Merge pull request #383 from GhadimiR/main

Bump artifact version, do digest check
Update dist
2026-09-09 12:44:22 +00:00 · 2025-03-18 16:31:00 +01:00 · 2025-03-18 15:23:08 +00:00 · 2025-03-18 15:21:17 +00:00 · 2025-03-18 13:23:53 +00:00 · 2025-03-18 11:57:35 +00:00
5 changed files with 436 additions and 59 deletions
@@ -1,6 +1,6 @@
 ---
 name: "@actions/artifact"
-version: 2.2.2
+version: 2.3.2
 type: npm
 summary: Actions artifact lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/artifact
@@ -1,15 +1,15 @@
 {
  "name": "download-artifact",
-  "version": "4.1.9",
+  "version": "4.2.0",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
    "": {
      "name": "download-artifact",
-      "version": "4.1.9",
+      "version": "4.2.0",
      "license": "MIT",
      "dependencies": {
-        "@actions/artifact": "^2.2.2",
+        "@actions/artifact": "^2.3.2",
        "@actions/core": "^1.10.1",
        "@actions/github": "^5.1.1",
        "minimatch": "^9.0.3"
@@ -36,9 +36,9 @@
      }
    },
    "node_modules/@actions/artifact": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-2.2.2.tgz",
-      "integrity": "sha512-UtS1kcINiPRkI3/hDKkO/XdrtKo89kn8s81J67QNBU6RRMWSSXrrfCCbQVThuxcdW2boOLv51NVCEKyo954A2A==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-2.3.2.tgz",
+      "integrity": "sha512-uX2Mr5KEPcwnzqa0Og9wOTEKIae6C/yx9P/m8bIglzCS5nZDkcQC/zRWjjoEsyVecL6oQpBx5BuqQj/yuVm0gw==",
      "dependencies": {
        "@actions/core": "^1.10.0",
        "@actions/github": "^5.1.1",
@@ -6032,9 +6032,9 @@
      "dev": true
    },
    "@actions/artifact": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-2.2.2.tgz",
-      "integrity": "sha512-UtS1kcINiPRkI3/hDKkO/XdrtKo89kn8s81J67QNBU6RRMWSSXrrfCCbQVThuxcdW2boOLv51NVCEKyo954A2A==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-2.3.2.tgz",
+      "integrity": "sha512-uX2Mr5KEPcwnzqa0Og9wOTEKIae6C/yx9P/m8bIglzCS5nZDkcQC/zRWjjoEsyVecL6oQpBx5BuqQj/yuVm0gw==",
      "requires": {
        "@actions/core": "^1.10.0",
        "@actions/github": "^5.1.1",
@@ -1,6 +1,6 @@
 {
  "name": "download-artifact",
-  "version": "4.1.9",
+  "version": "4.2.0",
  "description": "Download an Actions Artifact from a workflow run",
  "main": "dist/index.js",
  "scripts": {
@@ -28,7 +28,7 @@
  },
  "homepage": "https://github.com/actions/download-artifact#readme",
  "dependencies": {
-    "@actions/artifact": "^2.2.2",
+    "@actions/artifact": "^2.3.2",
    "@actions/core": "^1.10.1",
    "@actions/github": "^5.1.1",
    "minimatch": "^9.0.3"
@@ -106,29 +106,43 @@ async function run(): Promise<void> {
    core.info(`Preparing to download the following artifacts:`)
    artifacts.forEach(artifact => {
      core.info(
-        `- ${artifact.name} (ID: ${artifact.id}, Size: ${artifact.size})`
+        `- ${artifact.name} (ID: ${artifact.id}, Size: ${artifact.size}, Expected Digest: ${artifact.digest})`
      )
    })
  }

-  const downloadPromises = artifacts.map(artifact =>
-    artifactClient.downloadArtifact(artifact.id, {
+  const downloadPromises = artifacts.map(artifact => ({
+    name: artifact.name,
+    promise: artifactClient.downloadArtifact(artifact.id, {
      ...options,
      path:
        isSingleArtifactDownload || inputs.mergeMultiple
          ? resolvedPath
-          : path.join(resolvedPath, artifact.name)
+          : path.join(resolvedPath, artifact.name),
+      expectedHash: artifact.digest
    })
-  )
+  }))

  const chunkedPromises = chunk(downloadPromises, PARALLEL_DOWNLOADS)
  for (const chunk of chunkedPromises) {
-    await Promise.all(chunk)
-  }
+    const chunkPromises = chunk.map(item => item.promise)
+    const results = await Promise.all(chunkPromises)

-  core.info(`Total of ${artifacts.length} artifact(s) downloaded`)
-  core.setOutput(Outputs.DownloadPath, resolvedPath)
-  core.info('Download artifact has finished successfully')
+    for (let i = 0; i < results.length; i++) {
+      const outcome = results[i]
+      const artifactName = chunk[i].name
+
+      if (outcome.digestMismatch) {
+        core.warning(
+          `Artifact '${artifactName}' digest validation failed. Please verify the integrity of the artifact.`
+        )
+      }
+    }
+
+    core.info(`Total of ${artifacts.length} artifact(s) downloaded`)
+    core.setOutput(Outputs.DownloadPath, resolvedPath)
+    core.info('Download artifact has finished successfully')
+  }
 }

 run().catch(err =>
Author	SHA1	Message	Date
JoannaaKL	b14cf4c926	Merge pull request #383 from GhadimiR/main Bump artifact version, do digest check	2025-03-18 16:31:00 +01:00
Ryan Ghadimi	c5804ef743	Update dist	2025-03-18 15:23:08 +00:00
Ryan Ghadimi	956811a503	Update artifact to 2.3.2	2025-03-18 15:21:17 +00:00
Ryan Ghadimi	af3c6d3e5b	Update artifact license	2025-03-18 13:23:53 +00:00
Ryan Ghadimi	4dd97f8f21	Bump artifact package	2025-03-18 11:57:35 +00:00
Ryan Ghadimi	da9985dde6	Merge branch 'main' into main	2025-03-17 10:26:24 +00:00
Larissa Fortuna	81ba80daa4	Merge pull request #384 from actions/lkfortuna-patch-1 Update README.md	2025-03-13 08:12:46 -07:00
Ryan Ghadimi	56c2d7ea8c	Make work as intended	2025-03-12 16:21:59 +00:00
Ryan Ghadimi	7797bfcd59	run release	2025-03-12 16:20:09 +00:00
Ryan Ghadimi	9ff67cb2d2	Break the thing, also log the expected digest	2025-03-12 16:17:52 +00:00
Ryan Ghadimi	049eba1e9a	unbreak testing code	2025-03-12 16:04:02 +00:00
Ryan Ghadimi	503e7a18ae	Refactor loop, break for testing	2025-03-12 15:40:05 +00:00
Ryan Ghadimi	a8a786b097	update dist	2025-03-12 14:13:07 +00:00
Ryan Ghadimi	24aef17bbf	Refactor loop	2025-03-12 14:02:51 +00:00
Ryan Ghadimi	b81a615862	Bump artifact version, do digest check	2025-03-12 13:47:20 +00:00