gh run download doesn't download latest artifact from latest attempt #12437

Activity

1. adangel

   added

   bugSomething isn't workingSomething isn't working

   on Jan 7, 2026
2. cliAutomation

   added

   needs-triageneeds to be reviewedneeds to be reviewed

   on Jan 7, 2026
3. jsoref commented on Jan 7, 2026

   

   jsoref

   on Jan 7, 2026

   Contributor

   More actions

   I came here to file this. My guess is that github changed the sort order of the endpoint.

   Note that the workaround will almost certainly fail if you do enough reruns to trigger pagination, or if your jobs generate lots of artifacts.
4. jsoref commented on Jan 7, 2026

   

   jsoref

   on Jan 7, 2026

   Contributor

   More actions

   Fwiw, afaict the array limit is 30 which means that if you have more than 30 artifacts in the results, you're going to hit pagination:

   $ gh api '/repos/check-spelling-sandbox/MeshCore/actions/runs/20750207409/artifacts?name=check-spelling-comment' > x &&
      jq '.total_count' x &&
      jq '.artifacts |length' x
   295
   30
5. jsoref commented on Jan 7, 2026

   

   jsoref

   on Jan 7, 2026

   Contributor

   More actions

   In fact, it's much better (for my use case at least) to ask for per_page=1:

   jsoref@jsoref-mbp ~ % GH_DEBUG=api gh api 'https://api.github.com/repositories/1128664294/actions/runs/20750207409/artifacts?name=check-spelling-comment&per_page=1' > a
   
   * Request at 2026-01-07 13:14:46.65526 -0500 EST m=+0.058269001
   * Request to https://api.github.com/repositories/1128664294/actions/runs/20750207409/artifacts?name=check-spelling-comment&per_page=1
   > GET /repositories/1128664294/actions/runs/20750207409/artifacts?name=check-spelling-comment&per_page=1 HTTP/1.1
   > Host: api.github.com
   > Accept: */*
   > Authorization: token ████████████████████
   > Content-Type: application/json; charset=utf-8
   > Time-Zone: America/Toronto
   > User-Agent: GitHub CLI 2.83.2
   
   < HTTP/2.0 200 OK
   < Access-Control-Allow-Origin: *
   < Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
   < Cache-Control: private, max-age=60, s-maxage=60
   < Content-Security-Policy: default-src 'none'
   < Content-Type: application/json; charset=utf-8
   < Date: Wed, 07 Jan 2026 18:14:47 GMT
   < Etag: W/"2cbcbafa466e17b74d3f809c2472ba508ade0a0e742ee2340a1c97d6fe3850fd"
   < Link: <https://api.github.com/repositories/1128664294/actions/runs/20750207409/artifacts?name=check-spelling-comment&per_page=1&page=2>; rel="next", <https://api.github.com/repositories/1128664294/actions/runs/20750207409/artifacts?name=check-spelling-comment&per_page=1&page=333>; rel="last"
   < Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
   < Server: github.com
   < Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
   < Vary: Accept, Authorization, Cookie, X-GitHub-OTP,Accept-Encoding, Accept, X-Requested-With
   < X-Accepted-Oauth-Scopes:
   < X-Content-Type-Options: nosniff
   < X-Frame-Options: deny
   < X-Github-Api-Version-Selected: 2022-11-28
   < X-Github-Media-Type: github.v3; format=json
   < X-Github-Request-Id: C8AF:25C17B:1BEF5F5:79DD94A:695EA296
   < X-Oauth-Client-Id: 178c6fc778ccc68e1d6a
   < X-Oauth-Scopes: gist, read:org, repo, workflow, write:packages
   < X-Ratelimit-Limit: 5000
   < X-Ratelimit-Remaining: 4635
   < X-Ratelimit-Reset: 1767810296
   < X-Ratelimit-Resource: core
   < X-Ratelimit-Used: 365
   < X-Xss-Protection: 0
   

   {
     "total_count": 333,
     "artifacts": [
       {
         "id": 5037147613,
         "node_id": "MDg6QXJ0aWZhY3Q1MDM3MTQ3NjEz",
         "name": "check-spelling-comment",
         "size_in_bytes": 46486,
         "url": "https://api.github.com/repos/check-spelling-sandbox/MeshCore/actions/artifacts/5037147613",
         "archive_download_url": "https://api.github.com/repos/check-spelling-sandbox/MeshCore/actions/artifacts/5037147613/zip",
         "expired": false,
         "digest": "sha256:a8c226d11d54f9507d24394fceb5e02b9ea2ccd27f615e1d706884527101e2eb",
         "created_at": "2026-01-06T13:47:12Z",
         "updated_at": "2026-01-06T13:47:12Z",
         "expires_at": "2026-04-06T13:46:23Z",
         "workflow_run": {
           "id": 20750207409,
           "repository_id": 1128664294,
           "head_repository_id": 1128664294,
           "head_branch": "spell-check-with-spelling",
           "head_sha": "5aefd5dd6ed4512a2e6b2b4470988bbe06c0319c"
         }
       }
     ]
   }

   * Request took 273.9795ms
   

   And then the last (from the Link: header) page:

   jsoref@jsoref-mbp ~ % GH_DEBUG=api gh api 'https://api.github.com/repositories/1128664294/actions/runs/20750207409/artifacts?name=check-spelling-comment&per_page=1&page=333' > b
   * Request at 2026-01-07 13:14:58.527194 -0500 EST m=+0.088069542
   * Request to https://api.github.com/repositories/1128664294/actions/runs/20750207409/artifacts?name=check-spelling-comment&per_page=1&page=333
   > GET /repositories/1128664294/actions/runs/20750207409/artifacts?name=check-spelling-comment&per_page=1&page=333 HTTP/1.1
   > Host: api.github.com
   > Accept: */*
   > Authorization: token ████████████████████
   > Content-Type: application/json; charset=utf-8
   > Time-Zone: America/Toronto
   > User-Agent: GitHub CLI 2.83.2
   
   < HTTP/2.0 200 OK
   < Access-Control-Allow-Origin: *
   < Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
   < Cache-Control: private, max-age=60, s-maxage=60
   < Content-Security-Policy: default-src 'none'
   < Content-Type: application/json; charset=utf-8
   < Date: Wed, 07 Jan 2026 18:14:58 GMT
   < Etag: W/"670f2b028d03d5ba78caa3a6e3b6358f91c634a06e0382737b5f7be408101970"
   < Link: <https://api.github.com/repositories/1128664294/actions/runs/20750207409/artifacts?name=check-spelling-comment&per_page=1&page=332>; rel="prev", <https://api.github.com/repositories/1128664294/actions/runs/20750207409/artifacts?name=check-spelling-comment&per_page=1&page=1>; rel="first"
   < Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
   < Server: github.com
   < Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
   < Vary: Accept, Authorization, Cookie, X-GitHub-OTP,Accept-Encoding, Accept, X-Requested-With
   < X-Accepted-Oauth-Scopes:
   < X-Content-Type-Options: nosniff
   < X-Frame-Options: deny
   < X-Github-Api-Version-Selected: 2022-11-28
   < X-Github-Media-Type: github.v3; format=json
   < X-Github-Request-Id: C8EA:3B20D0:1C4FDF4:7AFF470:695EA2A2
   < X-Oauth-Client-Id: 178c6fc778ccc68e1d6a
   < X-Oauth-Scopes: gist, read:org, repo, workflow, write:packages
   < X-Ratelimit-Limit: 5000
   < X-Ratelimit-Remaining: 4634
   < X-Ratelimit-Reset: 1767810296
   < X-Ratelimit-Resource: core
   < X-Ratelimit-Used: 366
   < X-Xss-Protection: 0
   

   {
     "total_count": 333,
     "artifacts": [
       {
         "id": 5053199227,
         "node_id": "MDg6QXJ0aWZhY3Q1MDUzMTk5MjI3",
         "name": "check-spelling-comment",
         "size_in_bytes": 11047,
         "url": "https://api.github.com/repos/check-spelling-sandbox/MeshCore/actions/artifacts/5053199227",
         "archive_download_url": "https://api.github.com/repos/check-spelling-sandbox/MeshCore/actions/artifacts/5053199227/zip",
         "expired": false,
         "digest": "sha256:61311ca3cbfee5254a13209aee4b5f448d18c7b6e6edc962fd810c43d53a78c6",
         "created_at": "2026-01-07T18:09:59Z",
         "updated_at": "2026-01-07T18:09:59Z",
         "expires_at": "2026-04-07T18:09:35Z",
         "workflow_run": {
           "id": 20750207409,
           "repository_id": 1128664294,
           "head_repository_id": 1128664294,
           "head_branch": "spell-check-with-spelling",
           "head_sha": "5aefd5dd6ed4512a2e6b2b4470988bbe06c0319c"
         }
       }
     ]
   }

   * Request took 227.117792ms
   
6. adangel commented on Jan 8, 2026

   

   adangel

   on Jan 8, 2026

   Author

   More actions

   Yes, if you have many repeated runs of your workflow (aka attempts), then you might hit the paging problem. In order to sort the artifacts client-side, you need to have them all. I see, you have re-run your workflow 334 times...

   Note, that you can only upload an artifact with a specific name once ("it is no longer possible to upload to the same named Artifact multiple times" -> https://github.com/actions/upload-artifact?tab=readme-ov-file#breaking-changes). The only way to have multiple artifacts with the same name seems to be now when you re-run a workflow.

   For my use case, I don't rerun the workflows that often, so the default page size of 30 is ok. You could try to query a single very big page (e.g. per_page=1000), but there's probably also an undocumented upper limit. Your approach using per_page=1 (which is for one named artifact exactly one workflow run attempt) and using the "last" link, sound reasonable. However, you'll depend on the sort order, that github implements. If the last is not the latest, then this won't work.
7. babakks commented on Jan 8, 2026

   

   babakks

   on Jan 8, 2026

   Member

   More actions

   Thanks for the investigation here, @adangel and @jsoref! 🙏

   I'm curious what would you get if you omit the run ID, @adangel. 🤔

   Can you please run this and share the output (redact where needed)?

   GH_DEBUG=api gh run download --repo pmd/pmd --name pmd-regression-tester

   The reason I'm asking this is that when the run ID is missing, gh uses a different API endpoint, and I'm curious to see how that endpoint sort the entries.
8. babakks

   added

   more-info-neededMore info needed from user/contributorMore info needed from user/contributor

   gh-runrelating to the gh run commandrelating to the gh run command

   on Jan 8, 2026
9. jsoref commented on Jan 8, 2026

   

   jsoref

   on Jan 8, 2026

   Last edited by jsoref

   Contributor

   More actions

   Fwiw, I've now replaced my use of gh run download.

   Of course, I now will need to rely on the endpoint sort order being oldest to newest and I'm hoping to ship with this commit shortly (and I release once or twice a year).
10. babakks commented on Jan 8, 2026

    

    babakks

    on Jan 8, 2026

    Member

    More actions

    My bad, nevermind. You folks have already checked that route. 🏅

    Seems like gh doesn't expect to see colliding artifact names in the same run. But it's possible with retry attempts.

    However, I have to check internally to see if there has been any changes to the endpoint that returns the list of artifacts for a single run.
11. babakks

    added

    needs-investigationCLI team needs to investigateCLI team needs to investigate

    and removed

    more-info-neededMore info needed from user/contributorMore info needed from user/contributor

    on Jan 8, 2026
12. jsoref commented on Jan 8, 2026

    

    jsoref

    on Jan 8, 2026

    Last edited by jsoref

    Contributor

    More actions

    (I might add a check to my code to ensure it picks the newest between the first and the last page in the case that github changes the sort order. I'll talk w/ @nebuk89 about this today -- didn't happen)
13. jsoref commented on Jan 8, 2026

    

    jsoref

    on Jan 8, 2026

    Last edited by jsoref

    Contributor

    More actions

    Fwiw, the api appears to say the max page size is 100:

    per_page integer
    The number of results per page (max 100). For more information, see "Using pagination in the REST API."

    Default: 30

    ... Conveniently I've already far exceeded that. -- I was planning to stop closer to 1000, but it was a slow process and I stopped and determined I'd already proved my point and didn't feel a need to continue.

    For a different, but related endpoint, the oldest item is on the last page:
    https://github.com/check-spelling/check-spelling/blame/0b27d64c0ff97ddad604b38de45a92e722637dbf/t/apply.t#L77-L99

    And, yes, I've added some code to my gh-run-download to check to see which is newer (first or last) and favor the new one. I'm also fixed apply.pl to properly get the latest version for reruns.

    Fwiw, while there's a last header in the examples above, I had some trouble dealing w/ that header in apply.pl (it looked like I ran into a case where that header wasn't present), so for that, I just guess that i can get to the nth object by going to the nth page of 1 per page pages -- it saves some parsing as I already have to parse the json of the first page to get the object on that page. And, of course, if github decides to make the list randomly sorted, then, I give up.

    I also ran into some fun cases where GitHub's servers sent out pointers to domains that have been out of use for over a decade.

    Note that I run regression testing on apply.pl daily, so if other behaviors change in this stuff, I should be notified. I'm tempted to add a test to assert the order of reruns, but, that's actually pretty annoying to do. I think I'd need to have a workflow that runs (probably on a schedule) that uploads an artifact, and then have a workflow file with on:/workflow_run:/completed for that workflow which in turn triggers a rerun for that workflow (but only once).
14. 4 remaining items

    Load more
15. github-actions

    removed

    stale

    on Mar 5, 2026
16. BagToad

    changed the title [-]gh run download doesn't download latest artifact[/-] [+]`gh run download` doesn't download latest artifact[/+] on Mar 9, 2026
17. BagToad

    changed the title [-]`gh run download` doesn't download latest artifact[/-] [+]`gh run download` doesn't download latest artifact from latest attempt[/+] on Mar 9, 2026
18. BagToad

    added

    enhancementa request to improve CLIa request to improve CLI

    and removed

    bugSomething isn't workingSomething isn't working

    needs-investigationCLI team needs to investigateCLI team needs to investigate

    on Mar 9, 2026
19. github-actions commented on Mar 9, 2026

    

    github-actionsBot

    on Mar 9, 2026 – with GitHub Actions

    Contributor

    More actions

    Thank you for your issue! We have categorized it as an enhancement (feature or improvement) request, and it has been added to our backlog. In doing so, we are not committing to implementing this feature at this time, but, we will consider it for future releases based on community feedback and our own product roadmap.

    Unless you see the help wanted Contributions welcome label, we are not currently looking for external contributions for this feature.

    If you come across this issue and would like to see it implemented, please add a thumbs up! This will help us prioritize the feature. Please only comment if you have additional information or viewpoints to contribute.
20. github-actions

    removed

    needs-triageneeds to be reviewedneeds to be reviewed

    on Mar 9, 2026
21. BagToad

    added

    coreThis issue is not accepting PRs from outside contributorsThis issue is not accepting PRs from outside contributors

    on Mar 9, 2026
22. williammartin commented on Mar 10, 2026

    

    williammartin

    on Mar 10, 2026

    Member

    More actions

    https://docs.github.com/en/rest/actions/artifacts?apiVersion=2022-11-28#list-workflow-run-artifacts now contains a direction query parameter. Note that we currently support the 4 most recent GHES versions, so this won't be a complete solution for now.

    👍React with 👍1Reacted by Josh Soref

    👀React with 👀1Reacted by Josh Soref
23. jsoref commented on Mar 10, 2026

    

    jsoref

    on Mar 10, 2026

    Contributor

    More actions

    @williammartin is there a way to determine whether the direction parameter was honored? If so, that'd ensure that for the FPT instance, it's one query + one retrieval. If not, I think it's still two queries + one retrieval.
24. williammartin commented on Mar 10, 2026

    

    williammartin

    on Mar 10, 2026

    Member

    More actions

    @williammartin is there a way to determine whether the direction parameter was honored? If so, that'd ensure that for the FPT instance, it's one query + one retrieval. If not, I think it's still two queries + one retrieval.

    I don't think the API will tell us this, so we can either do a heuristic check, or probably add something to the feature detector to do a version check based on the host being targeted (if GHES). Some prior art:

    cli/internal/featuredetection/feature_detection.go

    Lines 307 to 315 in 19864b9

    	const (
    	// enterpriseAdvancedIssueSearchSupport is the minimum version of GHES that
    	// supports advanced issue search and gh should use it.
    	//
    	// Note that advanced issue search is also available on GHES 3.17, but it's
    	// at the preview stage and is not as mature as it is on github.com or later
    	// GHES version.
    	enterpriseAdvancedIssueSearchSupport = "3.18.0"
    	)

    👀React with 👀1Reacted by Josh Soref
25. jsoref commented on Mar 10, 2026

    

    jsoref

    on Mar 10, 2026

    Contributor

    More actions

    That appears to require a trip to /meta. I don't think it's worth it. It's simpler to just send a query for first + last and compare. Once GHES supports direction, the code to get last + compare can be dropped.
26. github-actions

    added

    stale

    on Apr 10, 2026
27. SaiSamyukthVemuri

    added a commit that references this issue on Oct 7, 2026

    docs(eng): CAP-01-ATTEST-READER-01 repair - duplicate same-name attes…

    ...

    32457de