Clean up transfer artifacts surgically at consumption, not blanket-delete - #216
Merged
Conversation
…lete Fixes #214. The terminal cleanup-artifacts job (duplicated in test-pull-request.yml and publish-release.yml) blanket-deleted every run artifact (.artifacts[].id). Added to control huge release-asset artifacts (KiCadLibrary) filling the storage quota, it overstepped: it also destroyed diagnostic/log artifacts needed to debug a failed run. - Delete each transfer artifact at its point of consumption, by exact name/pattern: the github-release job deletes release-asset-<branch>-* after attaching them to the release; publish-pypi deletes pypilibrary-build-<branch> after publishing. Grant actions:write where deletion happens (the publish caller for the reusable github-release job; publish-pypi directly). - Remove the blanket cleanup-artifacts job from both workflows. retention-days:1 on every upload is the failure-path backstop (a job that dies before its consumer leaves its artifact, reaped within a day); a failed run is reported normally. Diagnostics and build-records are no longer destroyed. - Rewrite the AGENTS.md artifact-retention rule to the consume-then-delete pattern so downstream job customizations honor it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the repository's GitHub Actions artifact-retention approach to avoid blanket-deleting all run artifacts (which can remove diagnostics), and instead deletes only inter-job transfer artifacts at the point they are consumed. It also updates the documented workflow conventions accordingly.
Changes:
- Document the new "consume-then-delete" artifact cleanup strategy in
AGENTS.md. - Remove the terminal
cleanup-artifactsjobs fromtest-pull-request.ymlandpublish-release.yml. - Add targeted deletion steps:
release-asset-<branch>-*cleanup inbuild-release-task.ymlafter attaching to the GitHub release, andpypilibrary-build-<branch>cleanup inpublish-release.ymlafter publishing to PyPI (including permission updates).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| AGENTS.md | Updates the workflow convention to require surgical, consume-time deletion of transfer artifacts and to avoid blanket deletion. |
| .github/workflows/test-pull-request.yml | Removes the terminal job that deleted all run artifacts. |
| .github/workflows/publish-release.yml | Grants actions: write where needed and deletes the consumed PyPI build artifact after publishing; removes blanket cleanup job. |
| .github/workflows/build-release-task.yml | Deletes consumed release-asset-<branch>-* artifacts after attaching them to the GitHub release. |
A listing/delete API hiccup must not red a job whose release/publish already succeeded: tolerate a failed artifact-list (warn + skip) and add continue-on-error, and delete every matching artifact id rather than a single scalar (a rerun can upload duplicates). The retention-days: 1 backstop covers anything missed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…rtifact-cleanup-214
This was referenced Jun 26, 2026
ptr727
added a commit
that referenced
this pull request
Jul 4, 2026
Promote the accumulated `develop` work to `main`. Twelve changes since the last promotion: - Add `WORKFLOW.md`: workflow style, architecture, behavioral contract, test methodology (#223) - Use NBGV `IGNORE_GITHUB_REF` instead of the ineffective `GITHUB_REF` override (#222) - Skip validate-release on smoke builds (#220) - Gate asset delete on the release create/refresh condition (#218) - Ship branch rulesets as versioned JSON in the re-sync / drift loop (#212) - Clean up transfer artifacts surgically at consumption, not blanket-delete (#216) - Version each publish leg against its own branch; validate at entry (#215) - Consolidate workspace configurations into a unified ProjectTemplate workspace (#210) - Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file (#207) - Key merge-bot concurrency on PR number, not `github.ref` (#206) - Codify orchestrated re-sync personas and full-replacement rule (#205) - Lead action pins; affirm pattern-based artifact handoff (#204) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Closes #214. The
cleanup-artifactsjob (duplicated intest-pull-request.ymlandpublish-release.yml) blanket-deleted every run artifact (.artifacts[].id). It was added to stop hugerelease-asset-*artifacts (KiCadLibrary) filling the storage quota, but it overstepped — it also destroys diagnostic/log artifacts and the build-records actions emit automatically, exactly what you need to debug a failed run.Fix
Per maintainer guidance: surgical cleanup +
retention-days: 1+ normal failed-job surfacing, no naming-pattern terminal backstop (overkill).github-releasejob deletesrelease-asset-<branch>-*after attaching them to the release;publish-pypideletespypilibrary-build-<branch>after publishing.actions: writegranted where deletion happens — at thepublishcaller for the reusablegithub-releasejob, and onpublish-pypidirectly (wasactions: read).cleanup-artifactsjob from both workflows.retention-days: 1(already on every transfer upload) is the failure-path backstop; a failed run is reported normally. Diagnostics/build-records survive — the intended outcome.Verification
actionlint(Docker, bundles shellcheck) clean on all three changed workflows; markdownlint clean onAGENTS.md; CRLF preserved.check-workflow-status(the required-status-check aggregator) does not depend on the removed job, so the merge gate is unaffected.🤖 Generated with Claude Code