Fix upload_artifact silently succeeding when relative paths are never staged by Copilot · Pull Request #61431 · github/gh-aw

Copilot · 2026-09-16T23:19:02Z

upload_artifact returned {"result":"success"} for relative (non-absolute) paths without ever verifying the file existed, so a workflow could reference a file that was never copied into the staging directory — no safe-outputs-upload-artifacts artifact was produced, and every downstream signal claimed success.

Root cause

uploadArtifactHandler in actions/setup/js/safe_outputs_handlers.cjs only validated and staged absolute paths. Relative paths — including the "workspace-relative" form documented in the tool's own JSON schema — were passed through untouched on the assumption the agent had already staged them, with no existence check performed.

Fix

Resolve relative paths in order: check the staging directory first (pass-through, unchanged), then fall back to resolving against GITHUB_WORKSPACE and copying into staging — reusing the same symlink/sensitive-path/canonical-root checks already applied to absolute paths.
Fail loudly on unresolvable paths: throw a validation error (file not found: ...) instead of recording the item and returning success when the path can't be found anywhere.
Behavior now mirrors the existing uploadCodeCoverageHandler, which already implemented this resolution logic for the analogous upload_code_coverage tool.

// before: relative path passed through with no check
if (typeof entry.path === "string" && path.isAbsolute(entry.path)) {
  /* stage + validate absolute path */
}
// relative path -> appendSafeOutputCounted(entry) unconditionally

// after: relative path resolved against staging, then workspace, or rejected
if (typeof entry.path === "string") {
  let filePath = entry.path;
  if (!path.isAbsolute(filePath)) {
    const stagedCandidate = path.resolve(stagingDir, filePath);
    if (fs.existsSync(stagedCandidate)) filePath = stagedCandidate;
    else if (process.env.GITHUB_WORKSPACE) filePath = path.resolve(process.env.GITHUB_WORKSPACE, filePath);
    else throw { code: -32602, message: `${ERR_VALIDATION}: upload_artifact: file not found: ...` };
  }
  if (!fs.existsSync(filePath)) throw { code: -32602, message: `${ERR_VALIDATION}: upload_artifact: file not found: ${filePath}` };
  /* stage + validate as before */
}

Tests

Updated safe_outputs_handlers.test.cjs: replaced the test that asserted the old (buggy) silent-success behavior with cases covering already-staged relative paths, missing relative paths (with/without GITHUB_WORKSPACE), and workspace-relative auto-copy into staging.

Fixes upload-artifact reports success but produces no artifact (v0.88.7) #60383

pr-sous-chef
Run URL: https://github.com/github/gh-aw/actions/runs/35168512171

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 20.9 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/35174719104

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 54.4 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

🟡 Changes recommended

Absolute pre-staged paths remain job-specific, and unrelated action-pin downgrades must be reverted.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Fixes silent upload_artifact success by resolving and validating relative paths before staging.

Changes:

Resolves relative paths from staging or GITHUB_WORKSPACE.
Adds regression tests for staged, missing, and workspace-relative paths.
Also introduces unrelated Docker action-pin downgrades.

File summaries

File	Description
`actions/setup/js/safe_outputs_handlers.cjs`	Adds relative-path resolution and validation.
`actions/setup/js/safe_outputs_handlers.test.cjs`	Tests the new resolution behavior.
`.github/aw/actions-lock.json`	Downgrades two Docker action pins.
`pkg/actionpins/data/action_pins.json`	Mirrors the pin downgrades.
`pkg/workflow/data/action_pins.json`	Mirrors the pin downgrades.

Review details

Suppressed comments (3)

pkg/workflow/data/action_pins.json:139

This unrelated change downgrades the valid docker/setup-buildx-action pin from v4.4.0 to v4.3.0, contrary to the repository's no-downgrade behavior (pkg/cli/update_actions_lockfile_test.go:252-315). Restore v4.4.0 and sync the generated pin catalogs.

    "docker/setup-buildx-action@v4.3.0": {
      "repo": "docker/setup-buildx-action",
      "version": "v4.3.0",
      "sha": "37fe631027851001ddb9b187196cc803df7f5f0e"

pkg/actionpins/data/action_pins.json:139

This generated package copy also replaces the valid v4.4.0 pin with v4.3.0 even though the PR is scoped to artifact path staging. Restore the newer pin when syncing from .github/aw/actions-lock.json.

    "docker/setup-buildx-action@v4.3.0": {
      "repo": "docker/setup-buildx-action",
      "version": "v4.3.0",
      "sha": "37fe631027851001ddb9b187196cc803df7f5f0e"

.github/aw/actions-lock.json:139

The canonical lock file is being downgraded from the valid v4.4.0 tag to v4.3.0, which is unrelated to the artifact-handler fix and propagates into both embedded catalogs during builds. Restore v4.4.0 here before syncing generated copies.

    "docker/setup-buildx-action@v4.3.0": {
      "repo": "docker/setup-buildx-action",
      "version": "v4.3.0",
      "sha": "37fe631027851001ddb9b187196cc803df7f5f0e"

Files reviewed: 5/5 changed files
Comments generated: 4
Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

+    "docker/build-push-action@v7.3.0": {
      "repo": "docker/build-push-action",
-      "version": "v7.4.0",
-      "sha": "c3c9e263c25d99ce0380d002d59b67737d91b0dc"
+      "version": "v7.3.0",
+      "sha": "53b7df96c91f9c12dcc8a07bcb9ccacbed38856a"


+        // Rewrite to staging-relative path so upload_artifact.cjs resolves it from staging.
+        entry.path = destName;


+    "docker/build-push-action@v7.3.0": {
      "repo": "docker/build-push-action",
-      "version": "v7.4.0",
-      "sha": "c3c9e263c25d99ce0380d002d59b67737d91b0dc"
+      "version": "v7.3.0",
+      "sha": "53b7df96c91f9c12dcc8a07bcb9ccacbed38856a"


+    "docker/build-push-action@v7.3.0": {
      "repo": "docker/build-push-action",
-      "version": "v7.4.0",
-      "sha": "c3c9e263c25d99ce0380d002d59b67737d91b0dc"
+      "version": "v7.3.0",
+      "sha": "53b7df96c91f9c12dcc8a07bcb9ccacbed38856a"


gh-aw-bot · 2026-09-17T01:01:58Z

pr-sous-chef
@copilot this PR still needs forward progress before a maintainer can investigate quickly. Please address the current blocking review feedback, revert or justify the unrelated action-pin downgrades, fix the failing checks below, refresh the branch if needed, and then run the pr-finisher skill.

Failed checks:

build-wasm: https://github.com/github/gh-aw/actions/runs/35163247583/job/105031001818
Unit tests (S-Z and other): https://github.com/github/gh-aw/actions/runs/35163247583/job/105031190317

Latest blocking review points:

absolute pre-staged paths still remain job-specific
restore the unrelated docker action-pin downgrades from the lock/catalog files

Run URL: https://github.com/github/gh-aw/actions/runs/35168512171

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 20.9 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-09-17T01:23:03Z

pr-sous-chef
@copilot this PR still needs forward progress before a maintainer can investigate quickly. Please address the current blocking review feedback, revert or justify the unrelated action-pi...

Addressed in 1b237a8 and follow-ups through c4dbd75: absolute pre-staged paths are now normalized to portable staging-relative paths, the staging-root edge case is rejected, regression coverage includes nested staged paths, and all unrelated Docker pin/catalog/workflow-lock changes are restored. make test-wasm-golden, make test, make recompile, targeted JS tests (276 passing), make lint, and final pre-push validation passed; final code review and CodeQL validation reported no findings.

gh-aw-bot · 2026-09-17T02:39:56Z

@copilot this PR still needs forward progress before a maintainer can investigate quickly. The branch already includes follow-up fixes responding to the earlier review, so please request a fresh Copilot review, refresh the branch if needed, and then run the pr-finisher skill.

Previously raised review points that should be re-evaluated:

portable handling for absolute pre-staged paths
restoration of unrelated Docker action-pin downgrades

Run URL: https://github.com/github/gh-aw/actions/runs/35174719104

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 54.4 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-17T02:59:16Z

@copilot this PR still needs forward progress before a maintainer can investigate quickly. The branch already includes follow-up fixes responding to the earlier review, so please request a fresh Copil...

Current branch head dbfa4a6 is refreshed onto main, and the prior review points remain addressed: absolute pre-staged artifact paths normalize to staging-relative paths, and the Docker action pins/catalogs are restored to v7.4.0/v4.4.0. Local PR-finisher validation passed (make fmt, make lint, make test-unit, make test, make recompile); the validation tool found no unsubmitted local changes to review.

github-actions · 2026-09-19T03:47:47Z

🎉 This pull request is included in a new release.

Release: v0.89.17

Initial plan

0d19136

Copilot AI assigned Copilot and pelikhan Sep 16, 2026

Copilot started work on behalf of pelikhan September 16, 2026 23:31

View session

Copilot AI linked an issue Sep 16, 2026 that may be closed by this pull request

upload-artifact reports success but produces no artifact (v0.88.7) #60383

Closed

Fix upload_artifact silently succeeding for non-existent relative paths

0d62826

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix upload-artifact to produce the expected artifact~~ Fix upload_artifact silently succeeding when relative paths are never staged Sep 16, 2026

Copilot finished work on behalf of pelikhan September 16, 2026 23:39

Copilot AI requested a review from pelikhan September 16, 2026 23:39

pelikhan marked this pull request as ready for review September 17, 2026 00:36

Copilot AI balanced review requested due to automatic review settings September 17, 2026 00:36

Copilot started reviewing on behalf of pelikhan September 17, 2026 00:36

View session

Copilot AI reviewed Sep 17, 2026

View reviewed changes

github-actions Bot mentioned this pull request Sep 17, 2026

[pr-sous-chef] PR Sous Chef run report #61445

Closed

Copilot started work on behalf of gh-aw-bot September 17, 2026 01:02

View session

Copilot AI and others added 5 commits September 17, 2026 01:07

Record review remediation plan

285d91f

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Address artifact staging review feedback

1b237a8

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Reject staging root artifact paths

d604365

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Normalize staged artifact separators

5141074

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Clarify nested artifact normalization

c4dbd75

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot September 17, 2026 01:23

Copilot AI requested a review from gh-aw-bot September 17, 2026 01:23

Merge branch 'main' into copilot/fix-upload-artifact-issue-v0887

dbfa4a6

Copilot started work on behalf of gh-aw-bot September 17, 2026 02:44

View session

Copilot finished work on behalf of gh-aw-bot September 17, 2026 02:59

pelikhan merged commit 9073417 into main Sep 17, 2026
12 checks passed

pelikhan deleted the copilot/fix-upload-artifact-issue-v0887 branch September 17, 2026 04:26

github-actions Bot mentioned this pull request Sep 20, 2026

Suggested test: copilot/upload-artifact-relative-path-staging githubnext/gh-aw-test#16875

Closed

Navigation Menu

Repository navigation

Fix upload_artifact silently succeeding when relative paths are never staged - #61431

Fix upload_artifact silently succeeding when relative paths are never staged#61431
pelikhan merged 8 commits into
mainfrom
copilot/fix-upload-artifact-issue-v0887

Copilot AI commented Sep 16, 2026 •

edited by github-actions Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		// Rewrite to staging-relative path so upload_artifact.cjs resolves it from staging.
		entry.path = destName;

Conversation

Copilot AI commented Sep 16, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Root cause

Fix

Tests

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (3)

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

gh-aw-bot commented Sep 17, 2026

Uh oh!

Copilot AI commented Sep 17, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Sep 16, 2026 •

edited by github-actions Bot

Loading