[bug] v4: Cannot download artifact using REST API

[Pythonic-Rainbow]

What happened?

v4 changes the storage backend. Unfortunately this seems to also break the REST API for downloading artifacts.

I followed the official REST doc and it works perfectly fine for v3.

Related to #500

What did you expect to happen?

Able to download the artifact

How can we reproduce it?

Try to download an artifact using the REST API.

I extracted a part of the script I used and uploaded it to a test repo

Anything else we need to know?

No response

What version of the action are you using?

v4

What are your runner environments?

linux

Are you on GitHub Enterprise Server? If so, what version?

No response

[pdconant]

Not sure if this is the same issue, but I've seen that artifacts uploaded with actions/upload-artifact@v4 aren't cannot be downloaded by the GHA workflow that uploaded the artifact. More details (including a sample GHA workflow illustrating the problem) are available in this comment on the actions/download-artifact repo: https://github.com/actions/download-artifact/issues/290#issuecomment-1935024240

[Pythonic-Rainbow]

@pdconant I've finally solved my problem: My HTTP client. As this is not related to the workflow I'll close this issue now.

So recently I used a HTTP endpoint debugger "Insomnia" to try downloading an artifact uploaded with v4 and to my surprise, it works. Upon investigation I realised that the entire process consists of 3 steps:

1. Insomnia sends a GET request to the artifact download url (https://api.github.com/xxx) with the following header {"Authorization": "Bearer <GITHUB_PERSONAL_ACCESS_TOKEN>"}
2. api.github.com returns a HTTP 302 response, asking Insomnia to redirect to the actual download url from Microsoft Azure (https://productionresultssa4.blob.core.windows.net)
3. Insomnia sends a GET request to the Azure url without the bearer token, and Azure streams the artifact to Insomnia.

My script uses Python's built-in urllib module. For some reason during step 3, it sends a GET with the bearer token. So I've manually captured the redirect url and send another GET without the token by myself. Now it works!