow already carried CacheReadCost/CacheWriteCost/ReasoningCost
columns but ComputeCost only priced input+output, and no span-level cache/
reasoning token fields existed -- so all three columns were dead. Transpiled
from yurekami/aegis CostEntry.compute_cost (harvest #7).

End-to-end wiring (sanctioned regenerate path, no hand-edited .g.cs):
- collector-semantic-policy.json: projectionConstants + spanHotAttributeKeys
  for gen_ai.usage.cache_read/cache_creation.input_tokens + reasoning.output_tokens
- regenerated CollectorSemanticAttributeCatalog.g.cs (3 new consts)
- StorageAttributeProjection + SpanHotAttributeProjection: extract the 3 fields
- SpanStorageRow: 3 new columns + upsert DO UPDATE SET clause
- IngestionStorageMapper: map projection -> row
- ComputeCost: additive per-class pricing, cache/reasoning rates fall back to
  input/output rate when a model omits them

Token classes are disjoint (Anthropic/OpenAI report them separately) so costs
add. Collector build 0W/0E; VerifyCollectorSemanticAttributeCatalog green.

Also recorded scoping verdicts in yurekami-harvest.md: harvest #1/#3/#4 are
REF-ONLY (already handled in qyl) -- no dead code written.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant