chore(deps): update actions/upload-pages-artifact action to v5

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/upload-pages-artifact	action	major	v4.0.0 → v5.0.0

---

Release Notes

actions/upload-pages-artifact (actions/upload-pages-artifact)

v5.0.0

Compare Source

Changelog

• Update upload-artifact action to version 7 @​Tom-van-Woudenberg (#​139)
• feat: add include-hidden-files input @​jonchurch (#​137)

See details of all code changes since previous release.

v5

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

�� Release Content Analysis

New Features:

• include-hidden-files input parameter: Added optional boolean input (default: false) to control whether hidden files and directories (starting with .) are included in the artifact. Note that .git and .github directories are always excluded regardless of this setting.
• This feature addresses use cases where sites need to deploy hidden files like .well-known directories for domain verification or other purposes.

Infrastructure Updates:

• Upgraded to upload-artifact v7: The underlying actions/upload-artifact action was upgraded from v6 to v7 to address Node 20 deprecation warnings on GitHub Actions runners.
• The v7 upgrade includes migration to ESM (ECMAScript modules) and support for direct file uploads (not used by this action).

Bug Fixes:

• No specific bug fixes documented in this release; primarily focused on feature additions and infrastructure modernization.

Security-Related Changes:

• The update ensures continued compatibility with GitHub Actions runners as Node 20 is being deprecated (end-of-life April 2026, full removal Fall 2026).
• Maintaining the default behavior of excluding hidden files (include-hidden-files: false) preserves security-conscious defaults.

Breaking Changes:

• None. The new include-hidden-files parameter is optional and defaults to false, maintaining backward compatibility.
• All existing workflows using v4 will work identically with v5 without any configuration changes.

🎯 Impact Scope Investigation

Usage Location Identification:

• The action is used in .github/workflows/hugo.yaml at line 50
• Current usage: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
• Updated to: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
• Configuration: Only specifies path: ./public parameter

Current Usage Analysis:

• The workflow builds a Hugo site and uploads the ./public directory for GitHub Pages deployment
• No custom configuration for artifact name or retention period
• The default exclusion of hidden files is appropriate for this Hugo site (no .well-known or similar directories needed)

Impact on Dependencies:

• The posts.yml workflow uses actions/upload-artifact@v7.0.1 directly for uploading topics and posts, which is compatible with the ecosystem
• The deploy job uses actions/deploy-pages@v5.0.0 which expects artifacts from upload-pages-artifact and remains fully compatible
• No dependency conflicts identified

Configuration Impact:

• No configuration changes required in the workflow
• The existing path: ./public parameter remains valid
• Optional new parameter include-hidden-files is not needed for this use case

Hugo Site Content Analysis:

• Hugo builds static sites to the ./public directory by default
• Standard Hugo sites do not typically include hidden files that need deployment
• The PaperMod theme (used via submodule) does not require hidden files in the deployment artifact

💡 Recommended Actions

Immediate Actions:

1. ✅ Approve and merge this PR - The update is backward compatible and safe to deploy
2. ✅ No code changes required - The existing workflow configuration works without modification
3. ✅ No testing required beyond CI - The change is non-breaking and the existing deployment pipeline will validate functionality

Optional Considerations:

• Monitor the deployment: While this is a safe update, verify that the next Hugo site deployment completes successfully after merge
• Future-proofing: This update addresses the Node 20 deprecation, ensuring the workflow continues functioning through Fall 2026 when Node 20 is fully removed from GitHub Actions runners

Not Required:

• No migration steps needed
• No configuration updates needed
• No documentation updates needed
• No feature flag changes needed

🔗 Reference Links

Release Information:

• v5.0.0 Release Notes
• v4.0.0 → v5.0.0 Comparison
• PR #139: Update upload-artifact to v7
• PR #137: Add include-hidden-files input

Context & Documentation:

• upload-artifact v7.0.0 Release Notes
• Node 20 Deprecation Announcement
• v5.0.0 action.yml Specification

Related Issues:

• Issue #138: Node 20 deprecation warning
• Issue #129: Hidden files unconditionally excluded

Generated by koki-develop/claude-renovate-review