Bump the actions group with 3 updates

[dependabot]

Bumps the actions group with 3 updates: actions/upload-artifact, actions/download-artifact and actions/create-github-app-token.

Updates actions/upload-artifact from 3 to 4

Release notes

Sourced from actions/upload-artifact's releases.

v4.0.0

What's Changed

The release of upload-artifact@v4 and download-artifact@v4 are major changes to the backend architecture of Artifacts. They have numerous performance and behavioral improvements.

ℹ️ However, this is a major update that includes breaking changes. Artifacts created with versions v3 and below are not compatible with the v4 actions. Uploads and downloads must use the same major actions versions. There are also key differences from previous versions that may require updates to your workflows.

For more information, please see:

1. The changelog post.
2. The README.
3. The migration documentation.
4. As well as the underlying npm package, @​actions/artifact documentation.

New Contributors

• @​vmjoseph made their first contribution in actions/upload-artifact#464

Full Changelog: actions/upload-artifact@v3...v4.0.0

v3.2.1

What's Changed

This fixes the include-hidden-files input introduced in https://github.com/actions/upload-artifact/releases/tag/v3.2.0

• Ensure hidden files input is used by @​joshmgross in actions/upload-artifact#609

Full Changelog: actions/upload-artifact@v3.2.0...v3.2.1

v3.2.1-node20

What's Changed

This fixes the include-hidden-files input introduced in https://github.com/actions/upload-artifact/releases/tag/v3.2.0-node20

• Ensure hidden files input is used by @​joshmgross in actions/upload-artifact#608

Full Changelog: actions/upload-artifact@v3.2.0-node20...v3.2.1-node20

v3.2.0

Notice: Breaking Changes ⚠️

We will no longer include hidden files and folders by default in the upload-artifact action of this version. This reduces the risk that credentials are accidentally uploaded into artifacts. Customers who need to continue to upload these files can use a new option, include-hidden-files, to continue to do so.

See "Notice of upcoming deprecations and breaking changes in GitHub Actions runners" changelog and this issue for more details.

What's Changed

• V3 backport: Exclude hidden files by default by @​SrRyan in actions/upload-artifact#604

... (truncated)

Commits

• 5076954 Merge pull request #598 from actions/joshmgross/exclude-hidden-files
• d52396a Add a warning about enabling include-hidden-files
• 710f362 Remove "merged" from include-hidden-files input description
• 3b315f2 npm run release again 🙂
• 3be2180 Remove another trailing comma
• 453e8d0 Update glob license
• 0a398c1 npm run release
• a0c40cf Update to latest @actions/glob and fix tests
• acb59e4 lint
• cb6558b Exclude hidden files by default
• Additional commits viewable in compare view

Updates actions/download-artifact from 3 to 4

Release notes

Sourced from actions/download-artifact's releases.

v4.0.0

What's Changed

The release of upload-artifact@v4 and download-artifact@v4 are major changes to the backend architecture of Artifacts. They have numerous performance and behavioral improvements.

ℹ️ However, this is a major update that includes breaking changes. Artifacts created with versions v3 and below are not compatible with the v4 actions. Uploads and downloads must use the same major actions versions. There are also key differences from previous versions that may require updates to your workflows.

For more information, please see:

1. The changelog post.
2. The README.
3. The migration documentation.
4. As well as the underlying npm package, @​actions/artifact documentation.

New Contributors

• @​bflad made their first contribution in actions/download-artifact#194

Full Changelog: actions/download-artifact@v3...v4.0.0

v3.0.2

• Bump @actions/artifact to v1.1.1 - actions/download-artifact#195
• Fixed a bug in Node16 where if an HTTP download finished too quickly (<1ms, e.g. when it's mocked) we attempt to delete a temp file that has not been created yet Migrate dev environment and workflows to node16  actions/toolkit#1278

v3.0.1

• Bump @​actions/core to 1.10.0

Commits

• fa0a91b Merge pull request #341 from actions/robherley/bump-pkgs
• b54d088 Update @​actions/artifact version, bump dependencies
• 65a9edc Merge pull request #325 from bethanyj28/main
• fdd1595 licensed
• c13dba1 update @​actions/artifact dependency
• 0daa75e Merge pull request #324 from actions/eggyhead/use-artifact-v2.1.6
• 9c19ed7 Merge branch 'main' into eggyhead/use-artifact-v2.1.6
• 3d3ea87 updating license
• 89af5db updating artifact package v2.1.6
• b4aefff Merge pull request #323 from actions/eggyhead/update-artifact-v215
• Additional commits viewable in compare view

Updates actions/create-github-app-token from 1.10.3 to 1.11.0

Release notes

Sourced from actions/create-github-app-token's releases.

v1.11.0

What's Changed

Features

• Allow repositories input to be comma or newline-separated by @​peter-evans in actions/create-github-app-token#169

New Contributors

• @​peter-evans made their first contribution in actions/create-github-app-token#169

Full Changelog: actions/create-github-app-token@v1.10.4...v1.11.0

v1.10.4

What's Changed

• build(deps-dev): bump the development-dependencies group with 4 updates by @​dependabot in actions/create-github-app-token#150
• docs(README): fix the git committer string and Configure git CLI examples by @​maboloshi in actions/create-github-app-token#151
• docs(readme): document how a Base64 private key could be decoded by @​vleon1a in actions/create-github-app-token#155
• test: fix test file extensions and inputs for repositories by @​parkerbxyz in actions/create-github-app-token#161
• build(deps-dev): bump the development-dependencies group across 1 directory with 4 updates by @​dependabot in actions/create-github-app-token#167

Bug Fixes

• bump the production-dependencies group across 1 directory with 3 updates by @​dependabot in actions/create-github-app-token#166

New Contributors

• @​vleon1a made their first contribution in actions/create-github-app-token#155

Full Changelog: actions/create-github-app-token@v1.10.3...v1.10.4

Commits

• 5d869da build(release): 1.11.0 [skip ci]
• 796b88d feat: allow repositories input to be comma or newline-separated (#169)
• 3378cda build(release): 1.10.4 [skip ci]
• e177c20 fix(deps): bump the production-dependencies group across 1 directory with 3 u...
• 961c228 build(deps-dev): bump the development-dependencies group across 1 directory w...
• 15db037 test: fix test file extensions and inputs for repositories (#161)
• 9ccc6db ci(test): add workflow_dispatch trigger
• 000e2a0 docs(readme): document how a Base64 private key could be decoded (#155)
• d0ac2ad docs(README): fix the git committer string and Configure git CLI examples...
• 040c259 build(deps-dev): bump the development-dependencies group with 4 updates (#150)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Dependabot tried to add @zendesk/codeql-production-shield as a reviewer to this PR, but received the following error from GitHub:

POST https://api.github.com/repos/zendesk/codeql-action/pulls/188/requested_reviewers: 422 - Reviews may only be requested from collaborators. One or more of the teams you specified is not a collaborator of the zendesk/codeql-action repository. // See: https://docs.github.com/rest/pulls/review-requests#request-reviewers-for-a-pull-request

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.