It is a little bit unclear about the direction that you intended here. I definitely see some workarounds:

• Create a release and use the sha as tag. Don't like this approach since this will create a release of every build and mess up the releases.
• Use the package registry maybe? Can't do this right now since we don't have access

Maybe we are doing something completely wrong, and that is fine since it is quite new :). With that said, if we can't access the artifacts we have to revert to circle ci for the build and use github actions only for deploy.

@chrispat for feedback

This could also be relevant for build caching.

And also for diffing artifacts between master and a pull request. There are hundreds of apps that do this for visual/webpage diffs, but none I can find that can diff a simple text file artifact.

In addition to this: How to do this cross repositories?

Also we would like to limit the download to certain branches (Using somewhat the same logic as what TeamCity uses with their artifact dependencies), for example we can use the build output of one repository master, in another repository (creating a master build from several smaller projects). Preferably this would use the same branch if possible, or fallback to the default branch if possible.

I'm very excited for this feature. I want to build and upload artifacts from a fork PR, and this part works well already. Fork PRs run without access to secrets, so in a second GitHub Action workflow that runs with access to secrets (outside of the fork PR), I want to download artifacts from GitHub and upload them to another service (BinTray). I had this arrangement working using CircleCI. This missing feature is blocking me from migrating from CircleCI to GitHub Actions, so I'm very keen to see it implemented!

H, @ethomson! I work with @MikeMcQuaid on Homebrew. He told me that you may be a good person to give this issue some 👀. See also the related issue actions/upload-artifact#21 (comment).

Same use case as OP here. Any progress on this? 🙏 It would be really helpful to access an artifact uploaded from a build-workflow in a deploy-workflow. Especially since the cache action doesn't support deployment events: actions/cache#63. Otherwise the cache could probably have been used with e.g. "artifact-name-$GITHUB_SHA" even though it's kind of a hack.

@mikkelbd we now have an api for downloading artifactshttps://developer.github.com/v3/actions/artifacts/#download-an-artifact so you could likely accomplish your scenario now.

@chrispat, I believe that @mikkelbd, as me and probably many others, is expecting this action to support the feature. In the end, if we are all forced to write custom scripts that interact with the API, all the "Actions" infrastructure is useless. This is specially unfortunate because GitHub's CI service as a product seems to be severely biased towards Actions.

@chrispat Thank you for the prompt response 👏 Artifacts being available in the API is a good start. Combined with https://github.com/octokit/request-action or https://github.com/actions/github-script one could probably download it without writing custom code. However, it seems that you would have to know the internal artifact_id of the artifact, or you would have to list all artifacts and then filter by name? Again, then you would have to know the run_id that uploaded the artifact? I guess that's pretty hard in another workflow run...

As @eine stated, it would be a much better experience if the download-artifact action supported this out of the box instead of forcing n developers to interact with the GitHub API and also making the workflow-file bloated with low-level stuff 😅

we now have an api for downloading artifactshttps://developer.github.com/v3/actions/artifacts/#download-an-artifact so you could likely accomplish your scenario now.

@chrispat Is there an API to get all the workflow runs for a given pull request or commit SHA-1? I found this API list-workflow-runs to list all the runs for a given repo and workflow, and that could then be filtered to find the SHA1 of the commit that you're interested in, but not terribly efficient.

https://developer.github.com/v3/actions/workflow_runs/#list-workflow-runs

We don't currently have that parameter to the API but I will add it to our feedback list to consider for the future.

pr="$(echo '${{github.event.head_commit.message}}' | sed 's/^.*#\([0-9]*\).*/\1/;q')"
git -C "$(brew --repo ${{github.repository}})" fetch origin "pull/$pr/head:pr"
sha1="$(git -C "$(brew --repo ${{github.repository}})" rev-parse pr)"
echo pr="$pr" sha1="$sha1"
run_id=$(curl -s -H 'Accept: application/vnd.github.antiope-preview+json' https://api.github.com/repos/${{github.repository}}/actions/workflows/build-bottles.yml/runs \
  | jq ".workflow_runs[] | select(.head_sha == \"$sha1\").id")
artifact_id="$(curl -s -H 'Accept: application/vnd.github.antiope-preview+json' https://api.github.com/repos/${{github.repository}}/actions/runs/$run_id/artifacts \
  | jq '.artifacts[0].id')"
echo run_id="$run_id" artifact_id="$artifact_id"
curl -L -o bottles.zip "https://${{secrets.GITHUB_PAT}}@api.github.com/repos/${{github.repository}}/actions/artifacts/$artifact_id/zip"

https://github.com/brewsci/homebrew-bio/blob/master/.github/workflows/upload-bottles.yml
I've successfully used the new workflows and artifacts endpoints to download the artifact of given PR number in a push event! Yeah! Any comments or suggestions to make this easier would be welcome.

Are artifacts of a public repo public, and why is a GITHUB_PAT needed to download an artifact? GITHUB_TOKEN wasn't sufficient.

I found the same oddity. It seems like downloading artifacts requires "admin" permissions instead of "read" permissions (as documented).

It would really be great if this would be a standard feature of this official GitHub action. Is there any progress on this?

I found the same oddity. It seems like downloading artifacts requires "admin" permissions instead of "read" permissions (as documented).

Is this reported somewhere? If not, where would be the ideal place to report it?

It would be great if we'd be able to access builds from other repos in our org through this action.
Is that planned at all?

It would be great if we'd be able to access builds from other repos in our org through this action.
Is that planned at all?

This action doesn't do that yet, but you can do it with curl

see: https://github.com/RedHatInsights/policies-ui-frontend/blob/master/.github/scripts/download-latest-openapi.sh#L23

You need to pass the token in the workflow for it to work correctly:
https://github.com/RedHatInsights/policies-ui-frontend/blob/master/.github/workflows/OpenAPIInSync.yml#L24

I was just trying to figure out why I can't store an artifact in a workflow run, and download it in the next run, and that's why ? How is that not implemented ? this sounds like a crazy common use case to me, either to detect differences or reuse some build artifacts...

Would cache be more useful ? https://github.com/actions/cache I struggled to store a simple SARIF file and resorted to using upload artifact...

That is what I use the above-mentioned gist for. Compare changes in test coverage from different workflow runs.

Using the Github API it is fairly straightforward to find previously-stored artifacts. You can use octokit.rest.actions.listArtifactsForRepo and octokit.rest.actions.downloadArtifact

@suecharo's snippet doesn't even require you to write a custom action for it.

Yeah the problem with the gh run download cli is that it's not available on self hosted runners, the container image doesn't have it and I tried downloading the binary manually, I think I'm almost there but there is a remaining issue (probably caused bc the cli expects to be inside a repository, so I need to checkout...)

In the meantime, this custom action allows to download artifacts created in a different workflow.

Just noting that Github has an example using github-script of downloading artifacts from another workflow in: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

@jszwedko but how to get the value of run_id: ${{github.event.<workflow_run>.id }}?

Because in order to get artifacts we need to specify the run_id of the previous workflow1 (which uploads the artifacts) and need to download the uploaded artifacts (by id) say in worfklow2

I tried almost every possible way but can't make it run.

Just noting that Github has an example using github-script of downloading artifacts from another workflow in: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

@jszwedko but how to get the value of run_id: ${{github.event.<workflow_run>.id }}?

Because in order to get artifacts we need to specify the run_id of the previous workflow1 (which uploads the artifacts) and need to download the uploaded artifacts (by id) say in worfklow2

I tried almost every possible way but can't make it run.

maybe actions/github-script#262 (comment) will help you?

Funny that we have to refer to 3rd parties for this. So many people would benefit from it.

Just noting that Github has an example using github-script of downloading artifacts from another workflow in: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

@jszwedko but how to get the value of run_id: ${{github.event.<workflow_run>.id }}?
Because in order to get artifacts we need to specify the run_id of the previous workflow1 (which uploads the artifacts) and need to download the uploaded artifacts (by id) say in worfklow2
I tried almost every possible way but can't make it run.

maybe actions/github-script#262 (comment) will help you?

Yup, this is what I'm using rn, works well.

You can use context.payload.workflow_run.id inside an action script to get the triggering workflow run id.
See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow.

Is there any reason this hasn't been implemented yet? It seems like something that should be included, considering things like actions/checkout support specifying things like a repository just fine.

It looks like dawidd6/action-download-artifact will work just fine for getting this to all work, but having this work with a first-party action would definitely be ideal.

action-download-artifact doesn't download the last artifact the workflow, so you might end up using a custom script like we do:
firezone/firezone#2665

If you are not running self hosted runners (which may not have gh CLI), you can use a step such as the following to download an artifact across workflows.

  - name: Download artifact
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    run: |
      gh run download --name my-artifact --dir ${{ github.workspace }}

gh is available on all GitHub-hosted runners https://docs.github.com/en/actions/using-workflows/using-github-cli-in-workflows.

With v4 this is now supported! It's also possible to download artifacts from other repositories 🎉 https://github.com/actions/download-artifact?tab=readme-ov-file#download-artifacts-from-other-workflow-runs-or-repositories

Recommend folks switch over to v4, a host of other improvements as well. https://github.blog/changelog/2023-12-14-github-actions-artifacts-v4-is-now-generally-available/

You will need to supply a PAT to download artifacts from other runs or repositories just FYI. GITHUB_TOKEN is only scoped to a single run so you will have to supply that to the action.

The options are not as extensive as some third party solutions like https://github.com/dawidd6/action-download-artifact but at least a basic version of this feature is officially supported