upload-artifact breaks file permissions

[kcgen]

The baseline behavior of the zip utilty on Linux and macOS is to retain permissions.

However, when the upload-artifact action zips a directory, it loses permissions. With permissions broken and lost in the resulting asset zipfile, this subsequently breaks the artifacts for users or for downstream automated scripts.

Yes, one option is to write a _"github-asset-permission-fixer"_ script that users must run after extracting the assets. However, this could be a lot of work to write and maintain, and hard to justify if it's simply to work-around broken behavior by GitHub. Likewise, if you're dealing with multiple platforms (Windows, macOS, Linux), this script will need to be cross-platform and conform to the lowest-common-denominator available on all platforms (such as bash 3.x on macOS). The alternative is to ask users to install prerequisites (such as bash 4.x) before they can run the _github-permission-fixer_ script.

Expected behavior: permissions, as defined and applied by prior steps in the workflow to the resulting asset files and directories, should not be dropped or ignored by the upload-artifact zipper, and should be present in the resulting asset zip file.

[kcgen]

Adding this issue to the download-artifact action, as that's where the zipping is currently performed in the v1 API. https://github.com/actions/download-artifact/issues/14.
Will leave this open in both repos open until it's solved (however github wants to manage this in their backend for v2).

[nhooyr]

Can confirm that with unzip -Z on the resulting .zip, there are no executable permissions on files that should have executable perms.

[jrozner]

Is anything being done about this? It's been over 6 moths and this is the recommended way by GitHub to handle artifact upload

[adriangb]

This is still broken as of today, very annoying.

[bcardiff]

I am not proud of it, but actions/cache@v2 keeps the permissions. If the goal is to pass some artifacts between jobs the following is working for me so far.

      - name: Artifact (with permissions)
        uses: actions/cache@v2
        with:
          path: /path/to/store
          key: artifacts-${{ github.run_id }}-${{ github.run_number }}

[thetroy]

A workaround is documented in the readme

https://github.com/actions/upload-artifact#maintaining-file-permissions-and-case-sensitive-files

  - name: 'Tar files'
    run: tar -cvf my_files.tar /path/to/my/directory

  - name: 'Upload Artifact'
    uses: actions/upload-artifact@v2
    with:
      name: my-artifact
      path: my_files.tar