download-artifact-action

Download named build artifacts on Forgejo Actions runners from storage you control (S3-compatible or a directory), with no dependency on the GitHub artifact API or github.com. A drop-in port of actions/download-artifact.

Reads what rasterstate/upload-artifact-action writes. Same backend env (RASTER_ARTIFACTS_*).

Quick start

jobs:
  deploy:
    needs: build
    runs-on: [self-hosted, Linux]
    env:
      RASTER_ARTIFACTS_S3_BUCKET: ci-artifacts
      RASTER_ARTIFACTS_S3_ENDPOINT: https://fsn1.your-objectstorage.com
      RASTER_ARTIFACTS_S3_REGION: fsn1
      RASTER_ARTIFACTS_S3_ACCESS_KEY_ID: ${{ secrets.ARTIFACTS_KEY_ID }}
      RASTER_ARTIFACTS_S3_SECRET_ACCESS_KEY: ${{ secrets.ARTIFACTS_SECRET }}
    steps:
      - uses: https://rasterhub.com/rasterstate/download-artifact-action@v1
        with:
          name: dist
          path: build
      - run: ./deploy.sh build

Download every artifact for the run (one subdirectory per name):

- uses: https://rasterhub.com/rasterstate/download-artifact-action@v1
  with:
    path: artifacts

Inputs

Mirror actions/download-artifact@v4.

Input	Required	Default	Description
name	no		Artifact to download. If omitted, all artifacts for the run.
path	no	workspace	Destination directory.
pattern	no		Glob over artifact names when downloading multiple.
merge-multiple	no	false	Extract all into path instead of per-name subdirectories.
run-id	no	current run	Download from another workflow run.
repository	no	current repo	Download from another repository (needs backend access to that scope).

Outputs

Output	Description
download-path	Absolute path where artifacts were extracted.

Behavior

• A named download extracts directly into path.
• Downloading all artifacts extracts each into path/<name> (or all into path with merge-multiple).
• A named artifact that is not found is a hard error. A pattern that matches nothing is a warning.
• The action requires the JSON metadata sidecar written on upload to find each artifact's object, compression method, and recorded sha256 digest. Artifacts without that sidecar fail closed and are not downloaded.
• Before extracting, the downloaded archive's sha256 is checked against the digest recorded by the upload action. A mismatch, missing digest, empty digest, or unrecognized digest fails the step and nothing is extracted.
• Every tar entry is validated before a byte is written: path traversal (..), absolute paths, symlinks/hardlinks whose target escapes the download path, and special files (devices, fifos) are refused, and the whole archive is rejected if any entry is unsafe. setuid/setgid bits are stripped from the files and directories that are extracted.
• Extraction is capped against decompression bombs: the summed uncompressed size and the entry count are bounded (defaults 10 GiB and 100000). Override with RASTER_ARTIFACTS_MAX_TOTAL_BYTES and RASTER_ARTIFACTS_MAX_ENTRIES; set either to 0 to disable that cap.

Backend configuration

Identical to the upload action: RASTER_ARTIFACTS_* (or AWS_* for credentials). See the upload action README for the full table. Point both at the same bucket and prefix.

Examples

See examples/workflows: consume in a dependent job, download all, matrix, and cross-run.

Migrating from actions/download-artifact

See MIGRATION.md.

License

MIT. See LICENSE.