Conversation
There was a problem hiding this comment.
Pull request overview
This pull request adds support for direct file uploads without archiving by introducing a new archive input parameter. When set to false, users can upload a single file directly without creating a zip archive. The implementation upgrades the @actions/artifact package from v6.1.0 to v6.2.0 to leverage the new skipArchive option.
Changes:
- Added new
archiveboolean input (defaults totruefor backward compatibility) - Implemented validation to ensure only a single file can be uploaded when
archiveisfalse - Updated package dependency to
@actions/artifactv6.2.0 to support theskipArchiveoption
Reviewed changes
Copilot reviewed 7 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/upload/upload-inputs.ts | Added archive boolean field to UploadInputs interface with documentation |
| src/upload/constants.ts | Added Archive constant to the Inputs enum |
| src/upload/input-helper.ts | Added input retrieval for the archive parameter and included it in the returned inputs object |
| src/upload/upload-artifact.ts | Added validation for single-file requirement when archive is false and sets skipArchive option accordingly |
| action.yml | Added archive input parameter with description and default value of 'true', updated name and path descriptions |
| package.json | Updated @actions/artifact dependency from ^6.1.0 to ^6.2.0 |
| package-lock.json | Updated lockfile to reflect the new artifact package version |
| dist/upload/index.js | Compiled distribution file reflecting all source changes |
| tests/upload.test.ts | Added Archive input to mock inputs default configuration |
Comments suppressed due to low confidence (1)
src/upload/upload-artifact.ts:79
- When archive is set to false, the compression-level option becomes irrelevant since no compression occurs. However, there's no validation or warning to inform users that setting compression-level has no effect when archive is false. Consider adding validation to either ignore or warn users about this incompatible configuration.
if (typeof inputs.compressionLevel !== 'undefined') {
options.compressionLevel = inputs.compressionLevel
}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| needs: [build, merge] | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Node 24 | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 24.x | ||
| cache: 'npm' | ||
|
|
||
| - name: Install dependencies | ||
| run: npm ci | ||
|
|
||
| - name: Delete test artifacts | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| const artifactClient = require('@actions/artifact'); | ||
| const artifact = artifactClient.default || artifactClient; | ||
|
|
||
| const {artifacts} = await artifact.listArtifacts({latest: true}); | ||
| const keep = ['report.html']; | ||
|
|
||
| for (const a of artifacts) { | ||
| if (keep.includes(a.name)) { | ||
| console.log(`Keeping artifact '${a.name}'`); | ||
| continue; | ||
| } | ||
| try { | ||
| await artifact.deleteArtifact(a.name); | ||
| console.log(`Deleted artifact '${a.name}'`); | ||
| } catch (err) { | ||
| console.log(`Could not delete artifact '${a.name}': ${err.message}`); | ||
| } | ||
| } | ||
|
|
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 1 day ago
In general, the fix is to add an explicit permissions: block that grants only the minimum scopes needed to run this workflow. This can be done at the workflow (top) level to apply to all jobs, or specifically on the cleanup job if different jobs need different scopes. Since the highlighted issue is on the cleanup job, and we want the smallest change without affecting other jobs’ current behavior, we will add a permissions: block only to the cleanup job.
The cleanup job reads and deletes artifacts via the @actions/artifact client. Artifact operations are governed by the actions permission, not contents. There is no need for contents: write, issues, pull-requests, etc. A minimal and appropriate configuration is:
permissions:
actions: write
contents: readactions: write allows managing artifacts created by workflows; contents: read is a safe baseline and recommended as a default read-only scope. We will insert this directly under runs-on: ubuntu-latest in the cleanup job, around line 392, in .github/workflows/test.yml. No imports or additional methods are required because this is purely a YAML configuration change.
| @@ -389,6 +389,9 @@ | ||
| name: Cleanup Artifacts | ||
| needs: [build, merge] | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| actions: write | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Checkout |
There was a problem hiding this comment.
Set the permissions block.
Description
This adds support for uploading a file directly without zipping it.
Callers will need to opt into this change by setting the new
archiveflag tofalse(to maintain backwards compatibility, the flag defaults totrueright now). Only a single file can be uploaded right now. If the action detects multiple files, it will error.Breaking changes
7so we're bumping the version of this client to match versions.