actions
[bug] download may silently fail download, but not fail action
What happened?
When downloading multiple artifacts, one of the file could fail to download, but not failing the action as a whole. The workflow then continues and can lead in inconsitent result due to silent failure and missing files.
What did you expect to happen?
If artifact fails to download, whole action must fail.
How can we reproduce it?
IDK
Anything else we need to know?
Snippet from GitHub Workflow:
....
push:
name: Push
runs-on: ubuntu-22.04
needs: [setup, build_test]
timeout-minutes: 20
steps:
- uses: actions/download-artifact@v4
with:
path: artifacts
- name: Podman Login to GitHub Container Registry
uses: redhat-actions/podman-login@v1
...
Snippet from logs attached, but same warning as in #381, maybe it's related.
2025-03-27T18:35:32.3300700Z (node:1475) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
2025-03-27T18:35:32.3305406Z (Use `node --trace-deprecation ...` to show where the warning was created)
What version of the action are you using?
v4.2.1
What are your runner environments?
linux
Are you on GitHub Enterprise Server? If so, what version?
No response
Hey, I'm currently experiencing the same issue with version 4. I haven't managed to find a concrete pattern in its behavior.
The artifacts that downloaded correctly seem to have the following lines at the end:
SHA256 digest of downloaded artifact is (sha here)
Artifact download completed successfully.
Total of 1 artifact(s) downloaded
Download artifact has finished successfully
While the artifacts that don't seem to have downloaded correctly lack these lines, ending with:
(node:25916) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
We're running into this as well and it seems that this issue was previously reported in #363. Alas no solution (or recognition of the issue) was added there.
We were affected by this issue as well. It appears to also be possible when only downloading a single artifact.
Successful download:
Downloading single artifact
Preparing to download the following artifacts:
- actions-cache (ID: [redacted], Size: 113180182, Expected Digest: sha256:[redacted])
Redirecting to blob download url: https://productionresultssa11.blob.core.windows.net/actions-results/[redacted]/artifacts/[redacted].zip
Starting download of artifact to: /home/runner/_work/[redacted]
(node:415) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
SHA256 digest of downloaded artifact is [redacted]
Artifact download completed successfully.
Total of 1 artifact(s) downloaded
Download artifact has finished successfully
Failed download (without workflow failure):
Downloading single artifact
Preparing to download the following artifacts:
- actions-cache (ID: [redacted], Size: 113180182, Expected Digest: sha256:[redacted])
Redirecting to blob download url: https://productionresultssa3.blob.core.windows.net/actions-results/[redacted]/artifacts/[redacted].zip
Starting download of artifact to: /home/runner/_work/[redacted]
(node:473) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
@patrick-rivos we just re-run our pipelines and it usually works fine the second time. Or you can download you artifact manually
In our workflow I replaced the GitHub action with the gh CLI which uses a different implementation than the action. That's been working flawlessly from our testing thus far.
- name: Download artifacts
run: gh run download --repo "$GITHUB_REPOSITORY" "$GITHUB_RUN_ID"
env:
GH_TOKEN: ${{ github.token }}
I also face the same issue. The actions/download-artifact@v4 fails to provide all files from the artifact zip. It just silently fails with some files missing. The sha matches. The files can be downloaded manually. The gh run download workaround works.
I am experiencing the same issue on specific self-hosted runners. Any workarounds (other than using gh)?
My suspicion is that the bug occurs when the self-hosted server has a slow or bad Internet connection. This happens more when the download takes longer than usual. One of the promises fails and then it stops all without returning an error status.
We just had this as well, also in a self-hosted runner, and with a single artifact:
Download fails:
Downloading single artifact
Preparing to download the following artifacts:
- fmod-project-build-16795056208 [redacted]
Redirecting to blob download url: [redacted]
Starting download of artifact to: /Users/effortstarbuild/runner/_work/[redacted]
(node:19985) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
The final success messages are never posted (nor any errors) and the task succeeds:
Thankfully after re-running failed jobs we see the expected result:
Downloading single artifact
Preparing to download the following artifacts:
- fmod-project-build-16795056208 [redacted]
Redirecting to blob download url: [redacted]
Starting download of artifact to: /Users/effortstarbuild/runner/_work/[redacted]
(node:23030) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
SHA256 digest of downloaded artifact is [redacted]
Artifact download completed successfully.
Total of 1 artifact(s) downloaded
Download artifact has finished successfully
This is also with v4.
- name: Download FMOD build
uses: actions/download-artifact@v4
with:
name: ${{ inputs.fmod_build_artifact_id }}
path: FmodProject/
Hi. We have faced the bug as well and have done some investigation. It seems like there is a problem with the retry logic - it does not retry the download if the stream of chunks ends after the defined timeout, and does not return any errors.
I've created a PR with a workaround in the actions/toolkit repo: the actions/download-artifact uses its download logic. You can check the PR's description for more information and logs.
Am I correct that we need a new drop of @actions/artifact to be released to pick up the change in this project?
Is this fixed in v6? I wasn't able to find it in the changelog.
