fix: find release artifacts across multiple workflow runs

src/github/GithubClient.ts

@@ -227,11 +227,11 @@ export class GithubClient {
    * Lists the workflow run artifacts for a completed workflow
    * @param branch the branch name
    */
-  async findLatestWorkflowRunForBranch({
+  async findLatestWorkflowRunsForBranch({
     branch,
   }: {
     branch: string;
-  }): Promise<WorkflowRun | undefined> {
+  }): Promise<WorkflowRun[] | undefined> {
     const response = await this.client.rest.actions.listWorkflowRunsForRepo({
       ...this.repo,
       branch,
@@ -240,13 +240,13 @@ export class GithubClient {
       page: 1,
     });
 
-    debugLog("findLatestWorkflowRunForBranch response:", response);
+    debugLog("findLatestWorkflowRunsForBranch response:", response);
 
     if (response.status >= 400) {
-      throw new Error("Unable to findLatestWorkflowRunForBranch");
+      throw new Error("Unable to findLatestWorkflowRunsForBranch");
     }
 
-    return response.data.workflow_runs[0];
+    return response.data.workflow_runs;
   }
 
   /**

src/github/SyftGithubAction.ts

@@ -349,28 +349,34 @@ async function comparePullRequestTargetArtifact(): Promise<void> {
     const client = getClient(repo, core.getInput("github-token"));
 
     const pr = (payload as PullRequestEvent).pull_request;
-    const branchWorkflow = await client.findLatestWorkflowRunForBranch({
+    const branchWorkflows = await client.findLatestWorkflowRunsForBranch({
       branch: pr.base.ref,
     });
 
-    debugLog("Got branchWorkflow:", branchWorkflow);
+    if (!branchWorkflows) {
+      return;
+    }
 
-    if (branchWorkflow) {
-      const baseBranchArtifacts = await client.listWorkflowRunArtifacts({
-        runId: branchWorkflow.id,
-      });
+    for (const branchWorkflow of branchWorkflows) {
+      debugLog("Got branchWorkflow:", branchWorkflow);
 
-      debugLog("Got baseBranchArtifacts:", baseBranchArtifacts);
+      if (branchWorkflow) {
+        const baseBranchArtifacts = await client.listWorkflowRunArtifacts({
+          runId: branchWorkflow.id,
+        });
 
-      for (const artifact of baseBranchArtifacts) {
-        if (artifact.name === getArtifactName()) {
-          const baseArtifact = await client.downloadWorkflowRunArtifact({
-            artifactId: artifact.id,
-          });
+        debugLog("Got baseBranchArtifacts:", baseBranchArtifacts);
 
-          core.info(
-            `Downloaded SBOM from ref '${pr.base.ref}' to ${baseArtifact}`,
-          );
+        for (const artifact of baseBranchArtifacts) {
+          if (artifact.name === getArtifactName()) {
+            const baseArtifact = await client.downloadWorkflowRunArtifact({
+              artifactId: artifact.id,
+            });
+
+            core.info(
+              `Downloaded SBOM from ref '${pr.base.ref}' to ${baseArtifact}`,
+            );
+          }
         }
       }
     }
@@ -519,7 +525,7 @@ export async function attachReleaseAssets(): Promise<void> {
     const matcher = new RegExp(sbomArtifactPattern);
 
     const artifacts = await client.listCurrentWorkflowArtifacts();
-    let matched = artifacts.filter((a) => {
+    const matched = artifacts.filter((a) => {
       const matches = matcher.test(a.name);
       if (matches) {
         core.debug(`Found artifact: ${a.name}`);
@@ -534,28 +540,36 @@ export async function attachReleaseAssets(): Promise<void> {
       core.info(
         "No artifacts found in this workflow. Searching for release artifacts from prior workflow...",
       );
-      const latestRun = await client.findLatestWorkflowRunForBranch({
+      const latestRuns = await client.findLatestWorkflowRunsForBranch({
         branch: release.target_commitish,
       });
 
-      debugLog("Got latest run for prior workflow", latestRun);
+      if (!latestRuns) {
+        return;
+      }
 
-      if (latestRun) {
-        const runArtifacts = await client.listWorkflowRunArtifacts({
-          runId: latestRun.id,
-        });
+      for (const latestRun of latestRuns) {
+        debugLog("Got latest run for prior workflow", latestRun);
 
-        matched = runArtifacts.filter((a) => {
-          const matches = matcher.test(a.name);
-          if (matches) {
-            core.debug(`Found run artifact: ${a.name}`);
-          } else {
-            core.debug(
-              `Run artifact: ${a.name} not matching ${sbomArtifactPattern}`,
-            );
-          }
-          return matches;
-        });
+        if (latestRun) {
+          const runArtifacts = await client.listWorkflowRunArtifacts({
+            runId: latestRun.id,
+          });
+
+          matched.push(
+            ...runArtifacts.filter((a) => {
+              const matches = matcher.test(a.name);
+              if (matches) {
+                core.debug(`Found run artifact: ${a.name}`);
+              } else {
+                core.debug(
+                  `Run artifact: ${a.name} not matching ${sbomArtifactPattern}`,
+                );
+              }
+              return matches;
+            }),
+          );
+        }
       }
     }
 

tests/GithubClient.test.ts

@@ -1,6 +1,7 @@
 import test, { describe, it, beforeEach, mock } from "node:test";
 import assert from "node:assert";
 import { getMocks } from "./mocks";
+import type { Release, WorkflowRun } from "@octokit/webhooks-types";
 
 const { data, mocks, setData, restoreInitialData } = getMocks(test);
 
@@ -11,8 +12,6 @@ for (const [name, factory] of Object.entries(mocks)) {
 
 mock.method(Date, "now", () => 1482363367071);
 
-import type { Release } from "@octokit/webhooks-types";
-
 const githubClient = await import("../src/github/GithubClient");
 const { debugLog } = githubClient;
 
@@ -71,23 +70,24 @@ describe("Github Client", { timeout: 30000 }, () => {
   });
 
   it("calls workflow run for branch methods", async () => {
+    const expected: Partial<WorkflowRun>[] = [
+      {
+        id: 3,
+        head_branch: "main",
+        conclusion: "success",
+      },
+    ];
     setData({
-      workflowRuns: [
-        {
-          id: 3,
-          head_branch: "main",
-          conclusion: "success",
-        },
-      ],
+      workflowRuns: expected,
     });
     const client = githubClient.getClient(
       { owner: "test-owner", repo: "test-repo" },
       "token"
     );
-    const run: any = await client.findLatestWorkflowRunForBranch({
+    const runs: any = await client.findLatestWorkflowRunsForBranch({
       branch: "main",
     });
-    assert.equal(run.id, 3);
+    assert.deepEqual(runs, expected);
   });
 
   it("calls findRelease methods", async () => {
@@ -201,7 +201,7 @@ describe("Github Client", { timeout: 30000 }, () => {
     }
 
     try {
-      await client.findLatestWorkflowRunForBranch({
+      await client.findLatestWorkflowRunsForBranch({
         branch: "main",
       });
       assert.fail("exception should be thrown");