fix(actions): let a rerun of selected jobs read the previous attempt's artifacts (#38857)

Fixes #38773

## Background

Artifacts became attempt-scoped in #37119, and the runner-facing
artifact APIs filter strictly by the attempt of the running job. "Re-run
failed jobs" creates a new attempt whose passed-through jobs never
upload their artifacts again, so a re-run job that downloads one of them
fails with "artifact not found".

## Fix

The read paths (v3 and v4 list and download) now resolve artifacts
across the running job's attempt plus the attempts it inherits from, and
an inherited artifact is shadowed by a same-named one from a newer
attempt.

## Note

GitHub's documentation does not document these behaviors. The
conclusions below are based on manual testing, so consistency with
GitHub cannot be guaranteed.

- In a "partial re-run", a job can download artifacts uploaded by an
earlier attempt, every attempt keeps its own copy of a name, and a
lookup by name resolves to the newest one.
- A full "Re-run all jobs" never downloads artifacts from earlier
attempts.

---------

Co-authored-by: bircni <bircni@icloud.com>

models/actions/artifact.go

@@ -9,10 +9,10 @@ package actions
 import (
 	"context"
 	"errors"
+	"slices"
 	"time"
 
 	"gitea.dev/models/db"
-	"gitea.dev/modules/optional"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"
 
@@ -147,7 +147,7 @@ type FindArtifactsOptions struct {
 	db.ListOptions
 	RepoID               int64
 	RunID                int64
-	RunAttemptID         optional.Option[int64] // use optional to allow filtering by zero (legacy artifacts have run_attempt_id=0)
+	RunAttemptIDs        []int64 // empty means every attempt; pass 0 to target legacy artifacts, which have run_attempt_id=0
 	ArtifactName         string
 	Status               int
 	FinalizedArtifactsV4 bool
@@ -167,8 +167,8 @@ func (opts FindArtifactsOptions) ToConds() builder.Cond {
 	if opts.RunID > 0 {
 		cond = cond.And(builder.Eq{"run_id": opts.RunID})
 	}
-	if opts.RunAttemptID.Has() {
-		cond = cond.And(builder.Eq{"run_attempt_id": opts.RunAttemptID.Value()})
+	if len(opts.RunAttemptIDs) > 0 {
+		cond = cond.And(builder.In("run_attempt_id", opts.RunAttemptIDs))
 	}
 	if opts.ArtifactName != "" {
 		cond = cond.And(builder.Eq{"artifact_name": opts.ArtifactName})
@@ -185,6 +185,27 @@ func (opts FindArtifactsOptions) ToConds() builder.Cond {
 	return cond
 }
 
+// FindReadableArtifacts returns the artifacts of opts.RunAttemptIDs, only keeps the ones from a newer attempt.
+func FindReadableArtifacts(ctx context.Context, opts FindArtifactsOptions) ([]*ActionArtifact, error) {
+	arts, err := db.Find[ActionArtifact](ctx, opts)
+	if err != nil || len(opts.RunAttemptIDs) <= 1 {
+		return arts, err
+	}
+	return keepLatestAttemptArtifacts(arts), nil
+}
+
+// keepLatestAttemptArtifacts keeps, per name, only the artifacts of the newest attempt that has it.
+// A v3 artifact is one row per uploaded file, so the whole group of the winning attempt is kept.
+func keepLatestAttemptArtifacts(arts []*ActionArtifact) []*ActionArtifact {
+	latest := make(map[string]int64)
+	for _, art := range arts {
+		latest[art.ArtifactName] = max(latest[art.ArtifactName], art.RunAttemptID)
+	}
+	return slices.DeleteFunc(arts, func(art *ActionArtifact) bool {
+		return art.RunAttemptID != latest[art.ArtifactName]
+	})
+}
+
 // ActionArtifactMeta is the meta-data of an artifact
 type ActionArtifactMeta struct {
 	ArtifactName string

models/actions/artifact_test.go

@@ -0,0 +1,27 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestKeepLatestAttemptArtifacts(t *testing.T) {
+	arts := []*ActionArtifact{
+		{ID: 1, RunAttemptID: 1, ArtifactName: "inherited"},
+		{ID: 2, RunAttemptID: 1, ArtifactName: "shadowed", ArtifactPath: "a.txt"},
+		{ID: 3, RunAttemptID: 1, ArtifactName: "shadowed", ArtifactPath: "b.txt"},
+		{ID: 4, RunAttemptID: 2, ArtifactName: "shadowed", ArtifactPath: "c.txt"},
+		{ID: 5, RunAttemptID: 2, ArtifactName: "own"},
+	}
+
+	// the whole "shadowed" group of attempt 1 is dropped, its multi-file rows must not mix with attempt 2
+	var ids []int64
+	for _, art := range keepLatestAttemptArtifacts(arts) {
+		ids = append(ids, art.ID)
+	}
+	assert.Equal(t, []int64{1, 4, 5}, ids)
+}

models/actions/run_attempt.go

@@ -11,6 +11,7 @@ import (
 
 	"gitea.dev/models/db"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"
@@ -96,6 +97,56 @@ func GetRunAttemptByRunIDAndAttemptNum(ctx context.Context, runID, attemptNum in
 	return &attempt, nil
 }
 
+// GetArtifactAttemptIDs returns the IDs of the attempts whose artifacts the job may read, newest first,
+// always including the job's own attempt.
+// An attempt that re-ran only some of the run's jobs keeps the artifacts of the attempt it re-ran from,
+// because the jobs it passed through never upload them again; a rerun of the whole run starts over.
+func GetArtifactAttemptIDs(ctx context.Context, job *ActionRunJob) ([]int64, error) {
+	if job.Attempt <= 1 || job.RunAttemptID == 0 {
+		return []int64{job.RunAttemptID}, nil
+	}
+
+	attempts, err := ListRunAttemptsByRunID(ctx, job.RunID)
+	if err != nil {
+		return nil, err
+	}
+	// a newer attempt is never readable, and attempt 1 has nothing older to continue into
+	candidateIDs := container.FilterSlice(attempts, func(a *ActionRunAttempt) (int64, bool) {
+		return a.ID, a.Attempt > 1 && a.Attempt <= job.Attempt
+	})
+	passThroughAttemptIDs, err := findPassThroughAttemptIDs(ctx, candidateIDs)
+	if err != nil {
+		return nil, err
+	}
+
+	ids := make([]int64, 0, len(attempts))
+	for _, attempt := range attempts {
+		if attempt.Attempt > job.Attempt {
+			continue
+		}
+		ids = append(ids, attempt.ID)
+		if !slices.Contains(passThroughAttemptIDs, attempt.ID) {
+			// stops at the first attempt that passed no job through
+			break
+		}
+	}
+	return ids, nil
+}
+
+// findPassThroughAttemptIDs narrows the given attempts to those that were a rerun of selected jobs:
+// only such a rerun clones jobs carrying a source task.
+// TODO: best-effort. Needs a better way to distinguish between "partial re-run" and "full re-run".
+func findPassThroughAttemptIDs(ctx context.Context, attemptIDs []int64) ([]int64, error) {
+	passThroughAttemptIDs := make([]int64, 0, len(attemptIDs))
+	return passThroughAttemptIDs, db.GetEngine(ctx).
+		Table("action_run_job").
+		Cols("run_attempt_id").
+		In("run_attempt_id", attemptIDs).
+		Where("source_task_id <> 0").
+		Distinct("run_attempt_id").
+		Find(&passThroughAttemptIDs)
+}
+
 // FindConcurrentRunAttempts returns attempts in the given concurrency group and status set.
 // Results are unordered; callers must not depend on any particular row order.
 func FindConcurrentRunAttempts(ctx context.Context, repoID int64, concurrencyGroup string, statuses []Status) ([]*ActionRunAttempt, error) {