Eliminate setup-time `@actions/artifact` install by inlining required artifact client features by Copilot · Pull Request #38684 · github/gh-aw

Copilot · 2026-06-11T17:40:40Z

This change removes the setup action’s runtime dependency on @actions/artifact by reimplementing the specific artifact operations used in this repo. The setup flow no longer installs npm packages at runtime to support artifact upload/download/list paths.

What changed
- Added actions/setup/js/artifact_client.cjs with an internal DefaultArtifactClient implementing:
  - artifact listing via Actions REST API
  - artifact download via Actions redirect + blob fetch
  - artifact upload via Results Twirp (CreateArtifact/FinalizeArtifact) + signed blob upload
- Switched existing consumers to the internal client:
  - actions/setup/js/upload_artifact.cjs
  - actions/setup/js/check_daily_aic_workflow_guardrail.cjs
Setup action integration cleanup
- Removed runtime @actions/artifact installation logic from actions/setup/setup.sh.
- Removed SAFE_OUTPUT_ARTIFACT_CLIENT env wiring from actions/setup/index.js.
- Kept action input compatibility but marked safe-output-artifact-client as deprecated no-op in actions/setup/action.yml.
Dependency surface reduction
- Removed @actions/artifact from actions/setup/js/package.json and lockfile.

// Before: dynamic npm dependency at runtimeconst{ DefaultArtifactClient }=awaitimport("@actions/artifact");// After: repo-local implementationconst{ DefaultArtifactClient }=require("./artifact_client.cjs");

Changeset

Type: patch
Description: Removed the setup-time @actions/artifact install by inlining the artifact client features needed for upload, download, and listing.

Generated by 📋 Changeset Generator for issue #38684 · 7.82 AIC · ⊞ 21.8K · ◷

✨ PR Review Safe Output Test - Run 27369159684

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · 87.6 AIC · ⌖ 33 AIC · ◷

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

This PR removes the setup action’s runtime dependency on @actions/artifact by introducing a repo-local artifact client and switching existing safe-output consumers to use it, eliminating setup-time npm installs and reducing the dependency surface of actions/setup/js.

Changes:

Added actions/setup/js/artifact_client.cjs implementing artifact list/download via GitHub REST and upload via Results Twirp + signed blob upload.
Updated upload_artifact.cjs and check_daily_aic_workflow_guardrail.cjs to use the internal DefaultArtifactClient.
Removed the setup-time @actions/artifact install path and deprecated the related action input as a no-op; removed @actions/artifact from package.json/lockfile.

Show a summary per file

File	Description
actions/setup/setup.sh	Removes setup-time `@actions/artifact` installation logic and related input wiring.
actions/setup/js/upload_artifact.cjs	Switches artifact uploads from `@actions/artifact` to the internal client.
actions/setup/js/check_daily_aic_workflow_guardrail.cjs	Switches artifact listing/downloading to the internal client.
actions/setup/js/artifact_client.cjs	New internal artifact client implementing list/download/upload operations.
actions/setup/index.js	Removes env propagation for the deprecated artifact-client flag.
actions/setup/action.yml	Keeps input compatibility while marking `safe-output-artifact-client` as deprecated no-op.
actions/setup/js/package.json	Removes `@actions/artifact` dependency.
actions/setup/js/package-lock.json	Removes `@actions/artifact` (and transitive) lockfile entries.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files not reviewed (1)

actions/setup/js/package-lock.json: Language not supported

Files reviewed: 7/8 changed files
Comments generated: 4

+ if (options.skipArchive) {
+ if (files.length !== 1) {
+ throw new Error("skipArchive option is only supported when uploading a single file");
+ }
+ uploadPath = files[0];
+ artifactName = path.basename(uploadPath);
+ contentType = "application/octet-stream";
+ } else {


+ if (redirectResponse.status !== 302) {
+ throw new Error(`unable to download artifact: unexpected status ${redirectResponse.status}`);
+ }


+ const uploadSize = await uploadFileToSignedURL(uploadPath, createResponse.signed_upload_url, contentType);
+ const sha256 = crypto.createHash("sha256").update(fs.readFileSync(uploadPath)).digest("hex");
+


+class DefaultArtifactClient {
+ async listArtifacts(options = {}) {
+ const findBy = options.findBy;
+ if (!findBy?.token || !findBy?.repositoryOwner || !findBy?.repositoryName || !findBy?.workflowRunId) {
+ throw new Error("listArtifacts requires findBy.token, findBy.repositoryOwner, findBy.repositoryName, and findBy.workflowRunId");
+ }
+


github-actions · 2026-06-11T18:05:18Z

Hey @Copilot 👋 — great work inlining the artifact client logic and cutting the @actions/artifact runtime install! Removing 1,747 lines from the lockfile is a meaningful dependency surface reduction, and the PR description clearly explains the before/after.

One thing that would strengthen this before merge:

Add tests for artifact_client.cjs — the new file is 375 lines covering three distinct code paths (list, download via redirect + blob fetch, and upload via Twirp CreateArtifact/FinalizeArtifact + signed blob PUT). These paths involve HTTP interactions that are straightforward to unit-test with mocked fetch responses. Without tests, regressions in the artifact API flow would be silent.

If you'd like a hand, you can assign this prompt to your coding agent:

Add unit tests for actions/setup/js/artifact_client.cjs.
Cover the following scenarios using mocked fetch (e.g. with jest or a lightweight node test runner already used in this project):
1. listArtifacts — mock a successful Actions REST API response and assert the returned artifact list matches.
2. downloadArtifact — mock a 302 redirect response followed by a successful blob fetch and assert the file is written correctly.
3. uploadArtifact — mock CreateArtifact Twirp response, the signed blob PUT, and FinalizeArtifact, then assert the artifact ID is returned.
4. Error paths — assert that a non-2xx response from any step throws or rejects with a descriptive error.
Use only test tooling already present in the repo (check actions/setup/js/package.json for existing devDependencies).

Generated by ✅ Contribution Check · 287.3 AIC · ⌖ 12.9 AIC · ⊞ 24.7K · ◷

pelikhan · 2026-06-11T18:08:14Z

@copilot run pr-finisher skill

…t codes, stream SHA-256, add tests Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-11T18:26:26Z

@copilot run pr-finisher skill

Addressed all four review findings in commit Fix artifact client: preserve name on skipArchive, accept all redirect codes, stream SHA-256, add tests:

skipArchive name overwrite — removed artifactName = path.basename(uploadPath) so the caller-provided name is always used.
Redirect status codes — replaced the !== 302 check with ![301, 302, 303, 307, 308].includes(...) to accept all standard redirect codes.
SHA-256 memory usage — replaced fs.readFileSync with a streaming hashFile() helper that pipes through a crypto.Hash transform, avoiding loading the full file into memory.
Unit tests — added artifact_client.test.cjs with 13 tests covering listArtifacts (REST pagination, latest dedup, error), downloadArtifact (missing findBy, non-redirect rejection, all five redirect codes, missing location), and uploadArtifact (empty files, skipArchive multi-file, name preservation vs basename, non-skipArchive name).

github-actions · 2026-06-11T18:37:48Z

🚀 Smoke AntigravityMISSION COMPLETE! Antigravity has spoken. ✨

github-actions · 2026-06-11T18:37:59Z

🚀 Smoke PiMISSION COMPLETE! Pi delivered. 🥧

github-actions · 2026-06-11T18:38:16Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-06-11T18:38:19Z

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

github-actions · 2026-06-11T18:38:21Z

⚠️Smoke Gemini failed. Gemini encountered unexpected challenges...

github-actions · 2026-06-11T18:38:50Z

🎬 THE END — Smoke ClaudeMISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-06-11T18:39:10Z

📰 BREAKING: Smoke Copilot - AOAI (apikey) is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-06-11T18:39:11Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-06-11T18:41:08Z

Commit pushed: 334e623

Generated by Changeset Generator · 7.82 AIC · ⊞ 21.8K

github-actions · 2026-06-11T18:44:35Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.54.0
jq	✅	1.7
yq	✅	v4.53.3
curl	✅	8.5.0
gh	✅	2.93.0
node	✅	v22.22.3
python3	✅	3.11.15 (PyPy 7.3.23)
go	✅	1.24.13
java	✅	21.0.11 (Temurin)
dotnet	✅	10.0.300

Result: 12/12 tools available ✅

Overall Status: PASS

🔧 Tool validation by Agent Container Smoke Test · 41.7 AIC · ⌖ 13.3 AIC · ◷

github-actions · 2026-06-11T18:47:31Z

Eliminate setup-time @actions/artifact install by inlining required artifact client features
PASS: 7 | FAIL: 0 | SKIP: 2
✅ Serena, Playwright, build, file, bash, memory
⚪ web-fetch, issue-field
Overall: PASS

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex · 36.4 AIC · ⌖ 4.14 AIC · ◷

github-actions · 2026-06-11T18:49:55Z

💥 Smoke Test: Claude — Run 27369159684

Core #1-12: ✅✅✅✅✅✅✅✅✅✅✅✅
PR Review #13-19: ✅ Update ✅ Comments ✅ Submit ✅ Resolve ✅ Reviewer ✅ Push ⚠️ Close(skipped)

Overall: PARTIAL (1 skipped, 0 failed) — Claude engine nominal! 🚀

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · 87.6 AIC · ⌖ 33 AIC · ◷

github-actions

💥 Automated smoke test review - all systems nominal!

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"

See Network Configuration for more information.

💥 [THE END] — Illustrated by Smoke Claude · 87.6 AIC · ⌖ 33 AIC

github-actions · 2026-06-11T18:49:58Z

+ workflowRunBackendId: ids[1],
+ workflowJobRunBackendId: ids[2],
+ };
+ }


💥 Smoke test: nice work inlining the artifact client! Consider a brief comment documenting the expected redirect behavior here.

github-actions · 2026-06-11T18:49:58Z

+ }
+ }
+
+ throw lastError || new Error(`artifact twirp ${method} failed`);


💥 Smoke test: streaming SHA-256 looks solid — worth a unit test asserting hash on empty input too.

github-actions · 2026-06-11T18:52:39Z

PR: Eliminate setup-time @actions/artifact install by inlining required artifact client features
1✅ 2✅ 3✅ 4✅ 5✅
6✅ 7✅ 8✅ 9✅ 10✅
11✅ 12✅ 13✅ 14✅ 15✅
PASS. Author: @app/copilot-swe-agent. Assignees: @pelikhan@Copilot.

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
safebrowsingohttpgateway.googleapis.com
www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · 188.9 AIC · ⌖ 16.1 AIC · ◷

github-actions · 2026-06-11T19:14:06Z

@copilot review all comments and address unresolved review feedback. Please refresh the branch and rerun checks once that is done.

Generated by 👨‍🍳 PR Sous Chef · 65.7 AIC · ⌖ 1.82 AIC · ⊞ 17.3K · ◷

Reimplement setup artifact client without npm install
2a13ffd
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

CopilotAI assigned Copilot and pelikhan Jun 11, 2026

CopilotAI changed the title ~~Reimplement setup artifact client without npm install~~Eliminate setup-time @actions/artifact install by inlining required artifact client featuresJun 11, 2026

Copilotcreated this pull request from a session on behalf of pelikhan June 11, 2026 17:41 View session

Copilotfinished work on behalf of pelikhan June 11, 2026 17:41

CopilotAI requested a review from pelikhan June 11, 2026 17:41

pelikhan marked this pull request as ready for review June 11, 2026 17:49

CopilotAI review requested due to automatic review settings June 11, 2026 17:49

Copilotstarted reviewing on behalf of pelikhan June 11, 2026 17:49 View session

CopilotAI reviewed Jun 11, 2026
View reviewed changes

Merge branch 'main' into copilot/remove-actions-artifacts-installation
66a7949

Copilotstarted work on behalf of pelikhan June 11, 2026 18:09 View session

Fix artifact client: preserve name on skipArchive, accept all redirec…
1e673ae
…t codes, stream SHA-256, add tests Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilotfinished work on behalf of pelikhan June 11, 2026 18:26

pelikhan added the smoke label Jun 11, 2026

github-actionsBot mentioned this pull request Jun 11, 2026
[aw] Smoke Antigravity produced no safe outputs #38691
Closed

Add changeset
334e623

github-actionsBot mentioned this pull request Jun 11, 2026
[aw] Smoke Pi produced no safe outputs #38693
Closed

github-actionsBot added the smoked label Jun 11, 2026

github-actionsBot mentioned this pull request Jun 11, 2026
Smoke Test: Claude - 27369159684 #38698
Closed

github-actionsBot added the smoke-claude label Jun 11, 2026

github-actionsBot reviewed Jun 11, 2026
View reviewed changes

This was referenced Jun 11, 2026
Smoke Test: Copilot - 27369249383 #38702
Closed
[aw] Smoke Copilot - AOAI (apikey) failed #38703
Closed

github-actionsBot mentioned this pull request Jun 11, 2026
[PR Triage Report] PR Triage Report — 2026-06-11 (Run §27371175049) #38709
Closed

pelikhan merged commit 69a8ed7 into mainJun 11, 2026
12 of 14 checks passed

pelikhan deleted the copilot/remove-actions-artifacts-installation branch June 11, 2026 20:10

This was referenced Jun 12, 2026
[aw] No-Op Runs #38739
Closed
[PR Triage Report] PR Triage Report - 2026-06-12 #38765
Closed

github-actionsBot mentioned this pull request Aug 18, 2026
🚨 [SECURITY] 🚨 Security Red Team Findings - 2026-08-18 #53853
Closed
12 tasks

CopilotAI mentioned this pull request Aug 19, 2026
Harden post-agent cache Git commits #53879
Merged

		const uploadSize = await uploadFileToSignedURL(uploadPath, createResponse.signed_upload_url, contentType);
		const sha256 = crypto.createHash("sha256").update(fs.readFileSync(uploadPath)).digest("hex");

Uh oh!

Conversation

CopilotAI commented Jun 11, 2026• edited by github-actions BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changeset

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

github-actionsBot commented Jun 11, 2026

Uh oh!

pelikhan commented Jun 11, 2026

Uh oh!

CopilotAI commented Jun 11, 2026

Uh oh!

github-actionsBot commented Jun 11, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Jun 11, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Jun 11, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Jun 11, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Jun 11, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Jun 11, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Jun 11, 2026

Uh oh!

github-actionsBot commented Jun 11, 2026

Uh oh!

github-actionsBot commented Jun 11, 2026

Uh oh!

github-actionsBot commented Jun 11, 2026

Agent Container Tool Check

Uh oh!

github-actionsBot commented Jun 11, 2026

Uh oh!

github-actionsBot commented Jun 11, 2026

💥 Smoke Test: Claude — Run 27369159684

Uh oh!

github-actionsBot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actionsBotJun 11, 2026

Choose a reason for hiding this comment

Uh oh!

github-actionsBotJun 11, 2026

Choose a reason for hiding this comment

Uh oh!

github-actionsBot commented Jun 11, 2026

Uh oh!

github-actionsBot commented Jun 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

CopilotAI commented Jun 11, 2026•
edited by github-actions Bot
Loading

github-actionsBot commented Jun 11, 2026•
edited
Loading

github-actionsBot commented Jun 11, 2026•
edited
Loading

github-actionsBot commented Jun 11, 2026•
edited
Loading

github-actionsBot commented Jun 11, 2026•
edited
Loading

github-actionsBot commented Jun 11, 2026•
edited
Loading

github-actionsBot commented Jun 11, 2026•
edited
Loading