From 53f9bca3c03adbce1d0f574c8ba4be750afee381 Mon Sep 17 00:00:00 2001
From: Tim Stranske <tim@stranskemo.com>
Date: Tue, 16 Jun 2026 20:27:16 -0500
Subject: [PATCH] fix: unblock renovate workflow updates

---
 scripts/workflow_validator.py                        |  6 +++---
 .../consumer-repo/.github/workflows/pr-00-gate.yml   |  5 +++++
 tests/test_workflow_validator.py                     | 12 ++++++------
 3 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/scripts/workflow_validator.py b/scripts/workflow_validator.py
index 2f22b44fe..aac268a3c 100644
--- a/scripts/workflow_validator.py
+++ b/scripts/workflow_validator.py
@@ -13,8 +13,8 @@
 DEPRECATED_ACTIONS = {
     "actions/checkout@v2": "actions/checkout@v4",
     "actions/checkout@v3": "actions/checkout@v4",
-    "actions/upload-artifact@v2": "actions/upload-artifact@v6",
-    "actions/upload-artifact@v3": "actions/upload-artifact@v6",
+    "actions/upload-artifact@v2": "actions/upload-artifact@v7",
+    "actions/upload-artifact@v3": "actions/upload-artifact@v7",
     "actions/download-artifact@v2": "actions/download-artifact@v7",
     "actions/download-artifact@v3": "actions/download-artifact@v7",
 }
@@ -87,7 +87,7 @@ def check_missing_timeout(workflow: dict) -> list[str]:
 
 
 def check_upload_artifact_major(
-    workflow: dict, expected_major: int = 6
+    workflow: dict, expected_major: int = 7
 ) -> list[tuple[str, str, str]]:
     """Check that actions/upload-artifact uses the expected major version.
 
diff --git a/templates/consumer-repo/.github/workflows/pr-00-gate.yml b/templates/consumer-repo/.github/workflows/pr-00-gate.yml
index f985361d3..226886aff 100644
--- a/templates/consumer-repo/.github/workflows/pr-00-gate.yml
+++ b/templates/consumer-repo/.github/workflows/pr-00-gate.yml
@@ -81,6 +81,7 @@ jobs:
         with:
 
           token: ${{ steps.app_token.outputs.token || github.token }}
+          persist-credentials: false
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           sparse-checkout: |
@@ -206,6 +207,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
+          persist-credentials: false
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
@@ -239,6 +241,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
+          persist-credentials: false
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - name: Detect optional script test suites
@@ -343,6 +346,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ steps.app_token.outputs.token || github.token }}
+          persist-credentials: false
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
@@ -407,6 +411,7 @@ jobs:
         with:
 
           token: ${{ steps.app_token.outputs.token || github.token }}
+          persist-credentials: false
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           sparse-checkout: |
diff --git a/tests/test_workflow_validator.py b/tests/test_workflow_validator.py
index aa4e93539..39d2457c0 100644
--- a/tests/test_workflow_validator.py
+++ b/tests/test_workflow_validator.py
@@ -121,19 +121,19 @@ class TestCheckUploadArtifactMajor:
     """Tests for check_upload_artifact_major function."""
 
     def test_accepts_expected_major(self) -> None:
-        """Test that v6 is accepted."""
+        """Test that v7 is accepted."""
         workflow = {
-            "jobs": {"build": {"steps": [{"name": "Upload", "uses": "actions/upload-artifact@v6"}]}}
+            "jobs": {"build": {"steps": [{"name": "Upload", "uses": "actions/upload-artifact@v7"}]}}
         }
 
         issues = check_upload_artifact_major(workflow)
         assert issues == []
 
     def test_accepts_expected_major_with_patch(self) -> None:
-        """Test that v6.x.y is accepted."""
+        """Test that v7.x.y is accepted."""
         workflow = {
             "jobs": {
-                "build": {"steps": [{"name": "Upload", "uses": "actions/upload-artifact@v6.1.2"}]}
+                "build": {"steps": [{"name": "Upload", "uses": "actions/upload-artifact@v7.0.1"}]}
             }
         }
 
@@ -141,14 +141,14 @@ def test_accepts_expected_major_with_patch(self) -> None:
         assert issues == []
 
     def test_flags_other_major(self) -> None:
-        """Test that non-v6 major versions are flagged."""
+        """Test that non-v7 major versions are flagged."""
         workflow = {
             "jobs": {"build": {"steps": [{"name": "Upload", "uses": "actions/upload-artifact@v4"}]}}
         }
 
         issues = check_upload_artifact_major(workflow)
         assert len(issues) == 1
-        assert "v6" in issues[0][2]
+        assert "v7" in issues[0][2]
 
     def test_ignores_other_actions(self) -> None:
         """Test that unrelated actions are ignored."""