Deprecation Notice (reminder): v3 of the artifact actions 📣

[samus-aran]

We would like to inform everyone of the upcoming deprecation of v3 of the artifact actions. 📣

Starting December 5th 2024, GitHub Actions customers will no longer be able to use v3 of actions/upload-artifact or actions/download-artifact. To ensure all users have adequate time to transition to the updated version and raise awareness, we will be implementing temporary job failures (brownouts) for any jobs using this deprecated version during scheduled periods.

• Deprecated Version: v3 of actions/upload-artifact and actions/download-artifact
• Brownout Dates:
  • TBD

During the brownout periods, any job using this version will fail temporarily to signal that the workflow will no longer be supported in the near future. These brownout periods are essential to encourage migration to the supported version and prevent interruptions when the workflow is officially deprecated.

What This Means for You

Please review and update your workflows to use the latest version (v4) of the artifact actions as soon as possible.

Any jobs that we've detected using the deprecated v3 artifact actions will show an annotation on your workflows. Below is an example of an indirect dependency showing an annotation at the job level.

v4 improves upload and download speeds by up to 98% and includes several new features, however there are key differences from the previous versions that may require updates to your workflows.

Updated documentation and support resources are available to assist with the migration.

• upload-artifact v3 to v4 documentation
• download-artifact v3 to v4 documentation

Thank you for your attention! If you have any questions on the migration documentation please comment below.

[laurent22]

Why are we told about this just a month before it's taken down? Also GitHub sent us an email telling us we use these actions but we don't, not directly, so it's probably a dependency of a dependency. Since GitHub knows that we use them, why not tell us where exactly so that we can act on it? Right now we have no idea where it's used.

[samus-aran]

This deprecation was announced on the changelog blog back in April and we are setting up these reminders for those that have not migrated from v3 to v4 yet.

Also GitHub sent us an email telling us we use these actions but we don't, not directly, so it's probably a dependency of a dependency.

We'll certainly share this with the internal team. As a user of a dependency I would probably want to know that along down the line something will happen but yes it would be helpful to know exactly what would be affected.

[laurent22]

As much as I'd like to, I can't subscribe to every blog of every service I use and read every news. If there's an important breaking change coming up, it would be nice to get an email about it in April then, and not just one month before.

[samus-aran]

I can understand that!

[samus-aran]

@laurent22 could you try out the below code search query to narrow down the jobs within your org? Let us know how you get on. 👍

org:[your_org_name] upload-artifact@v3 path:/^\.github\/workflows\//

or

org:[your_org_name] download-artifact@v3 path:/^\.github\/workflows\//

[laurent22]

That helped find one workflow, thank you for the tip!

[ima747]

How do we identify usage? I found a few references to older versions of our internal actions which in turn consume the upload action, but if we have a nested dependency tree of actions how do we identify what is going to break? Since the email was sent to people who are using outdated versions is there any way to find specifics since something on the GitHub side is seeing our usage of this... as it stands we have to audit everything, and everything that those things consume, on down to the ground and even then not sure how confident we'll be...

[samus-aran]

Hi all, we've updated the Brownout Dates on this discussion:

• November 14, 12-1pm EST
• November 21, 9am - 5pm EST

We also included guidance that you can see annotations at the job level if we've detected there is a use of the v3 artifact actions.

[ima747]

Is that guidance generic, and can it be shared here if so? If not, the email I received had those dates but didn't have guidance regarding locating jobs, how could I get that guidance?

[samus-aran]

Sorry, I'll clarify that I updated this discussion's main copy with this:

Any jobs that we've detected using the deprecated v3 artifact actions will show an annotation on your workflows. Below is an example of an indirect dependency showing an annotation at the job level.

[cliffchapmanrbx]

With the deprecation of the GHES v4 support does this mean GHES has no planned date for this deprecation?

We will of course be moving our GHEC use before the deadline.

[ChristopherHX]

does this mean GHES has no planned date for this deprecation?

In short they can't deprecate it for GHES, it's impossible before v4 exist and the v3 backend remains available as long the changelog says v4 is supported for GHES.
They didn't ship any of their golang based (they leaked this somewhere) backends to GHES yet, they are still migrating github.com over to the new backend at this time old and new backend are both deployed (artifacts v4 as of December 2023) for GitHub.com and logs + step uploaded are sent to both old and new service (as of Jan/Feb 2024).

The services for GitHub Actions on .com are a big mess right now, until 5. December (end of v3 in .com) the date they plan to shutdown their azure pipelines fork (this one is deployed in the GHES VM).

I assume end of december GitHub might make plans for GHES, I guess their timeline might has a regression and it can be > 1a.

BTW I have a custom runner that notices every major protocol change on .com.

Sadly this means the isGHES bomb in artifacts v4 remains :(, even if a fake GHES supports artifacts v4 due to me coding the server part based on the spec and I need to continue to patch it.