feat: implement new `artifact-ids` input by GrantBirki · Pull Request #401 · actions/download-artifact

GrantBirki · 2025-04-17T04:48:53Z

`artifact-ids` input

This pull request implements a new artifact-ids input which takes a comma separated list of artifact ids for this Action to download.

Why?

In v4, artifacts are immutable by default and each artifact gets a unique ID when uploaded. When an artifact with the same name is uploaded again (with or without overwrite: true), it gets a new artifact ID.

To take advantage of this immutability for security purposes (to avoid potential TOCTOU issues where an artifact might be replaced between upload and download), the new artifact-ids input allows you to download artifacts by their specific ID rather than by name:

jobs:
  upload:
    runs-on: ubuntu-latest
    steps:
      - name: Create a file
        run: echo "hello world" > my-file.txt
      - name: Upload Artifact
        id: upload
        uses: actions/upload-artifact@v4
        with:
          name: my-artifact
          path: my-file.txt
      # The upload step outputs the artifact ID
      - name: Print Artifact ID
        run: echo "Artifact ID is ${{ steps.upload.outputs.artifact-id }}"
  download:
    needs: upload
    runs-on: ubuntu-latest
    steps:
      - name: Download Artifact by ID
        uses: actions/download-artifact@v4
        with:
          # Use the artifact ID directly, not the name, to ensure you get exactly the artifact you expect
          artifact-ids: ${{ needs.upload.outputs.artifact-id }}

This approach provides stronger guarantees about which artifact version you're downloading compared to using just the artifact name.

Testing

I gave this a go in another project and it works great!

resolves: #349

Copilot

Pull Request Overview

This PR introduces a new input, artifact-ids, which allows users to download artifacts by their unique IDs rather than by name to leverage artifact immutability for enhanced security.

Adds the artifact-ids input and associated validation logic in the download artifact code
Updates documentation, tests, and constants to support this new input
Modifies error messages and info logs to reflect the mutually exclusive usage of name and artifact-ids

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/download-artifact.ts	Added artifact-ids input with validation and branch handling for downloading by IDs
src/constants.ts	Updated enumeration to include artifact-ids
docs/MIGRATION.md	Documented new immutable artifacts workflow
action.yml	Introduced new input definition for artifact-ids
tests/download.test.ts	Updated test expectation messages to include artifact-ids
README.md	Enhanced documentation with examples for downloading artifacts by ID

Comments suppressed due to low confidence (1)

src/download-artifact.ts:89

Ensure dedicated tests are added for the new artifact-ids branch, including scenarios for non-numeric input and cases where provided IDs are missing, to increase test coverage.

else if (isDownloadByIds) {

…esulting id returned

…`isSingleArtifactDownload` logic

…y artifact-ids until a `getArtifactById()` public method exists

GrantBirki · 2025-04-22T15:16:49Z

I'm not quite sure what the release process looks like for this project so I'll just merge and leave it at that. Thanks! 🙇

…of `name` related: actions/download-artifact#401

* Update GitHub Actions workflow for artifact handling by `id` instead of `name` related: actions/download-artifact#401

@pedrolacerda

* docs: small migration fix * Update MIGRATION.md Fixing the broken link pointing to `actions/upload-artifact` content outside of the repository. cc: @pedrolacerda * Update artifact package to 2.2.2 * Bump artifact version, do digest check * Refactor loop * update dist * Refactor loop, break for testing * unbreak testing code * Break the thing, also log the expected digest * run release * Make work as intended * Update README.md removing deprecation warning * Bump artifact package * Update artifact license * Update artifact to 2.3.2 * Update dist * Fix bug introduced in 4.2.0 * dist & package.json * Add tests & test dependencies * Lint * Unfix error * Configure tsconfig * lint * Add extra assertion to download single artifact test * lint * Run unit tests in CI * Move log statements * implement new `artifact-ids` input * apply actions#401 (comment) suggestion * when only one artifact-id is given, use `getArtifact` and check the resulting id returned * bundle * use the same `artifactClient.getArtifact` structure as seen above in `isSingleArtifactDownload` logic * bundle * revert `getArtifact()` changes - for now we have to list and filter by artifact-ids until a `getArtifactById()` public method exists * add supporting unit tests for artifact downloads with ids * Fix workflow example for downloading by artifact ID * Remove path filters from Check dist workflow * prep for v4.3.0 release * Update README.md * Update to Node.js 24 and related dependencies Bump Node.js version to 24 in workflows, action definition, and package requirements. Update @types/node to 24.1.0 and add engines field to enforce Node.js >=24. This ensures compatibility with the latest Node.js features and ecosystem. * fix download path logic when downloading a single artifact by id * update docs * bundle dist * refactor: resolve download path correctly in artifact download tests (mainly for windows unit tests) * Update README for download-artifact v5 changes Updated documentation for download-artifact action to reflect changes in version 5. * Update README.md Co-authored-by: Copilot <[email protected]> * Remove migration guide for artifact download changes Readme probably should be less verbose since it's not a changelog. * Update README with artifact extraction details Clarified note on artifact extraction and GHES support. * Readme: spell out the first use of GHES * Update to use local artifact package v3.0.0 - Switch from @actions/artifact@^2.3.2 to file:../packages/artifact - Add uri-js-replace security override - Update @actions/github to v6.0.1 for security fixes - Rebuild dist/index.js with updated dependencies - Fix all security vulnerabilities (0 remaining) * update licenses * Update licensed configuration for new dependencies with Node 24 support * Fix licensed configuration by ignoring packages with missing license text * update * Update licensed workflow to cache dependencies before status check * Revert licensed workflow changes - keep original behavior * update licences with temp not using package * update dist * Prepare `v6.0.0` * Remove `github.dep.yml` * Revert "Remove `github.dep.yml`" This reverts commit bb3a066. * Update GHES guidance to include reference to Node 20 version * Fix typo in URL * chore: use local @actions/artifact and @actions/core packages * chore: update dependencies to use published npm packages * chore: update @actions/artifact to use npm package v5.0.0 - Changed from file:../packages/artifact to 5.0.0 - Regenerated package-lock.json * chore: regenerate license cache and fix @bufbuild/protobuf license * chore: add minimatch.dep.yml license file * chore: use local @actions/artifact package for Node.js 24 testing This branch uses a local file reference to @actions/artifact which includes the updated @azure/storage-blob ^12.29.1 to fix the punycode deprecation warning on Node.js 24. This is a test branch - do not merge until @actions/[email protected] is published. * fix: update @actions/artifact to ^5.0.0 for Node.js 24 punycode fix Updates @actions/artifact dependency to use the published npm version which includes @azure/storage-blob ^12.29.1 that fixes the punycode deprecation warning on Node.js 24. * chore: update package-lock.json with @actions/[email protected] * chore: update @actions/artifact license file to 5.0.1 * chore: remove obsolete dependency license files * chore: restore minimatch.dep.yml license file * chore: release v7.0.0 for Node.js 24 support - Update to Node.js 24 runtime (runs.using: node24) - Bump version to 7.0.0 - Update README with v7 release notes - Rebuild dist * doc: update readme * Update .gitignore * Migrate eslint to `v9` * Upgrade jest and typescript * Don't attempt to un-zip non-zipped downloads * Add tests * Add an integration test for `skip-decompress` * Update the integration test * Cache licenses * Updated the licensed version * Revert "Updated the licensed version" This reverts commit e6afc5e. * Re-add minimatch.dep.yml * Fixup the minimatch license * Fix skip decompress test * One more test fix * Update test names to make it clearer what they do * Bump the version to `v8` and add release notes * Add note about package bumps * Add a setting to specify what to do on hash mismatch and default it to `error` * Fix linting issues * Add change docs * Add a regression test for artifact name + content-type mismatches (actions#472) * Add a regression test for artifact name + content-type mismatches * Specify that we want v4 in a comment * Fix the expected type * Add regression tests for CJK characters (actions#471) * Add regression tests for CJK characters * Dedupe the names and remove the ignored `name` param * Bump @actions/artifact to v6.2.1 * Run `npm run release` * Update licenses * Update the readme (actions#473) * Update the readme * Update upload artifact versions * Add back the GHES support note * Update the skip-decompress description * Be more specific with the direct download example * Add GHES support section to TOC --------- Co-authored-by: Francisco Robles Martín <[email protected]> Co-authored-by: Josh Gross <[email protected]> Co-authored-by: Andy Feller <[email protected]> Co-authored-by: Rob Herley <[email protected]> Co-authored-by: Yang Cao <[email protected]> Co-authored-by: Ryan Ghadimi <[email protected]> Co-authored-by: Larissa Fortuna <[email protected]> Co-authored-by: JoannaaKL <[email protected]> Co-authored-by: Grant Birkinbine <[email protected]> Co-authored-by: Ben De St Paer-Gotch <[email protected]> Co-authored-by: Salman Muin Kayser Chishti <[email protected]> Co-authored-by: Copilot <[email protected]> Co-authored-by: Daniel Kennedy <[email protected]> Co-authored-by: Patrik Polyak <[email protected]> Co-authored-by: Zachary Taylor <[email protected]>

implement new artifact-ids input

ac35f99

GrantBirki added the enhancement New feature or request label Apr 17, 2025

Copilot AI review requested due to automatic review settings April 17, 2025 04:48

GrantBirki requested a review from a team as a code owner April 17, 2025 04:48

Copilot AI reviewed Apr 17, 2025

View reviewed changes

Comment thread src/download-artifact.ts Outdated

robherley reviewed Apr 17, 2025

View reviewed changes

Comment thread src/download-artifact.ts

GrantBirki added 6 commits April 17, 2025 09:55

apply #401 (comment) suggestion

42aef06

when only one artifact-id is given, use getArtifact and check the r…

ec378bc

…esulting id returned

bundle

e463631

use the same artifactClient.getArtifact structure as seen above in …

171183c

…`isSingleArtifactDownload` logic

bundle

b83057b

revert getArtifact() changes - for now we have to list and filter b…

54124fb

…y artifact-ids until a `getArtifactById()` public method exists

robherley reviewed Apr 17, 2025

View reviewed changes

Comment thread __tests__/download.test.ts

add supporting unit tests for artifact downloads with ids

d219c63

robherley approved these changes Apr 22, 2025

View reviewed changes

GrantBirki merged commit 8ea3c2c into main Apr 22, 2025

ramonpetgrave64 reviewed Apr 22, 2025

View reviewed changes

Comment thread docs/MIGRATION.md

joshmgross mentioned this pull request Apr 23, 2025

Fix workflow example for downloading by artifact ID #402

Merged

joshmgross deleted the download-by-id branch April 23, 2025 14:30

GrantBirki added a commit to GrantBirki/urllib3 that referenced this pull request Aug 4, 2025

Update GitHub Actions workflow for artifact handling by id instead …

b264554

…of `name` related: actions/download-artifact#401

GrantBirki mentioned this pull request Aug 4, 2025

security: update actions for artifact handling only by id urllib3/urllib3#3648

Merged

pquentin pushed a commit to urllib3/urllib3 that referenced this pull request Aug 5, 2025

security: update actions for artifact handling only by id (#3648)

fd84166

* Update GitHub Actions workflow for artifact handling by `id` instead of `name` related: actions/download-artifact#401

GrantBirki mentioned this pull request Aug 5, 2025

fix: inconsistent path behavior for single artifact downloads by ID #416

Merged

coderabbitai Bot mentioned this pull request May 31, 2026

feat: CI/CD 파이프라인 구축 완료 HSU-Makeus-Challenge-10th/Node.js#46

Merged

7 tasks

coderabbitai Bot mentioned this pull request Aug 7, 2026

fix(opencode): bind coverage artifacts to workflow attempts ContextualWisdomLab/.github#812

Closed

coderabbitai Bot mentioned this pull request Aug 16, 2026

feat: add Python and Node.js SDK packages rspdl/rspdl-core#22

Merged

Navigation Menu

Uh oh!

feat: implement new `artifact-ids` input - #401

feat: implement new `artifact-ids` input#401
GrantBirki merged 8 commits into
mainfrom
download-by-id

GrantBirki commented Apr 17, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

GrantBirki commented Apr 22, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

GrantBirki commented Apr 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

artifact-ids input

Why?

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

GrantBirki commented Apr 22, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

GrantBirki commented Apr 17, 2025 •

edited

Loading

`artifact-ids` input