search

actions / upload-artifact

MIT License
3.24k stars 728 forks source link

[bug] Explicitly requested hidden files should be uploaded without allowing all hidden files #614

Open nedbat opened 2 months ago

nedbat commented 2 months ago

What happened?

Many people were surprised by the change that hidden files are no longer uploaded unless hidden-files: true is set. Even explicitly named files are not uploaded. This is confusing, and encourages people to turn off the safety feature completely.

If I name a hidden file, it should be uploaded regardless of the setting.

To make an analogy: ls ignores hidden files. ls -a shows them all. ls .gitignore shows me the hidden .gitignore file even without the -a flag.

Previous comments:

What did you expect to happen?

Explicitly named hidden files should be uploaded.

How can we reproduce it?

Many examples are in the other issues.

Anything else we need to know?

No response

What version of the action are you using?

v4.4.0

What are your runner environments?

linux, window, macos

Are you on GitHub Enterprise Server? If so, what version?

No response

WorldSEnder commented 2 months ago

I agree with the sentiment of the issue, In case it gets decided that the current behaviour is intended (or while discussion about it is on-going), I would suggest that explicitly specified filepaths that end up being ignored should lead to an error or big fat warning telling you about it. There is currently no difference in behaviour between

- uses: actions/upload-artifact@v4
  with:
    name: my-artifact
    path: .my-hidden-file

and not specifying such a path at all, as in,

- uses: actions/upload-artifact@v4
  with:
    name: my-artifact
    path: ""

so in almost every case I can think of, the former is a configuration mistake that should throw up some flags. It currently makes no sense to specify a path with a leading dot without also setting include-hidden-files: true.

nedbat commented 1 month ago

I'm disappointed that this hasn't even been discussed on this issue. I love that you are taking security seriously by preventing accidental upload of sensitive data. But it's really disappointing that you are telling us to simply switch it all off, and not discussing more sophisticated approaches.

Can we at least get a response here?

John0x commented 1 week ago

Just had a deployment fail on me silently, because not all necessary files were uploaded for the application to run.

Not a cool move guys, to just change the default behaviour in such a drastic way