gh run download doesn't work as expected with name #11610

Activity

1. prousso

   added

   bugSomething isn't workingSomething isn't working

   on Aug 29, 2025
2. cliAutomation

   added

   needs-triageneeds to be reviewedneeds to be reviewed

   on Aug 29, 2025
3. babakks commented on Oct 9, 2025

   

   babakks

   on Oct 9, 2025

   Last edited by babakks

   Member

   More actions

   Thanks for the issue, @prousso! 🙏

   As you've already figured, this is due to the large number of artifacts and gh iterating over all of them. Note that the API endpoint that gh uses returns all artifacts regardless of their expiry.

   I looked into the code and have added notes about potential fix at the end. However, I don't think this is a bug, but rather this can be considered as an enhancement to run download. So, I'll relabel this and keep the issue open for internal team discussion. I'll update you here.

   A workaround for your situation is to directly call the API endpoint like this:

   gh api \
     '/repos/OWNER/REPO/actions/artifacts?name=my-artifact' \
     --jq '.artifacts.[] | select (.expired==false) | .archive_download_url'

   This will print the download URL for unexpired artifacts.

   Notes on potential implementation

   The API endpoint to fetch the list of artifacts supports a name query parameter to narrow down the lookup. One idea could be gh populating the name parameter if --name is provided. However, the gotcha is, unlike the --name option, the name query parameter does not support multiple values. So, if there are multiple names, gh has to repeat the API call per --name entries.

   I cannot say this is a good approach, but it's going to help with such situations.
4. babakks

   added

   enhancementa request to improve CLIa request to improve CLI

   gh-runrelating to the gh run commandrelating to the gh run command

   and removed

   bugSomething isn't workingSomething isn't working

   on Oct 9, 2025
5. github-actions commented on Oct 9, 2025

   

   github-actionsBot

   on Oct 9, 2025 – with GitHub Actions

   Contributor

   More actions

   Thank you for your issue! We have categorized it as a feature request, and it has been added to our backlog. In doing so, we are not committing to implementing this feature at this time, but, we will consider it for future releases based on community feedback and our own product roadmap.

   Unless you see the help wanted Contributions welcome label, we are not currently looking for external contributions for this feature.

   If you come across this issue and would like to see it implemented, please add a thumbs up! This will help us prioritize the feature. Please only comment if you have additional information or viewpoints to contribute.
6. codfish commented on Oct 15, 2025

   

   codfish

   on Oct 15, 2025

   More actions

   @babakks thanks for the workaround! might be a dumb question but how would we refactor your suggested workaround to actually download the artifact(s), like the original command of gh run download -n my-artifact is looking to do?

   you've got the artifact dload urls, assuming they are private, do we need to curl it with the GITHUB_TOKEN passed as a header? or is there a different suggested approach?
7. babakks commented on Oct 16, 2025

   

   babakks

   on Oct 16, 2025

   Member

   More actions

   No worries, and yeah, you can use curl with Authorization header and enabling follow redirects (-L).

   curl -L \
     -H "Authorization: Bearer $GITHUB_TOKEN" \
     --output artifact.zip
     <ARTIFACT-DOWNLOAD-URL>

   or, if you want to use gh to provide the token (helpful when running on local):

   curl -L \
     -H "Authorization: Bearer $(gh auth token --hostname github.com)" \
     --output artifact.zip
     <ARTIFACT-DOWNLOAD-URL>

   👍React with 👍1Reacted by Chris O'Donnell
8. codfish commented on Oct 16, 2025

   

   codfish

   on Oct 16, 2025

   Last edited by codfish

   More actions

   Thanks so much @babakks, working well. Saving about ~40s in total (16,333 artifacts in the repo I was benchmarking in).

   Just for posterity for anyone stumbling upon this issue, here was the full implementation in a github actions workflow environment:

   Context

   • We build and generate a bundle report named output.txt on merges to main.
   • This is uploaded as an artifact, with a name of build-output.
   • On PR's, we want to download that build report, and compare to the PR's build report to highlight any anomalies

   Implementation

   • My implementation only grabs the first non-expired url, not all of them, so take note of that difference in the jq query
   • Set the response to a variable so we can then pass to curl

   - name: Retrieve latest bundle stats
     shell: bash
     env:
       GH_TOKEN: ${{ github.token }}
     run: |
       artifact_download_url=$(gh api '/repos/${{ github.repository }}/actions/artifacts?name=build-output' --jq '.artifacts | map(select(.expired == false)) | .[0].archive_download_url')
       curl -L -H "Authorization: Bearer $GH_TOKEN" -o output.zip "$artifact_download_url"
       unzip -o output.zip
       # You're left with output.txt in the working directory. Delete the zip file if your heart desires.

   With error handling and logging

   - name: Retrieve latest main bundle stats
     shell: bash
     env:
       GH_TOKEN: ${{ github.token }}
     run: |
       set -e
   
       echo "Fetching latest build stats artifact from ${{ github.repository }}..."
       artifact_download_url=$(gh api '/repos/${{ github.repository }}/actions/artifacts?name=build-output' --jq '.artifacts | map(select(.expired == false)) | .[0].archive_download_url')
       if [ "$artifact_download_url" == "null" ] || [ -z "$artifact_download_url" ]; then
         echo "❌ Error: No valid build-output artifact found for ${{ github.repository }}"
         echo "This could mean:"
         echo "  - No previous builds have run on the main branch"
         echo "  - All artifacts have expired (artifacts expire after 90 days by default)"
         echo "  - The artifact name doesn't match 'build-output'"
         exit 1
       fi
   
       echo "Found artifact, downloading from: $artifact_download_url"
       # Use a temporary netrc file to avoid exposing token in process list
       NETRC_FILE=$(mktemp)
       trap "rm -f $NETRC_FILE" EXIT
       echo "machine api.github.com login token password $GH_TOKEN" > "$NETRC_FILE"
       chmod 600 "$NETRC_FILE"
   
       if ! curl -L --netrc-file "$NETRC_FILE" -o output.zip "$artifact_download_url"; then
         echo "❌ Error: Failed to download artifact"
         exit 1
       fi
   
       echo "Extracting artifact..."
       if ! unzip -o build-output.zip; then
         echo "❌ Error: Failed to extract artifact"
         exit 1
       fi

   👍React with 👍1Reacted by Babak K. Shandiz
9. babakks commented on Oct 17, 2025

   

   babakks

   on Oct 17, 2025

   Member

   More actions

   artifact_download_url=$(gh api '/repos/${{ github.repository }}/actions/artifacts?name=build-output' --jq '.artifacts | map(select(.expired == false)) | .[0].archive_download_url')

   Just beware that artifact_download_url can contain more than one URL (per unexpired artifacts).
10. codfish commented on Oct 17, 2025

    

    codfish

    on Oct 17, 2025

    More actions

    .[0].archive_download_url

    @babakks yes good call. I had to add the map around select and .[0] before the property in order to just always grab the latest one

    👍React with 👍1Reacted by Babak K. Shandiz
11. jsoref commented on Jan 7, 2026

    

    jsoref

    on Jan 7, 2026

    Contributor

    More actions

    • beware of gh run download doesn't download latest artifact from latest attempt #12437

    By default, this command downloads the latest artifact created and uploaded through GitHub Actions. Because workflows can delete or overwrite artifacts, <run-id> must be used to select an artifact from a specific workflow run.

    Appears to be really problematic documentation. It should at the very least call out that unless you use the run-id, potentially every artifact will be searched and this may be expensive (as it could conceivably run through your api quota).