Bump actions/download-artifact from 4 to 5

[dependabot]

Bumps actions/download-artifact from 4 to 5.

Release notes

Sourced from actions/download-artifact's releases.

v5.0.0

What's Changed

• Update README.md by @​nebuk89 in actions/download-artifact#407
• BREAKING fix: inconsistent path behavior for single artifact downloads by ID by @​GrantBirki in actions/download-artifact#416

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

• By name: name: my-artifact → extracted to path/ (direct)
• By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

• By name: name: my-artifact → extracted to path/ (unchanged)
• By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:

• You download artifacts by name
• You download multiple artifacts by ID
• You already use merge-multiple: true as a workaround

⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist
# Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

</tr></table> 

... (truncated)

Commits

• 634f93c Merge pull request #416 from actions/single-artifact-id-download-path
• b19ff43 refactor: resolve download path correctly in artifact download tests (mainly ...
• e262cbe bundle dist
• bff23f9 update docs
• fff8c14 fix download path logic when downloading a single artifact by id
• 448e3f8 Merge pull request #407 from actions/nebuk89-patch-1
• 47225c4 Update README.md
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'KMP JSON schema validator'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.50.

Benchmark suite	Current: 58c84a4	Previous: e7e9021	Ratio
macosArm64.CommonAvgTimeBench.validateBasic ( {"objectPath":"openapi.json","schemaPath":"openapi_schema.json"} )	3142.4069841726614 us/op	1353.788926463964 us/op	2.32
macosArm64.CommonAvgTimeBench.validateBasic ( {"objectPath":"openapi-invalid.json","schemaPath":"openapi_schema.json"} )	2214.3826789855075 us/op	1315.7005138248846 us/op	1.68
macosArm64.CommonAvgTimeBench.validateDetailed ( {"objectPath":"openapi-invalid.json","schemaPath":"openapi_schema.json"} )	7786.690734265734 us/op	3212.757983557047 us/op	2.42
macosArm64.CommonAvgTimeBench.validateVerbose ( {"objectPath":"openapi.json","schemaPath":"openapi_schema.json"} )	11364.388146511628 us/op	5916.451372784811 us/op	1.92
macosArm64.CommonAvgTimeBench.validateVerbose ( {"objectPath":"openapi-invalid.json","schemaPath":"openapi_schema.json"} )	10689.027374000001 us/op	5318.1390131578955 us/op	2.01
macosX64.CommonAvgTimeBench.validateBasic ( {"objectPath":"openapi.json","schemaPath":"openapi_schema.json"} )	5251.128913483146 us/op	2537.916424875622 us/op	2.07
macosX64.CommonAvgTimeBench.validateBasic ( {"objectPath":"openapi-invalid.json","schemaPath":"openapi_schema.json"} )	7612.986554450263 us/op	2628.0222931398416 us/op	2.90
macosX64.CommonAvgTimeBench.validateDetailed ( {"objectPath":"openapi.json","schemaPath":"openapi_schema.json"} )	14394.69864827586 us/op	5906.53335625 us/op	2.44
macosX64.CommonAvgTimeBench.validateDetailed ( {"objectPath":"openapi-invalid.json","schemaPath":"openapi_schema.json"} )	26466.819127906976 us/op	6184.540165789474 us/op	4.28
macosX64.CommonAvgTimeBench.validateFlag ( {"objectPath":"openapi.json","schemaPath":"openapi_schema.json"} )	3325.1873697674428 us/op	1850.8630129496403 us/op	1.80
macosX64.CommonAvgTimeBench.validateFlag ( {"objectPath":"openapi-invalid.json","schemaPath":"openapi_schema.json"} )	2.204261236667706 us/op	1.3266187032362173 us/op	1.66
macosX64.CommonAvgTimeBench.validateVerbose ( {"objectPath":"openapi-invalid.json","schemaPath":"openapi_schema.json"} )	22282.38277708333 us/op	9933.608609183673 us/op	2.24
macosX64.CommonAvgTimeBench.validate ( {"objectPath":"openapi.json","schemaPath":"openapi_schema.json"} )	6145.888267875647 us/op	2494.280358181818 us/op	2.46
macosX64.CommonAvgTimeBench.validate ( {"objectPath":"openapi-invalid.json","schemaPath":"openapi_schema.json"} )	4048.025742465753 us/op	2485.9571170370373 us/op	1.63

This comment was automatically generated by workflow using github-action-benchmark.

CC: @OptimumCode