Artifacts, Retention, Cross-Job Data, and Workflow Result Management: Diagnostics, Failure Modes, and Production Practices

1. Evidence-first diagnostic sequence

1. Preserve the run ID, attempt, event, ref/SHA and workflow revision.
2. Record the generated job graph and conclusions before rerun/cancellation changes them.
3. Record artifact list/IDs/names/digests/sizes/expiry for that run.
4. Confirm runner/image and exact pinned action SHAs.
5. Compare configured upload paths with pre-upload filesystem evidence.
6. Inspect download selection: name, ID, source run/repository and destination path.
7. Inspect sensitivity/hidden-file policy and whether any artifact should be quarantined/deleted.
8. Apply the narrowest fix, create a new run/attempt, and keep the original evidence.

2. Symptom → likely layer → evidence

3. Intentionally broken example: name-only selection finds no artifact

The producer uploads build-${{ github.run_id }}, while the consumer assumes the name is simply build. The download failure is not a runner or network problem; the selection contract is wrong.

# Producer
- id: upload
  uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
  with:
    name: build-${{ github.run_id }}
    path: dist/build.txt

# Broken consumer: wrong human name
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
  with:
    name: build
    path: ${{ runner.temp }}/incoming

Preserve the failed run and upload output. Repair the dataflow by promoting artifact-id to a job output and selecting artifact-ids in the consumer. This removes hidden coupling to naming convention.

# Repaired consumer selection
with:
  artifact-ids: ${{ needs.build.outputs.artifact_id }}
  path: ${{ runner.temp }}/incoming
  digest-mismatch: error

4. Sensitive artifact response is an incident, not a cosmetic bug

If a real credential or private key is uploaded, deleting the artifact is not sufficient. Assume authorized readers or automation may already have downloaded it. Preserve incident metadata, revoke/rotate the credential, inspect access/audit evidence where available, then remove the artifact and fix the workflow selection. Never publish the secret in a ticket or log “to prove” the leak.

5. Matrix collisions are evidence loss

Under current immutable artifact semantics, multiple matrix cells cannot all upload to the same artifact name as if appending. Give every cell a unique name, for example test-${{ matrix.os }}-${{ matrix.runtime }}-${{ github.run_id }}. If you want one combined object, use a downstream aggregation step after all cells complete.

6. Expiry is not transient failure

An expired artifact download can return Gone/404-like outcomes depending on interface. Retrying will not resurrect it. Check expired/expires_at and the repository retention policy. Rebuilding a release artifact merely to make the error disappear breaks provenance because the new bytes are produced by a new run; treat it as a new build with a new identity.

7. Read metadata before delete

GH_REPO='OWNER/gha-artifact-lab'
ARTIFACT_ID='123456789'
# Preserve metadata first
gh api -H 'X-GitHub-Api-Version: 2026-03-10'   "repos/$GH_REPO/actions/artifacts/$ARTIFACT_ID"   --jq '{id,name,size_in_bytes,digest,expired,created_at,expires_at,workflow_run}'

# Destructive cleanup only after evidence/authorization
# gh api --method DELETE .../actions/artifacts/$ARTIFACT_ID

Knowledge check

Official references and version notes

• GitHub Docs — Workflow artifacts — artifact purpose, cache distinction and attestation context.
• GitHub Docs — Store and share data with workflow artifacts — upload/download, retention, cross-job transfer and digest validation.
• GitHub REST API — Actions artifacts — artifact ID, size, digest, expiration, download and delete endpoints.
• actions/upload-artifact v7.0.1 — upload action pinned to 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a.
• actions/download-artifact v8.0.1 — download action pinned to 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c.
• GitHub Docs — Artifact attestations — signed provenance is separate from ordinary artifact storage/digest verification.