Developers using upload-artifact and download-artifact in their Actions workflows can now ensure the integrity of their artifacts with the new SHA256 digest. This feature automatically verifies that the artifact uploaded is identical to the one downloaded, providing security for Actions runs and ensuring the artifact remains unchanged.
How it works
Whenever upload-artifact
is used, it now computes and stores an output called digest
. This is the SHA256 digest of the artifact uploaded during the run.
When download-artifact
is used to download that same artifact, it uses the same process to compute a digest for the downloaded file and compares the two digests to validate that they match.
If a mismatch is detected, the run displays a warning in the UI and in the job logs. The workflow won’t fail if the digests don’t match, but this may change in a future release.
Note: This functionality is only available with artifacts v4 or newer. It’s also not currently available on GitHub Enterprise Server.
Where can I view the digest?
The digest will appear in the logs of the workflow run under the “upload-artifact” step. They’ll also appear in the Artifact output that appears in the workflow run UI.
Learn more
To get started using the artifacts actions view our documentation on storing and sharing data from a workflow.