Add support for $GITHUB_ARTIFACTS environment files

src/Runner.Common/Constants.cs

@@ -180,6 +180,7 @@ public static class Features
                 public static readonly string BatchActionResolution = "actions_batch_action_resolution";
                 public static readonly string UseBearerTokenForCodeload = "actions_use_bearer_token_for_codeload";
                 public static readonly string OverrideDebuggerWelcomeMessage = "actions_runner_override_debugger_welcome_message";
+                public static readonly string AllowArtifactsFile = "actions_runner_allow_artifacts_file";
                 public static readonly string SelfRepository = "actions_self_repository";
             }
 
@@ -228,6 +229,12 @@ public static class NodeMigration
             public static readonly string UnsupportedStopCommandTokenDisabled = "You cannot use a endToken that is an empty string, the string 'pause-logging', or another workflow command. For more information see: https://docs.github.com/actions/learn-github-actions/workflow-commands-for-github-actions#example-stopping-and-starting-workflow-commands or opt into insecure command execution by setting the `ACTIONS_ALLOW_UNSECURE_STOPCOMMAND_TOKENS` environment variable to `true`.";
             public static readonly string UnsupportedSummarySize = "$GITHUB_STEP_SUMMARY upload aborted, supports content up to a size of {0}k, got {1}k. For more information see: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-markdown-summary";
             public static readonly string SummaryUploadError = "$GITHUB_STEP_SUMMARY upload aborted, an error occurred when uploading the summary. For more information see: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-markdown-summary";
+
+            // $GITHUB_ARTIFACTS file command
+            public static readonly string ArtifactsFileSizeExceeded = "$GITHUB_ARTIFACTS file exceeds the maximum size of {0} KiB (got {1} KiB).";
+            public static readonly string ArtifactsAggregateLimitExceeded = "The job has exceeded the maximum of {0} declared artifacts.";
+            public static readonly string ArtifactsInvalidLine = "Invalid $GITHUB_ARTIFACTS entry on line {0}: {1}";
+            public static readonly string ArtifactsConflictingDigest = "Conflicting digest for artifact '{0}': previously declared as '{1}', now declared as '{2}'.";
         }
 
         public static class RunnerEvent

src/Runner.Common/ExtensionManager.cs

@@ -62,6 +62,8 @@ private List<IExtension> LoadExtensions<T>() where T : class, IExtension
                     Add<T>(extensions, "GitHub.Runner.Worker.CreateStepSummaryCommand, Runner.Worker");
                     Add<T>(extensions, "GitHub.Runner.Worker.SaveStateFileCommand, Runner.Worker");
                     Add<T>(extensions, "GitHub.Runner.Worker.SetOutputFileCommand, Runner.Worker");
+                    Add<T>(extensions, "GitHub.Runner.Worker.CreateArtifactsFileCommand, Runner.Worker");
+                    Add<T>(extensions, "GitHub.Runner.Worker.ArtifactsListFileCommand, Runner.Worker");
                     break;
                 case "GitHub.Runner.Listener.Check.ICheckExtension":
                     Add<T>(extensions, "GitHub.Runner.Listener.Check.InternetCheck, Runner.Listener");

src/Runner.Worker/ArtifactSubject.cs

@@ -0,0 +1,52 @@
+using System;
+
+namespace GitHub.Runner.Worker
+{
+    public enum ArtifactSubjectKind
+    {
+        File,
+        OciSubject,
+    }
+
+    /// <summary>
+    /// Represents a single artifact subject declared via the
+    /// <c>GITHUB_ARTIFACTS</c> per-step environment file.
+    /// </summary>
+    public sealed class ArtifactSubject : IEquatable<ArtifactSubject>
+    {
+        public ArtifactSubject(string name, string digest, ArtifactSubjectKind kind)
+        {
+            if (string.IsNullOrEmpty(name))
+            {
+                throw new ArgumentException("Name must not be null or empty.", nameof(name));
+            }
+            if (string.IsNullOrEmpty(digest))
+            {
+                throw new ArgumentException("Digest must not be null or empty.", nameof(digest));
+            }
+            Name = name;
+            Digest = digest;
+            Kind = kind;
+        }
+
+        public string Name { get; }
+        public string Digest { get; }
+        public ArtifactSubjectKind Kind { get; }
+
+        public bool Equals(ArtifactSubject other)
+        {
+            if (other is null)
+            {
+                return false;
+            }
+            return string.Equals(Name, other.Name, StringComparison.Ordinal)
+                && string.Equals(Digest, other.Digest, StringComparison.Ordinal);
+        }
+
+        public override bool Equals(object obj) => Equals(obj as ArtifactSubject);
+
+        public override int GetHashCode() => HashCode.Combine(Name, Digest);
+
+        public override string ToString() => $"{Name}@{Digest}";
+    }
+}

src/Runner.Worker/ArtifactsListFileCommand.cs

@@ -0,0 +1,92 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using GitHub.Runner.Common;
+using GitHub.Runner.Sdk;
+using GitHub.Runner.Worker.Container;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+
+namespace GitHub.Runner.Worker
+{
+    /// <summary>
+    /// File command extension that exposes the job-scoped aggregate of
+    /// <see cref="GlobalContext.ArtifactSubjects"/> as a read-only JSON
+    /// file. Subsequent steps in the same job read the file via the
+    /// <c>GITHUB_ARTIFACTS_LIST</c> environment variable, getting a
+    /// running view of every artifact declared via
+    /// <c>$GITHUB_ARTIFACTS</c> in earlier steps.
+    /// </summary>
+    /// <remarks>
+    /// The file uses the existing per-step file-command lifecycle:
+    /// <see cref="FileCommandManager.InitializeFiles"/> creates a fresh
+    /// file, invokes <see cref="PopulateInitialContents"/> here, exposes
+    /// the (translated) path to the step's environment, and (for the
+    /// read-only file) ignores anything the step writes back.
+    ///
+    /// The file is always written when the feature is enabled, so
+    /// consumers never need to branch on "did the runner inject this?".
+    /// An empty aggregate produces <c>{"version":1,"subjects":[]}</c>.
+    /// </remarks>
+    public sealed class ArtifactsListFileCommand : RunnerService, IFileCommandExtension
+    {
+        public const int FormatVersion = 1;
+
+        public string ContextName => "artifacts_list";
+        public string FilePrefix => "artifacts_list_";
+
+        public Type ExtensionType => typeof(IFileCommandExtension);
+
+        public void PopulateInitialContents(IExecutionContext context, string filePath, ContainerInfo container)
+        {
+            ArgUtil.NotNull(context, nameof(context));
+
+            // Feature flag gate. Mirrors CreateArtifactsFileCommand so the
+            // write side and the read side are toggled together.
+            var enabled = (context.Global.Variables.GetBoolean(Constants.Runner.Features.AllowArtifactsFile) ?? false)
+                || StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable(CreateArtifactsFileCommand.EnableEnvVar));
+            if (!enabled)
+            {
+                Trace.Verbose("$GITHUB_ARTIFACTS_LIST publishing is disabled (feature flag and env-var fallback are both off).");
+                return;
+            }
+
+            var aggregate = context.Global.ArtifactSubjects
+                ?? new Dictionary<string, ArtifactSubject>(StringComparer.Ordinal);
+
+            var subjects = new JArray();
+            // Emit subjects sorted by name so the output is deterministic
+            // regardless of the backing dictionary's enumeration order
+            // (which is not contractually guaranteed).
+            foreach (var entry in aggregate.Values.OrderBy(v => v.Name, StringComparer.Ordinal))
+            {
+                subjects.Add(new JObject
+                {
+                    ["name"] = entry.Name,
+                    ["digest"] = entry.Digest,
+                    ["kind"] = entry.Kind == ArtifactSubjectKind.OciSubject ? "oci" : "file",
+                });
+            }
+
+            var payload = new JObject
+            {
+                ["version"] = FormatVersion,
+                ["subjects"] = subjects,
+            };
+
+            // UTF-8 without BOM; consumers in other languages should not
+            // have to special-case a leading BOM.
+            File.WriteAllText(filePath, payload.ToString(Formatting.None), new UTF8Encoding(false));
+            Trace.Info($"Wrote $GITHUB_ARTIFACTS_LIST with {aggregate.Count} subject(s) to '{filePath}'");
+        }
+
+        public void ProcessCommand(IExecutionContext context, string filePath, ContainerInfo container)
+        {
+            // Read-only file: anything the step writes here is ignored.
+            // The aggregate is fed only by the write-side $GITHUB_ARTIFACTS
+            // file processed by CreateArtifactsFileCommand.
+        }
+    }
+}