Skip to content

Add a regression test for artifact name + content-type mismatches - #472

Merged
danwkennedy merged 3 commits into
mainfrom
danwkennedy/name-mismatch-regression
Mar 11, 2026
Merged

danwkennedy merged 3 commits into
mainfrom
danwkennedy/name-mismatch-regression

Conversation

@danwkennedy

@danwkennedy danwkennedy commented Mar 11, 2026 •

Copy link
Copy Markdown
Contributor

Description

We have reports of older archive files being uploaded (with the v4 action) and the downloaded Content-Disposition returns a file without the .zip extension. This only happens when the artifact name has a file type extension (ie. report.txt). This adds tests for that scenario so we can know when we're green again.

@danwkennedy
danwkennedy requested a review from a team as a code owner March 11, 2026 00:49
Copilot AI review requested due to automatic review settings March 11, 2026 00:49

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds an end-to-end workflow regression test to detect cases where an archived artifactโ€™s Content-Disposition filename does not include the expected .zip suffix when the artifact name itself has a misleading extension (e.g. .txt).

Changes:

  • Upload an artifact named like report.txt-<runner> to simulate a name/content-type mismatch.
  • Download that artifact with skip-decompress: true and assert the saved filename ends in .zip.
Comments suppressed due to low confidence (1)

.github/workflows/test.yml:170

  • This actions/upload-artifact@v4 step is missing a name: field. Most steps in this workflow are named, and naming this one will make the job log much easier to read/debug when failures happen around this regression test.
    - uses: actions/upload-artifact@v4 # V4 is important here to ensure we're supporting older versions correctly
      with:
        name: report.txt-${{ matrix.runs-on }}
        path: path/to/extension-test/data.json

๐Ÿ’ก Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +162 to +171
- name: Create and upload archived artifact with misleading extension
shell: bash
run: |
mkdir -p path/to/extension-test
echo '{"key": "value"}' > path/to/extension-test/data.json
- uses: actions/upload-artifact@v4 # V4 is important here to ensure we're supporting older versions correctly
with:
name: report.txt-${{ matrix.runs-on }}
path: path/to/extension-test/data.json

Copilot AI Mar 11, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The step name says "Create and upload..." but this step only creates the input file; the upload happens in the following actions/upload-artifact@v4 step. Consider splitting this into two clearly named steps (e.g., "Create artifact payload" and "Upload artifact with misleading extension") so the workflow logs accurately reflect what happened.

This issue also appears on line 167 of the same file.

Suggested change
- name: Create and upload archived artifact with misleading extension
shell: bash
run: |
mkdir -p path/to/extension-test
echo '{"key": "value"}' > path/to/extension-test/data.json
- uses: actions/upload-artifact@v4 # V4 is important here to ensure we're supporting older versions correctly
with:
name: report.txt-${{ matrix.runs-on }}
path: path/to/extension-test/data.json
- name: Create archived artifact payload with misleading extension
shell: bash
run: |
mkdir -p path/to/extension-test
echo '{"key": "value"}' > path/to/extension-test/data.json
- name: Upload archived artifact with misleading extension
uses: actions/upload-artifact@v4 # V4 is important here to ensure we're supporting older versions correctly
with:
name: report.txt-${{ matrix.runs-on }}
path: path/to/extension-test/data.json

Copilot uses AI. Check for mistakes.
@danwkennedy
danwkennedy merged commit e6d03f6 into main Mar 11, 2026
11 of 17 checks passed
@danwkennedy
danwkennedy deleted the danwkennedy/name-mismatch-regression branch March 11, 2026 12:57
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request Mar 13, 2026
Bumps the github-actions group with 2 updates: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [actions/download-artifact](https://github.com/actions/download-artifact).
Updates `anthropics/claude-code-action` from 1.0.70 to 1.0.71
Release notes

*Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).*

> v1.0.71
> -------
>
> What's Changed
> --------------
>
> * docs: warn that allowed\_bots can expose the action to external triggers by [`@โ€‹an-dustin`](https://github.com/an-dustin) in [anthropics/claude-code-action#1039](https://redirect.github.com/anthropics/claude-code-action/pull/1039)
> * feat(inline-comment): add confirmed param + probe-pattern safety net by [`@โ€‹km-anthropic`](https://github.com/km-anthropic) in [anthropics/claude-code-action#1048](https://redirect.github.com/anthropics/claude-code-action/pull/1048)
>
> New Contributors
> ----------------
>
> * [`@โ€‹an-dustin`](https://github.com/an-dustin) made their first contribution in [anthropics/claude-code-action#1039](https://redirect.github.com/anthropics/claude-code-action/pull/1039)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.71>


Commits

* [`5d0cc74`](anthropics/claude-code-action@5d0cc74) feat(inline-comment): add confirmed param + probe-pattern safety net ([#1048](https://redirect.github.com/anthropics/claude-code-action/issues/1048))
* [`567be3d`](anthropics/claude-code-action@567be3d) chore: bump Claude Code to 2.1.73 and Agent SDK to 0.2.73
* [`eb99fb3`](anthropics/claude-code-action@eb99fb3) chore: bump Claude Code to 2.1.72 and Agent SDK to 0.2.72
* [`33fbb80`](anthropics/claude-code-action@33fbb80) docs: warn that allowed\_bots can expose the action to external triggers ([#1039](https://redirect.github.com/anthropics/claude-code-action/issues/1039))
* [`3428ca8`](anthropics/claude-code-action@3428ca8) chore: bump Claude Code to 2.1.71 and Agent SDK to 0.2.71
* See full diff in [compare view](anthropics/claude-code-action@26ec041...5d0cc74)
  
Updates `actions/download-artifact` from 8.0.0 to 8.0.1
Release notes

*Sourced from [actions/download-artifact's releases](https://github.com/actions/download-artifact/releases).*

> v8.0.1
> ------
>
> What's Changed
> --------------
>
> * Support for CJK characters in the artifact name by [`@โ€‹danwkennedy`](https://github.com/danwkennedy) in [actions/download-artifact#471](https://redirect.github.com/actions/download-artifact/pull/471)
> * Add a regression test for artifact name + content-type mismatches by [`@โ€‹danwkennedy`](https://github.com/danwkennedy) in [actions/download-artifact#472](https://redirect.github.com/actions/download-artifact/pull/472)
>
> **Full Changelog**: <actions/download-artifact@v8...v8.0.1>


Commits

* [`3e5f45b`](actions/download-artifact@3e5f45b) Add regression tests for CJK characters ([#471](https://redirect.github.com/actions/download-artifact/issues/471))
* [`e6d03f6`](actions/download-artifact@e6d03f6) Add a regression test for artifact name + content-type mismatches ([#472](https://redirect.github.com/actions/download-artifact/issues/472))
* See full diff in [compare view](actions/download-artifact@70fc10c...3e5f45b)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore  major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore  minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore  ` will remove the ignore condition of the specified dependency and ignore conditions
tae898 pushed a commit to humemai/arcadedb-embedded-python that referenced this pull request Jun 28, 2026
Bumps the github-actions group with 2 updates: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [actions/download-artifact](https://github.com/actions/download-artifact).
Updates `anthropics/claude-code-action` from 1.0.70 to 1.0.71
Release notes

*Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).*

> v1.0.71
> -------
>
> What's Changed
> --------------
>
> * docs: warn that allowed\_bots can expose the action to external triggers by [`@โ€‹an-dustin`](https://github.com/an-dustin) in [anthropics/claude-code-action#1039](https://redirect.github.com/anthropics/claude-code-action/pull/1039)
> * feat(inline-comment): add confirmed param + probe-pattern safety net by [`@โ€‹km-anthropic`](https://github.com/km-anthropic) in [anthropics/claude-code-action#1048](https://redirect.github.com/anthropics/claude-code-action/pull/1048)
>
> New Contributors
> ----------------
>
> * [`@โ€‹an-dustin`](https://github.com/an-dustin) made their first contribution in [anthropics/claude-code-action#1039](https://redirect.github.com/anthropics/claude-code-action/pull/1039)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.71>


Commits

* [`5d0cc74`](anthropics/claude-code-action@5d0cc74) feat(inline-comment): add confirmed param + probe-pattern safety net ([#1048](https://redirect.github.com/anthropics/claude-code-action/issues/1048))
* [`567be3d`](anthropics/claude-code-action@567be3d) chore: bump Claude Code to 2.1.73 and Agent SDK to 0.2.73
* [`eb99fb3`](anthropics/claude-code-action@eb99fb3) chore: bump Claude Code to 2.1.72 and Agent SDK to 0.2.72
* [`33fbb80`](anthropics/claude-code-action@33fbb80) docs: warn that allowed\_bots can expose the action to external triggers ([ArcadeData#1039](https://redirect.github.com/anthropics/claude-code-action/issues/1039))
* [`3428ca8`](anthropics/claude-code-action@3428ca8) chore: bump Claude Code to 2.1.71 and Agent SDK to 0.2.71
* See full diff in [compare view](anthropics/claude-code-action@26ec041...5d0cc74)
  
Updates `actions/download-artifact` from 8.0.0 to 8.0.1
Release notes

*Sourced from [actions/download-artifact's releases](https://github.com/actions/download-artifact/releases).*

> v8.0.1
> ------
>
> What's Changed
> --------------
>
> * Support for CJK characters in the artifact name by [`@โ€‹danwkennedy`](https://github.com/danwkennedy) in [actions/download-artifact#471](https://redirect.github.com/actions/download-artifact/pull/471)
> * Add a regression test for artifact name + content-type mismatches by [`@โ€‹danwkennedy`](https://github.com/danwkennedy) in [actions/download-artifact#472](https://redirect.github.com/actions/download-artifact/pull/472)
>
> **Full Changelog**: <actions/download-artifact@v8...v8.0.1>


Commits

* [`3e5f45b`](actions/download-artifact@3e5f45b) Add regression tests for CJK characters ([#471](https://redirect.github.com/actions/download-artifact/issues/471))
* [`e6d03f6`](actions/download-artifact@e6d03f6) Add a regression test for artifact name + content-type mismatches ([#472](https://redirect.github.com/actions/download-artifact/issues/472))
* See full diff in [compare view](actions/download-artifact@70fc10c...3e5f45b)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore  major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore  minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore  ` will remove the ignore condition of the specified dependency and ignore conditions
ziemowit-orlikowski added a commit to Elmnt-Internal/download-artifact that referenced this pull request Jul 1, 2026
* docs: small migration fix

* Update MIGRATION.md

Fixing the broken link pointing to `actions/upload-artifact` content outside of the repository.

cc: @pedrolacerda

* Update artifact package to 2.2.2

* Bump artifact version, do digest check

* Refactor loop

* update dist

* Refactor loop, break for testing

* unbreak testing code

* Break the thing, also log the expected digest

* run release

* Make work as intended

* Update README.md

removing deprecation warning

* Bump artifact package

* Update artifact license

* Update artifact to 2.3.2

* Update dist

* Fix bug introduced in 4.2.0

* dist & package.json

* Add tests & test dependencies

* Lint

* Unfix error

* Configure tsconfig

* lint

* Add extra assertion to download single artifact test

* lint

* Run unit tests in CI

* Move log statements

* implement new `artifact-ids` input

* apply actions#401 (comment) suggestion

* when only one artifact-id is given, use `getArtifact` and check the resulting id returned

* bundle

* use the same `artifactClient.getArtifact` structure as seen above in `isSingleArtifactDownload` logic

* bundle

* revert `getArtifact()` changes - for now we have to list and filter by artifact-ids until a `getArtifactById()` public method exists

* add supporting unit tests for artifact downloads with ids

* Fix workflow example for downloading by artifact ID

* Remove path filters from Check dist workflow

* prep for v4.3.0 release

* Update README.md

* Update to Node.js 24 and related dependencies

Bump Node.js version to 24 in workflows, action definition, and package requirements. Update @types/node to 24.1.0 and add engines field to enforce Node.js >=24. This ensures compatibility with the latest Node.js features and ecosystem.

* fix download path logic when downloading a single artifact by id

* update docs

* bundle dist

* refactor: resolve download path correctly in artifact download tests (mainly for windows unit tests)

* Update README for download-artifact v5 changes

Updated documentation for download-artifact action to reflect changes in version 5.

* Update README.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Remove migration guide for artifact download changes

Readme probably should be less verbose since it's not a changelog.

* Update README with artifact extraction details

Clarified note on artifact extraction and GHES support.

* Readme: spell out the first use of GHES

* Update to use local artifact package v3.0.0

- Switch from @actions/artifact@^2.3.2 to file:../packages/artifact
- Add uri-js-replace security override
- Update @actions/github to v6.0.1 for security fixes
- Rebuild dist/index.js with updated dependencies
- Fix all security vulnerabilities (0 remaining)

* update licenses

* Update licensed configuration for new dependencies with Node 24 support

* Fix licensed configuration by ignoring packages with missing license text

* update

* Update licensed workflow to cache dependencies before status check

* Revert licensed workflow changes - keep original behavior

* update licences with temp not using package

* update dist

* Prepare `v6.0.0`

* Remove `github.dep.yml`

* Revert "Remove `github.dep.yml`"

This reverts commit bb3a066.

* Update GHES guidance to include reference to Node 20 version

* Fix typo in URL

* chore: use local @actions/artifact and @actions/core packages

* chore: update dependencies to use published npm packages

* chore: update @actions/artifact to use npm package v5.0.0

- Changed from file:../packages/artifact to 5.0.0
- Regenerated package-lock.json

* chore: regenerate license cache and fix @bufbuild/protobuf license

* chore: add minimatch.dep.yml license file

* chore: use local @actions/artifact package for Node.js 24 testing

This branch uses a local file reference to @actions/artifact which includes
the updated @azure/storage-blob ^12.29.1 to fix the punycode deprecation
warning on Node.js 24.

This is a test branch - do not merge until @actions/artifact@5.0.1 is published.

* fix: update @actions/artifact to ^5.0.0 for Node.js 24 punycode fix

Updates @actions/artifact dependency to use the published npm version
which includes @azure/storage-blob ^12.29.1 that fixes the punycode
deprecation warning on Node.js 24.

* chore: update package-lock.json with @actions/artifact@5.0.1

* chore: update @actions/artifact license file to 5.0.1

* chore: remove obsolete dependency license files

* chore: restore minimatch.dep.yml license file

* chore: release v7.0.0 for Node.js 24 support

- Update to Node.js 24 runtime (runs.using: node24)
- Bump version to 7.0.0
- Update README with v7 release notes
- Rebuild dist

* doc: update readme

* Update .gitignore

* Migrate eslint to `v9`

* Upgrade jest and typescript

* Don't attempt to un-zip non-zipped downloads

* Add tests

* Add an integration test for `skip-decompress`

* Update the integration test

* Cache licenses

* Updated the licensed version

* Revert "Updated the licensed version"

This reverts commit e6afc5e.

* Re-add minimatch.dep.yml

* Fixup the minimatch license

* Fix skip decompress test

* One more test fix

* Update test names to make it clearer what they do

* Bump the version to `v8` and add release notes

* Add note about package bumps

* Add a setting to specify what to do on hash mismatch and default it to `error`

* Fix linting issues

* Add change docs

* Add a regression test for artifact name + content-type mismatches (actions#472)

* Add a regression test for artifact name + content-type mismatches

* Specify that we want v4 in a comment

* Fix the expected type

* Add regression tests for CJK characters (actions#471)

* Add regression tests for CJK characters

* Dedupe the names and remove the ignored `name` param

* Bump @actions/artifact to v6.2.1

* Run `npm run release`

* Update licenses

* Update the readme (actions#473)

* Update the readme

* Update upload artifact versions

* Add back the GHES support note

* Update the skip-decompress description

* Be more specific with the direct download example

* Add GHES support section to TOC

---------

Co-authored-by: Francisco Robles Martรญn <f.robles.martin@pm.me>
Co-authored-by: Josh Gross <joshmgross@github.com>
Co-authored-by: Andy Feller <andyfeller@github.com>
Co-authored-by: Rob Herley <robherley@github.com>
Co-authored-by: Yang Cao <yacaovsnc@github.com>
Co-authored-by: Ryan Ghadimi <114221941+GhadimiR@users.noreply.github.com>
Co-authored-by: Larissa Fortuna <56982181+lkfortuna@users.noreply.github.com>
Co-authored-by: JoannaaKL <joannaakl@github.com>
Co-authored-by: Grant Birkinbine <grant.birkinbine@gmail.com>
Co-authored-by: Ben De St Paer-Gotch <nebuk89@github.com>
Co-authored-by: Salman Muin Kayser Chishti <salmanmkc@github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Daniel Kennedy <danwkennedy@github.com>
Co-authored-by: Patrik Polyak <patrikpolyak@github.com>
Co-authored-by: Zachary Taylor <zaataylor@github.com>
dbmikus pushed a commit to gofixpoint/amika that referenced this pull request Oct 23, 2026
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 8.0.2.

## Release notes

Sourced from actions/download-artifact's releases.

### v8.0.2

### What's Changed
- Update the readme by `@danwkennedy` in actions/download-artifact#473
- Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
- Update `@actions/artifact` to 6.3.1 by `@tunc-d` in actions/download-artifact#492
- Prepare download-artifact v8.0.2 by `@tunc-d` in actions/download-artifact#493

### New Contributors
- `@tunc-d` made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

### v8.0.1

### What's Changed
- Support for CJK characters in the artifact name by `@danwkennedy` in actions/download-artifact#471
- Add a regression test for artifact name + content-type mismatches by `@danwkennedy` in actions/download-artifact#472

Full Changelog: actions/download-artifact@v8...v8.0.1

### v8.0.0

### v8 - What's new

[!IMPORTANT]
actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT]
Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

### Direct downloads

To support direct uploads in `actions/upload-artifact`, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the `Content-Type` header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new `skip-decompress` parameter to `true`.

### Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the `digest-mismatch` parameter. To be secure by default, we are now defaulting the behavior to `error` which will fail the workflow run.

### ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

### What's Changed
- Don't attempt to un-zip non-zipped downloads by `@danwkennedy` in actions/download-artifact#460
- Add a setting to specify what to do on hash mismatch and default it to `error` by `@danwkennedy` in actions/download-artifact#461

Full Changelog: actions/download-artifact@v7...v8.0.0

### v7.0.0

### v7 - What's new

... (truncated)

## Commits
- `9000827` Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
- `e455989` Prepare download-artifact v8.0.2
- `a00b90c` Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
- `29bb7ce` Update `@actions/artifact` to 6.3.1
- `484a0b5` Update the readme (#473)
- `3e5f45b` Add regression tests for CJK characters (#471)
- `e6d03f6` Add a regression test for artifact name + content-type mismatches (#472)
- `70fc10c` Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
- `f258da9` Add change docs
- `ccc058e` Fix linting issues
- Additional commits viewable in compare view
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants