Bump actions/upload-artifact from 4.6.2 to 7.0.2

.github/workflows/ci.yml

@@ -130,7 +130,7 @@ jobs:
           printf 'rbac_exit=%s\nchaos_exit=%s\ngraph_exit=%s\n' \
             "$rbac_status" "$chaos_status" "$graph_status" | tee security-assurance-summary.txt
           test "$rbac_status" -eq 0 -a "$chaos_status" -eq 0 -a "$graph_status" -eq 0
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         if: always()
         with:
           name: security-and-graph-assurance
@@ -205,7 +205,7 @@ jobs:
           format: cyclonedx
           output: supply-chain-sbom.cdx.json
           exit-code: "0"
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         if: always()
         with:
           name: supply-chain-sbom
@@ -233,7 +233,7 @@ jobs:
           --cov=mesa_mcp.v4_service --cov-fail-under=55
           --cov-report=term-missing --cov-report=xml:mcp-coverage.xml
           --cov-report=json:mcp-coverage.json
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         with:
           name: mcp-coverage-report
           path: |
@@ -314,7 +314,7 @@ jobs:
           printf 'black_exit=%s\nmypy_exit=%s\n' "$black_status" "$mypy_status" \
             | tee legacy-static-summary.txt
           test "$black_status" -eq 0 -a "$mypy_status" -eq 0
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         if: always()
         with:
           name: legacy-static-baseline
@@ -395,7 +395,7 @@ jobs:
           uv run python -m scripts.capture_v4_closure_evidence
           --junit v4-contract.xml
           --output v4-closure-evidence.json
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         if: always()
         with:
           name: v4-contract
@@ -438,7 +438,7 @@ jobs:
           uv run python -m scripts.capture_v4_closure_evidence
           --junit migration-dr.xml
           --output migration-dr-evidence.json
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         if: always()
         with:
           name: migration-dr
@@ -494,7 +494,7 @@ jobs:
           subject-path: |
             dist/a/*.whl
             dist/mesa-runtime.cdx.json
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         with:
           name: package-report
           path: dist/
@@ -532,7 +532,7 @@ jobs:
           --ignore=tests/go_live_proofs --ignore=tests/bench
       - name: SDK coverage collection contract
         run: uv run python -m pytest --collect-only -q tests/test_async_client_auth_contract.py tests/test_mcp_api_boundary.py
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         with:
           name: coverage-report-${{ matrix.python-version }}
           path: |

.github/workflows/external-release-gates.yml

@@ -66,7 +66,7 @@ jobs:
           tests/test_v4_session_finalization_contract.py
           tests/test_v4_session_principal_route_isolation.py
           tests/test_v4_principal_authorization.py | tee flow-e2e.log
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         if: always()
         with:
           name: flow-logs
@@ -99,7 +99,7 @@ jobs:
       - name: Write factual bounded-capacity summary
         run: >-
           python -c "import json,xml.etree.ElementTree as e; r=e.parse('performance-capacity.xml').getroot(); print(json.dumps({'suite':'bounded-capacity','tests':int(r.attrib.get('tests',0)),'failures':int(r.attrib.get('failures',0)),'errors':int(r.attrib.get('errors',0))},sort_keys=True))" > performance-capacity.json
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         if: always()
         with:
           name: performance-capacity
@@ -140,7 +140,7 @@ jobs:
           docker exec mesa-gate sh -c 'printf persisted > /var/lib/mesa/data/gate-marker'
           docker restart mesa-gate
           docker exec mesa-gate test -f /var/lib/mesa/data/gate-marker
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         if: always()
         with:
           name: docker-logs
@@ -228,7 +228,7 @@ jobs:
           "${compose[@]}" restart mesa-v4
           wait_for_health
           "${compose[@]}" exec -T mesa-v4 python -m mesa_memory.container_health
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         if: always()
         with:
           name: v4-compose-logs
@@ -271,7 +271,7 @@ jobs:
             MESA_MODEL_ENABLED=false MESA_EXTERNAL_PROVIDER_ENABLED=false \
             docker compose -f docker-compose.v4.yml config --quiet
           uv run python -m pytest -q tests/test_deployment_assets.py tests/test_runtime_profiles_contract.py tests/test_migration_closure.py tests/test_recovery_contract.py tests/test_v4_sdk_contract.py | tee docs-smoke.log
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         if: always()
         with:
           name: docs-smoke

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
         run: |
           uv build
           uvx twine check dist/*
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dist
           path: dist/