Support direct file uploads

[danwkennedy]

Description

This adds support for uploading a file directly without zipping it.

Callers will need to opt into this change by setting the new archive flag to false (to maintain backwards compatibility, the flag defaults to true right now). Only a single file can be uploaded right now. If the action detects multiple files, it will error.

Breaking changes

• We're supporting a new API version, version 7 so we're bumping the version of this client to match versions.

[Copilot]

Pull request overview

This pull request adds support for direct file uploads without archiving by introducing a new archive input parameter. When set to false, users can upload a single file directly without creating a zip archive. The implementation upgrades the @actions/artifact package from v6.1.0 to v6.2.0 to leverage the new skipArchive option.

Changes:

• Added new archive boolean input (defaults to true for backward compatibility)
• Implemented validation to ensure only a single file can be uploaded when archive is false
• Updated package dependency to @actions/artifact v6.2.0 to support the skipArchive option

Reviewed changes

Copilot reviewed 7 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/upload/upload-inputs.ts	Added archive boolean field to UploadInputs interface with documentation
src/upload/constants.ts	Added Archive constant to the Inputs enum
src/upload/input-helper.ts	Added input retrieval for the archive parameter and included it in the returned inputs object
src/upload/upload-artifact.ts	Added validation for single-file requirement when archive is false and sets skipArchive option accordingly
action.yml	Added archive input parameter with description and default value of 'true', updated name and path descriptions
package.json	Updated @actions/artifact dependency from ^6.1.0 to ^6.2.0
package-lock.json	Updated lockfile to reflect the new artifact package version
dist/upload/index.js	Compiled distribution file reflecting all source changes
tests/upload.test.ts	Added Archive input to mock inputs default configuration

Comments suppressed due to low confidence (1)

src/upload/upload-artifact.ts:79

• When archive is set to false, the compression-level option becomes irrelevant since no compression occurs. However, there's no validation or warning to inform users that setting compression-level has no effect when archive is false. Consider adding validation to either ignore or warn users about this incompatible configuration.

    if (typeof inputs.compressionLevel !== 'undefined') {
      options.compressionLevel = inputs.compressionLevel
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

In general, the fix is to add an explicit permissions: block that grants only the minimum scopes needed to run this workflow. This can be done at the workflow (top) level to apply to all jobs, or specifically on the cleanup job if different jobs need different scopes. Since the highlighted issue is on the cleanup job, and we want the smallest change without affecting other jobs’ current behavior, we will add a permissions: block only to the cleanup job.

The cleanup job reads and deletes artifacts via the @actions/artifact client. Artifact operations are governed by the actions permission, not contents. There is no need for contents: write, issues, pull-requests, etc. A minimal and appropriate configuration is:

    permissions:
      actions: write
      contents: read

actions: write allows managing artifacts created by workflows; contents: read is a safe baseline and recommended as a default read-only scope. We will insert this directly under runs-on: ubuntu-latest in the cleanup job, around line 392, in .github/workflows/test.yml. No imports or additional methods are required because this is purely a YAML configuration change.

[danwkennedy]

Set the permissions block.

[Moumouls]

@danwkennedy, you’re a lifesaver!

[Ickerday]

Genuinely curious - why isn't this action pinned to its commit SHA?

[danwkennedy]

These two actions are intertwined quite a bit. Keeping this test's reference relative helps smoke test
somewhat.