Task 1.3: Manage workflow execution and outputs

• ASet overwrite: true on every matrix job's upload, keeping the shared name

  Incorrect

  Each overwrite deletes the previous artifact, so only one job's files would remain.

• BName each upload with the matrix values, such as test-results-${{ matrix.os }}-${{ matrix.node }}

  Correct

  Artifacts are immutable, so each job needs its own name to upload.

• CDownload with pattern: test-results-* and merge-multiple: true

  Correct

  The pattern selects all six artifacts and merge-multiple extracts them into one directory.

• DKeep the shared name and let each job append its files to the same artifact

  Incorrect

  An artifact can't be added to after it is uploaded; a second upload with the same name fails.

• EDownload with name: test-results in the report job

  Incorrect

  No artifact has that exact name once the uploads are renamed, and a name matches a single artifact.

Artifacts created by upload-artifact v4 and later are immutable, so uploading twice with the same name fails unless overwrite replaces the artifact. In a matrix, give each upload a unique name built from matrix values, then download them together with a glob pattern and merge-multiple: true.

• AThe output exceeds 1 MB; split it into several outputs

  Incorrect

  A connection string is far below the 1 MB per job limit.

• BThe deploy job lacks needs; add needs: setup to read it

  Incorrect

  The stem already has deploy needing setup, so needs isn't the problem.

• COutputs are cleared after a job; upload the string as an artifact

  Incorrect

  Outputs do reach downstream jobs, and an artifact would store the password in plain text.

• DOutputs holding secrets are redacted and not sent; build the string in deploy instead

  Correct

  Outputs with secrets are redacted on the runner, so the job that connects should read the secret directly.

Job outputs are available to downstream jobs that need the job, up to 1 MB per job and 50 MB per run. Outputs containing expressions are evaluated on the runner at the end of each job, and outputs containing secrets are redacted on the runner and not sent to GitHub Actions. The job that needs the credential should read the secret itself.

• AA nightly job that calls DELETE for every artifact older than 30 days through the artifacts API

  Incorrect

  That would delete artifacts but leave logs, and it adds a job to keep running.

• BPUT /orgs/{org}/actions/permissions/artifact-and-log-retention with days set to 30

  Correct

  This sets the organization's retention for artifacts and logs, along with checks, runs and statuses.

• CPOST /orgs/{org}/actions/variables creating RETENTION_DAYS with the value 30

  Incorrect

  A variable only passes a value to workflows that read it; it doesn't change any retention setting.

• DA PUT to the organization's cache retention settings with 30 days

  Incorrect

  Cache retention controls dependency caches, not artifacts and logs.

The REST API endpoint PUT /orgs/{org}/actions/permissions/artifact-and-log-retention sets the number of days that checks, workflow runs, commit statuses, artifacts and logs are kept for the organization; a matching endpoint exists for repositories. A new retention period applies only to data created afterwards.

• ASet compression-level: 0 on the upload

  Incorrect

  The compression level doesn't affect file permissions.

• BSet if-no-files-found: error on the upload

  Incorrect

  That only fails the step when no files match the path; permissions are still lost.

• CSave the directory with a cache instead of an artifact

  Incorrect

  A cache is meant for reusable dependencies between runs, not for passing build outputs between jobs of one run.

• DPack the directory into a tar file and upload that

  Correct

  A tar archive keeps the executable bits that the artifact zip doesn't preserve.

File permissions aren't kept during a zipped artifact upload: directories get 755 and files 644. To keep executable bits, archive the files with tar before uploading and extract them after downloading.

• ACopy ci.yml to a second workflow that runs only on the release/3 branch

  Incorrect

  A badge can show any branch of the existing workflow.

• BAdd event=push to the badge URL

  Incorrect

  event selects the triggering event, not the branch.

• CAdd branch=release/3 to the badge URL

  Correct

  The branch query parameter shows the status of runs on that branch.

• DPoint the badge at the latest run ID for release/3

  Incorrect

  Badge URLs use the workflow file or name, not a run ID.

A workflow status badge shows the default branch by default. The branch and event query parameters show the status for a specific branch or event, for example badge.svg?branch=release/3.

• Aoverwrite: true

  Incorrect

  That replaces an artifact of the same name; it doesn't change how long it is kept.

• Bcompression-level: 9

  Incorrect

  Higher compression shrinks the upload but keeps it for the full period.

• Cif-no-files-found: ignore

  Incorrect

  That controls what happens when no files match the path.

• Dretention-days: 5

  Correct

  A custom retention period applies to that artifact only.

The upload-artifact action accepts retention-days to set a custom retention period for one artifact, while other artifacts keep the default retention.

• AAn upload-artifact step for ~/.npm at the end of each job

  Incorrect

  Artifacts belong to one run and aren't restored automatically by later runs.

• Bcache: npm on the setup-node step

  Correct

  The setup action creates and restores the dependency cache for you.

• CA separate actions/cache step keyed on the runner's name

  Incorrect

  That is more configuration than the single input setup-node needs.

• Dnpm ci --prefer-offline without any cache step

  Incorrect

  Without a cache, each new runner starts with an empty npm cache.

The setup-* actions for package managers, such as setup-node for npm, Yarn and pnpm, create and restore dependency caches with minimal configuration. Artifacts store files from one run and aren't restored by later runs.

• Aif-no-files-found: error, to fail fast

  Incorrect

  Files were found, so this wouldn't change anything.

• Binclude-hidden-files: true

  Correct

  Hidden files and folders, those starting with a dot, are left out unless this input is true.

• Coverwrite: true

  Incorrect

  Overwriting replaces an artifact of the same name; it doesn't add files.

• Darchive: false

  Incorrect

  That uploads a single file without zipping it, which doesn't bring the folder back.

upload-artifact ignores hidden files by default to avoid uploading sensitive information. Files that start with a dot, or are inside folders that start with a dot, are included only when include-hidden-files is true.