actions/download-artifact false positives for GitHub Enterprise Server

[martincostello]

Follow-up to #468.

In a GitHub Enterprise Server (GHES) environment where GitHub Connect is not enabled (i.e. actions are shipped-in box with the appliance, and not downloaded from GitHub.com) the actions/upload-artifact@v3-node20 and actions/download-artifact@v3-node20 branches/tags/references do not exist in the actions repositories that ship with the appliance.

Accordingly, it is not possible to use actionlint v1.7.4+ in GHES as it is impossible to upgrade from v3 to v4 as it is not supported. I assume GHES doesn't enforce the Node.js v16 restriction internally in GHES environments as they are still functional.

My suggestion for a fix would be to not issue these warnings if the GITHUB_SERVER_URL environment variable is not https://github.com and does not end with .ghe.com (for GitHub Enterprise Cloud) (docs).

[rhysd]

Thanks for the heads up. However actions/download-artifact@v3 is using node16 runner and the runner is already dead. How does GHES use the action? Is node16 still available on GHES server?

[martincostello]

It must still be supported somehow, whether still installed or some internal "treat node16 as node20". GHES only supports custom runners (not hosted), and we base those on the actions-runner image.

The important point is that regardless of how they work in GHES, v3 artifacts actions do and v4 don't 😄

By coincidence I happen to be having a go at trying to resolve this now. I'm not a Go developer though so it might not be the best way to do it. I'll push up a draft soon for feedback.

[martincostello]

I'll push up a draft soon for feedback.

#510

[codezninja]

Would love to see if we can get this fixed. Cause right now our super-linting jobs fail on this but we can't update artifact actions from v3 -> v4. So we've had to turn actionlint off