upload-artifact@v4 uploads corrupted archive

Bug report info

act version:            0.2.63
GOOS:                   linux
GOARCH:                 amd64
NumCPU:                 16
Docker host:            DOCKER_HOST environment variable is not set
Sockets found:
        /var/run/docker.sock
Config files:           
        /home/vinci/.config/act/actrc:
                -P ubuntu-latest=catthehacker/ubuntu:full-latest
                -P ubuntu-24.04=catthehacker/ubuntu:full-24.04
                -P ubuntu-22.04=catthehacker/ubuntu:full-22.04
                -P ubuntu-20.04=catthehacker/ubuntu:full-20.04
                -P ubuntu-18.04=catthehacker/ubuntu:full-18.04
Build info:
        Go version:            go1.22.3
        Module path:           github.com/nektos/act
        Main version:          (devel)
        Main path:             github.com/nektos/act
        Main checksum:         
        Build settings:
                -buildmode:           pie
                -compiler:            gc
                -trimpath:            true
                DefaultGODEBUG:       httplaxcontentlength=1,httpmuxgo121=1,tls10server=1,tlsrsakex=1,tlsunsafeekm=1
                CGO_ENABLED:          1
                GOARCH:               amd64
                GOOS:                 linux
                GOAMD64:              v1
Docker Engine:
        Engine version:        26.1.3
        Engine runtime:        runc
        Cgroup version:        2
        Cgroup driver:         systemd
        Storage driver:        overlay2
        Registry URI:          https://index.docker.io/v1/
        OS:                    Garuda Linux
        OS type:               linux
        OS version:            
        OS arch:               x86_64
        OS kernel:             6.9.3-zen1-1-zen
        OS CPU:                16
        OS memory:             31240 MB
        Security options:
                name=seccomp,profile=builtin
                name=cgroupns

Command used with act

act -v --artifact-server-path build -j x86_64-linux-gnu-gcc

Describe issue

upload-artifact@v4 does produce corrupted archives in some cases. I have no idea why because the log does not hint any issue at all:

[build/x86_64-linux-gnu-gcc]   💬  ::debug::File:/home/vinci/Develop/VSCode/act_upload_artifact_v4/build.tar was found using the provided searchPath
| With the provided path, there will be 1 file uploaded
[build/x86_64-linux-gnu-gcc]   💬  ::debug::Root artifact directory is /home/vinci/Develop/VSCode/act_upload_artifact_v4
| Artifact name is valid!
| Root directory input is valid!

I've attached the archive produced from act and the original one from GitHub: corrupted.zip original.zip

The very same workflow works for me when using the older upload-artifact@v3.

I've also created a small test example where this is easily reproducible.

Link to GitHub repository

https://github.com/higaski/act_upload_artifact_v4

Workflow content

name: build

on:
  workflow_call:

jobs:
  x86_64-linux-gnu-gcc:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4.1.6
        with:
          fetch-depth: 0
      - run: cmake -Bbuild -DCMAKE_BUILD_TYPE=Release
      - run: cmake --build build --parallel
      - run: tar -cvf build.tar build
      - uses: actions/upload-artifact@v4.3.3
        with:
          name: build.tar
          path: build.tar

I am seeing the same issue, with act version 0.2.63-9-g935e4c3. The asset corruption seems to be size dependent:

Things work fine at 4M:

    - run: dd if=/dev/urandom bs=1024 count=4096 of=urandom4M.bin                                                                                                                                                      
    - uses: actions/upload-artifact@v4
      with: { name: assets, path: 'urandom4M.bin' }

$ unzip /tmp/artifacts/1/assets/assets.zip 
Archive:  /tmp/artifacts/1/assets/assets.zip
  inflating: urandom4M.bin

Things are broken at 8M:

    - run: dd if=/dev/urandom bs=1024 count=8192 of=urandom8M.bin                                                                                                                                                      
    - uses: actions/upload-artifact@v4
      with: { name: assets, path: 'urandom8M.bin' }

$ unzip /tmp/artifacts/1/assets/assets.zip 
Archive:  /tmp/artifacts/1/assets/assets.zip
error [/tmp/artifacts/1/assets/assets.zip]:  missing 8388608 bytes in zipfile
  (attempting to process anyway)
error: invalid zip file with overlapped components (possible zip bomb)
$ ls -al /tmp/artifacts/1/assets/assets.zip
-rw-r--r-- 1 timj timj 2705 Jun 25 18:19 /tmp/artifacts/1/assets/assets.zip

The 8M asset file is obviously too small. Both results are repeatable reliably.

nektos / act