Support direct file uploads by danwkennedy · Pull Request #764 · actions/upload-artifact

danwkennedy · 2026-02-25T19:10:08Z

Description

This adds support for uploading a file directly without zipping it.

Callers will need to opt into this change by setting the new archive flag to false (to maintain backwards compatibility, the flag defaults to true right now). Only a single file can be uploaded right now. If the action detects multiple files, it will error.

Breaking changes

We're supporting a new API version, version 7 so we're bumping the version of this client to match versions.

Copilot

Pull request overview

This pull request adds support for direct file uploads without archiving by introducing a new archive input parameter. When set to false, users can upload a single file directly without creating a zip archive. The implementation upgrades the @actions/artifact package from v6.1.0 to v6.2.0 to leverage the new skipArchive option.

Changes:

Added new archive boolean input (defaults to true for backward compatibility)
Implemented validation to ensure only a single file can be uploaded when archive is false
Updated package dependency to @actions/artifact v6.2.0 to support the skipArchive option

Reviewed changes

Copilot reviewed 7 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/upload/upload-inputs.ts	Added `archive` boolean field to UploadInputs interface with documentation
src/upload/constants.ts	Added `Archive` constant to the Inputs enum
src/upload/input-helper.ts	Added input retrieval for the archive parameter and included it in the returned inputs object
src/upload/upload-artifact.ts	Added validation for single-file requirement when archive is false and sets skipArchive option accordingly
action.yml	Added archive input parameter with description and default value of 'true', updated name and path descriptions
package.json	Updated `@actions/artifact` dependency from ^6.1.0 to ^6.2.0
package-lock.json	Updated lockfile to reflect the new artifact package version
dist/upload/index.js	Compiled distribution file reflecting all source changes
tests/upload.test.ts	Added Archive input to mock inputs default configuration

Comments suppressed due to low confidence (1)

src/upload/upload-artifact.ts:79

When archive is set to false, the compression-level option becomes irrelevant since no compression occurs. However, there's no validation or warning to inform users that setting compression-level has no effect when archive is false. Consider adding validation to either ignore or warn users about this incompatible configuration.

    if (typeof inputs.compressionLevel !== 'undefined') {
      options.compressionLevel = inputs.compressionLevel
    }

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

action.yml

__tests__/upload.test.ts

danwkennedy · 2026-02-25T20:30:47Z

.github/workflows/test.yml

+    needs: [build, merge]
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Setup Node 24
+      uses: actions/setup-node@v4
+      with:
+        node-version: 24.x
+        cache: 'npm'
+
+    - name: Install dependencies
+      run: npm ci
+
+    - name: Delete test artifacts
+      uses: actions/github-script@v7
+      with:
+        script: |
+          const artifactClient = require('@actions/artifact');
+          const artifact = artifactClient.default || artifactClient;
+
+          const {artifacts} = await artifact.listArtifacts({latest: true});
+          const keep = ['report.html'];
+
+          for (const a of artifacts) {
+            if (keep.includes(a.name)) {
+              console.log(`Keeping artifact '${a.name}'`);
+              continue;
+            }
+            try {
+              await artifact.deleteArtifact(a.name);
+              console.log(`Deleted artifact '${a.name}'`);
+            } catch (err) {
+              console.log(`Could not delete artifact '${a.name}': ${err.message}`);
+            }
+          }
+


In general, the fix is to add an explicit permissions: block that grants only the minimum scopes needed to run this workflow. This can be done at the workflow (top) level to apply to all jobs, or specifically on the cleanup job if different jobs need different scopes. Since the highlighted issue is on the cleanup job, and we want the smallest change without affecting other jobs’ current behavior, we will add a permissions: block only to the cleanup job.

The cleanup job reads and deletes artifacts via the @actions/artifact client. Artifact operations are governed by the actions permission, not contents. There is no need for contents: write, issues, pull-requests, etc. A minimal and appropriate configuration is:

permissions: actions: write contents: read

actions: write allows managing artifacts created by workflows; contents: read is a safe baseline and recommended as a default read-only scope. We will insert this directly under runs-on: ubuntu-latest in the cleanup job, around line 392, in .github/workflows/test.yml. No imports or additional methods are required because this is purely a YAML configuration change.

Set the permissions block.

Moumouls · 2026-03-01T19:35:20Z

@danwkennedy, you’re a lifesaver!

Bumps actions/upload-artifact from 6 to 7. ## Release notes Sourced from actions/upload-artifact's releases. v7.0.0 v7 What's new Direct Uploads Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file. ESM To support new versions of the @actions/* packages, we've upgraded the package to ESM. What's Changed Add proxy integration test by @Link- in actions/upload-artifact#754 Upgrade the module to ESM and bump dependencies by @danwkennedy in actions/upload-artifact#762 Support direct file uploads by @danwkennedy in actions/upload-artifact#764 New Contributors @Link- made their first contribution in actions/upload-artifact#754 Full Changelog: actions/upload-artifact@v6...v7.0.0 ## Commits bbbca2d Support direct file uploads (#764) 589182c Upgrade the module to ESM and bump dependencies (#762) 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests 02a8460 Add proxy integration test See full diff in compare view ![Dependabot compatibility score](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Signed-off-by: dependabot[bot] <support@github.com> Change-Id: Ia2e29e951761b7cd74c86c9469ca502af2b566f6 GitHub-PR: #4131 GitHub-Hash: ec81e01b2a1da5f9 Signed-off-by: fdio.github <releng+fdio-github@linuxfoundation.org>

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0. Release notes *Sourced from [actions/upload-artifact's releases](https://github.com/actions/upload-artifact/releases).* > v7.0.0 > ------ > > v7 What's new > ------------- > > ### Direct Uploads > > Adds support for uploading single files directly (unzipped). Callers can set the new `archive` parameter to `false` to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The `name` parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file. > > ### ESM > > To support new versions of the `@actions/*` packages, we've upgraded the package to ESM. > > What's Changed > -------------- > > * Add proxy integration test by [`@Link`](https://github.com/Link)- in [actions/upload-artifact#754](https://redirect.github.com/actions/upload-artifact/pull/754) > * Upgrade the module to ESM and bump dependencies by [`@danwkennedy`](https://github.com/danwkennedy) in [actions/upload-artifact#762](https://redirect.github.com/actions/upload-artifact/pull/762) > * Support direct file uploads by [`@danwkennedy`](https://github.com/danwkennedy) in [actions/upload-artifact#764](https://redirect.github.com/actions/upload-artifact/pull/764) > > New Contributors > ---------------- > > * [`@Link`](https://github.com/Link)- made their first contribution in [actions/upload-artifact#754](https://redirect.github.com/actions/upload-artifact/pull/754) > > **Full Changelog**: <actions/upload-artifact@v6...v7.0.0> Commits * [`bbbca2d`](actions/upload-artifact@bbbca2d) Support direct file uploads ([#764](https://redirect.github.com/actions/upload-artifact/issues/764)) * [`589182c`](actions/upload-artifact@589182c) Upgrade the module to ESM and bump dependencies ([#762](https://redirect.github.com/actions/upload-artifact/issues/762)) * [`47309c9`](actions/upload-artifact@47309c9) Merge pull request [#754](https://redirect.github.com/actions/upload-artifact/issues/754) from actions/Link-/add-proxy-integration-tests * [`02a8460`](actions/upload-artifact@02a8460) Add proxy integration test * See full diff in [compare view](actions/upload-artifact@b7c566a...bbbca2d) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/upload-artifact&package-manager=github\_actions&previous-version=6.0.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps actions/upload-artifact from 6 to 7. ## Release notes Sourced from actions/upload-artifact's releases. v7.0.0 v7 What's new Direct Uploads Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file. ESM To support new versions of the @actions/* packages, we've upgraded the package to ESM. What's Changed Add proxy integration test by @Link- in actions/upload-artifact#754 Upgrade the module to ESM and bump dependencies by @danwkennedy in actions/upload-artifact#762 Support direct file uploads by @danwkennedy in actions/upload-artifact#764 New Contributors @Link- made their first contribution in actions/upload-artifact#754 Full Changelog: actions/upload-artifact@v6...v7.0.0 ## Commits bbbca2d Support direct file uploads (#764) 589182c Upgrade the module to ESM and bump dependencies (#762) 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests 02a8460 Add proxy integration test See full diff in compare view ![Dependabot compatibility score](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Signed-off-by: dependabot[bot] <support@github.com> Change-Id: Ia2e29e951761b7cd74c86c9469ca502af2b566f6 GitHub-PR: #4131 GitHub-Hash: ec81e01b2a1da5f9 Signed-off-by: fdio.github <releng+fdio-github@linuxfoundation.org>

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0. Release notes *Sourced from [actions/upload-artifact's releases](https://github.com/actions/upload-artifact/releases).* > v7.0.0 > ------ > > v7 What's new > ------------- > > ### Direct Uploads > > Adds support for uploading single files directly (unzipped). Callers can set the new `archive` parameter to `false` to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The `name` parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file. > > ### ESM > > To support new versions of the `@actions/*` packages, we've upgraded the package to ESM. > > What's Changed > -------------- > > * Add proxy integration test by [`@Link`](https://github.com/Link)- in [actions/upload-artifact#754](https://redirect.github.com/actions/upload-artifact/pull/754) > * Upgrade the module to ESM and bump dependencies by [`@danwkennedy`](https://github.com/danwkennedy) in [actions/upload-artifact#762](https://redirect.github.com/actions/upload-artifact/pull/762) > * Support direct file uploads by [`@danwkennedy`](https://github.com/danwkennedy) in [actions/upload-artifact#764](https://redirect.github.com/actions/upload-artifact/pull/764) > > New Contributors > ---------------- > > * [`@Link`](https://github.com/Link)- made their first contribution in [actions/upload-artifact#754](https://redirect.github.com/actions/upload-artifact/pull/754) > > **Full Changelog**: <actions/upload-artifact@v6...v7.0.0> Commits * [`bbbca2d`](actions/upload-artifact@bbbca2d) Support direct file uploads ([#764](https://redirect.github.com/actions/upload-artifact/issues/764)) * [`589182c`](actions/upload-artifact@589182c) Upgrade the module to ESM and bump dependencies ([#762](https://redirect.github.com/actions/upload-artifact/issues/762)) * [`47309c9`](actions/upload-artifact@47309c9) Merge pull request [#754](https://redirect.github.com/actions/upload-artifact/issues/754) from actions/Link-/add-proxy-integration-tests * [`02a8460`](actions/upload-artifact@02a8460) Add proxy integration test * See full diff in [compare view](actions/upload-artifact@b7c566a...bbbca2d) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/upload-artifact&package-manager=github\_actions&previous-version=6.0.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

danwkennedy added 5 commits February 25, 2026 14:08

Cache licenses

9c47937

Bump minimatch to 10.1.1

e785baf

Try fixing licenced issues

c6ec997

More licensed fixes

4177a10

Support direct file uploads

6b68470

Copilot AI review requested due to automatic review settings February 25, 2026 19:10

danwkennedy requested a review from a team as a code owner February 25, 2026 19:10

Copilot started reviewing on behalf of danwkennedy February 25, 2026 19:10 View session

Copilot AI reviewed Feb 25, 2026

View reviewed changes

action.yml Outdated Show resolved Hide resolved

__tests__/upload.test.ts Show resolved Hide resolved

danwkennedy added 3 commits February 25, 2026 14:18

Add CI tests for direct uploads

ffeab76

Use download-artifact@main temporarily

15af323

CI: clean up artifacts on successful runs

428074b

github-advanced-security bot found potential problems Feb 25, 2026

View reviewed changes

danwkennedy added 4 commits February 25, 2026 15:19

Use script v8

bdabba3

Fix some issues with the cleanup

3a2b6d4

Add unit tests

518025b

Clarify naming

d5c7bee

yacaovsnc approved these changes Feb 25, 2026

View reviewed changes

danwkennedy merged commit bbbca2d into main Feb 25, 2026
12 checks passed

dpy013 mentioned this pull request Feb 25, 2026

Add ability to use GitHub Actions to build NVDA nvaccess/nvda#10516

Closed

mrbusche mentioned this pull request Feb 27, 2026

[feat req] Non-zip artifacts #426

Open

github-actions bot mentioned this pull request Feb 27, 2026

Bump actions/upload-artifact from 6 to 7 senzing-factory/build-resources#266

Merged

This was referenced Mar 2, 2026

Use direct file uploads (archive: false) for Allure reports in all test workflows ShaftHQ/SHAFT_ENGINE#2277

Merged

feat: Handle non-zipped artifacts from upload-artifact@v7 (archive: false) wdconinc/action-download-artifact#1

Open

zaher899z-hub mentioned this pull request Mar 7, 2026

## Workflow does not contain permissions zaher899z-hub/Zaher-Mohamed-#6

Closed

This was referenced Mar 2, 2026

Use direct file uploads (archive: false) for Allure reports in all test workflows ShaftHQ/SHAFT_ENGINE#2277

Merged

feat: Handle non-zipped artifacts from upload-artifact@v7 (archive: false) wdconinc/action-download-artifact#1

Open

zaher899z-hub mentioned this pull request Mar 7, 2026

## Workflow does not contain permissions zaher899z-hub/Zaher-Mohamed-#6

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support direct file uploads#764

Support direct file uploads#764
danwkennedy merged 12 commits intomainfrom
danwkennedy/direct-uploads

danwkennedy commented Feb 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Check warning

Copilot Autofix

danwkennedy Feb 25, 2026

Uh oh!

Uh oh!

Moumouls commented Mar 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

@@ -389,6 +389,9 @@
                 name: Cleanup Artifacts
                 needs: [build, merge]
                 runs-on: ubuntu-latest
+                permissions:
+                  actions: write
+                  contents: read
                 steps:
                 - name: Checkout

Conversation

danwkennedy commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Breaking changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Check warning

Copilot Autofix

danwkennedy Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Moumouls commented Mar 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

danwkennedy commented Feb 25, 2026 •

edited

Loading