From 4c9f149d1cb01c3eb73301b5b2afef5c04368f73 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 26 May 2026 01:42:17 +0100
Subject: [PATCH] fix(ci): repair broken actions/upload-artifact SHA pin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pin `actions/upload-artifact@65c79d7f...` references a commit
that does not exist on upstream `actions/upload-artifact` (verified
via gh api — "No commit found for SHA"). Every workflow run using
this pin fails immediately with:

    Unable to resolve action `actions/upload-artifact@65c79d7f...`

Replacing with the current v4 head SHA `ea165f8d65b6e75b540449e92b4886f43607fa02`, retrieved from
`gh api repos/actions/upload-artifact/git/refs/tags/v4`.

One repo's slice of a 10-repo estate-wide outage; companion PRs are
landing in parallel.

Affects 1 workflow file in .github/workflows/.
---
 .github/workflows/hypatia-scan.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index c74c598..849bfd2 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -74,7 +74,7 @@ jobs:
           echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload findings artifact
-        uses: actions/upload-artifact@65c79d7f54e76e4e3c7a8f34db0f4ac8b515c478 # v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: hypatia-findings
           path: hypatia-findings.json