[dependabot]

Bumps actions/upload-artifact from 7.0.1 to 7.0.2.

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

[claude]

Review: LGTM.

• This is a patch bump of actions/upload-artifact from 7.0.1 to 7.0.2 across 7 workflows. The diff changes only version refs, with no behavior or config changes.
• The upstream changes are an @actions/artifact bump to 6.3.1 and better retry handling on HTTP 429. Neither affects how our with: inputs (name, path) are used.
• production-release.yml pins by full SHA (cf430e03…) and the others use the tag. That matches the existing convention in each file. The SHA is the merge commit for the v7.0.2 release prep listed in the release notes.
• No code, tests, docs or changelog fragment are needed for a CI-only dependency bump.
• Security: no new permissions or inputs. Keeping the SHA pin in the release workflow is the right call.

I didn't run anything; the check is the PR's CI run, since these steps only fire on failure.

[claude]

Review: LGTM.

• This is a patch bump of actions/upload-artifact from 7.0.1 to 7.0.2. It touches 7 workflow files and changes only the uses: refs.
• The pinned SHA in production-release.yml (cf430e030ddbb5b0abf93d22962f4752f3646cd9) matches the v7.0.2 merge commit listed in the release notes. The pinning convention for that release workflow is kept.
• The upstream changes are 429 retry handling and an @actions/artifact bump to 6.3.1. Neither changes inputs or outputs, so I see no breaking risk.
• No code, security, or test-coverage concerns. CI passing on the workflows that exercise the upload step is enough to confirm.
• Optional: the other workflows use the v7.0.2 tag, while production-release.yml uses a SHA. Pinning all of them to SHAs would be safer against tag moves, but that is outside this PR.