feat: add upload-artifact safe output type for run-scoped GitHub Actions artifact uploads

.github/workflows/shared/safe-output-upload-artifact.md

@@ -0,0 +1,58 @@
+---
+safe-outputs:
+  upload-artifact:
+    max-uploads: 3
+    default-retention-days: 7
+    max-retention-days: 30
+    allow:
+      skip-archive: true
+---
+
+<!--
+# Shared Upload Artifact Safe Output Configuration
+
+This shared workflow enables the `upload_artifact` safe output tool, which lets AI agents
+upload files as run-scoped GitHub Actions artifacts.
+
+## How it works
+
+The agent stages files to `$RUNNER_TEMP/gh-aw/safeoutputs/upload-artifacts/` and calls the
+`upload_artifact` tool. The `safe_outputs` job picks up the staged files and uploads them
+directly via the `@actions/artifact` REST API (no `actions: write` permission needed —
+authentication uses `ACTIONS_RUNTIME_TOKEN` which is always available to the runner).
+
+The tool returns a temporary opaque artifact ID (`tmp_artifact_*`) that can be resolved to
+a download URL by an authorised downstream step.
+
+## Usage
+
+Import this shared workflow to enable `upload_artifact` in any workflow:
+
+```yaml
+imports:
+  - shared/safe-output-upload-artifact.md
+```
+
+The agent must stage files before calling the tool:
+
+```bash
+# Stage files to the upload-artifacts directory
+cp dist/report.json $RUNNER_TEMP/gh-aw/safeoutputs/upload-artifacts/report.json
+```
+
+Then call the tool:
+
+```json
+{ "type": "upload_artifact", "path": "report.json", "retention_days": 7 }
+```
+
+## Configuration defaults
+
+- `max-uploads`: 3 uploads per run
+- `default-retention-days`: 7 days
+- `max-retention-days`: 30 days
+- `allow.skip-archive`: true (single-file uploads can skip zip archiving)
+
+Override any of these by defining `upload-artifact` directly in your workflow's
+`safe-outputs` section (the top-level definition takes precedence over the import).
+-->

.github/workflows/smoke-copilot.md

@@ -49,6 +49,12 @@ runtimes:
     version: "1.25"
 safe-outputs:
     allowed-domains: [default-safe-outputs]
+    upload-artifact:
+      max-uploads: 1
+      default-retention-days: 1
+      max-retention-days: 1
+      allow:
+        skip-archive: true
     add-comment:
       allowed-repos: ["github/gh-aw"]
       hide-older-comments: true
@@ -140,9 +146,10 @@ strict: false
    - Extract the discussion number from the result (e.g., if the result is `{"number": 123, "title": "...", ...}`, extract 123)
    - Use the `add_comment` tool with `discussion_number: <extracted_number>` to add a fun, playful comment stating that the smoke test agent was here
 9. **Build gh-aw**: Run `GOCACHE=/tmp/go-cache GOMODCACHE=/tmp/go-mod make build` to verify the agent can successfully build the gh-aw project (both caches must be set to /tmp because the default cache locations are not writable). If the command fails, mark this test as ❌ and report the failure.
-10. **Discussion Creation Testing**: Use the `create_discussion` safe-output tool to create a discussion in the announcements category titled "copilot was here" with the label "ai-generated"
-11. **Workflow Dispatch Testing**: Use the `dispatch_workflow` safe output tool to trigger the `haiku-printer` workflow with a haiku as the message input. Create an original, creative haiku about software testing or automation.
-12. **PR Review Testing**: Review the diff of the current pull request. Leave 1-2 inline `create_pull_request_review_comment` comments on specific lines, then call `submit_pull_request_review` with a brief body summarizing your review and event `COMMENT`. To test `reply_to_pull_request_review_comment`: use the `pull_request_read` tool (with `method: "get_review_comments"` and `pullNumber: ${{ github.event.pull_request.number }}`) to fetch the PR's existing review comments, then reply to the most recent one using `reply_to_pull_request_review_comment` with its actual numeric `id` as the `comment_id`. Note: `create_pull_request_review_comment` does not return a `comment_id` — you must fetch existing comment IDs from the GitHub API. If the PR has no existing review comments, skip the reply sub-test.
+10. **Upload gh-aw binary as artifact**: After a successful build, use bash to copy the `./gh-aw` binary into the staging directory (`mkdir -p $RUNNER_TEMP/gh-aw/safeoutputs/upload-artifacts && cp ./gh-aw $RUNNER_TEMP/gh-aw/safeoutputs/upload-artifacts/gh-aw`), then call the `upload_artifact` safe-output tool with `path: "gh-aw"`, `retention_days: 1`, and `skip_archive: true`. The `upload_artifact` tool is available and configured in this workflow run — use it directly, do NOT use `missing_tool` for it. Mark this test as ❌ if the build in step 9 failed.
+11. **Discussion Creation Testing**: Use the `create_discussion` safe-output tool to create a discussion in the announcements category titled "copilot was here" with the label "ai-generated"
+12. **Workflow Dispatch Testing**: Use the `dispatch_workflow` safe output tool to trigger the `haiku-printer` workflow with a haiku as the message input. Create an original, creative haiku about software testing or automation.
+13. **PR Review Testing**: Review the diff of the current pull request. Leave 1-2 inline `create_pull_request_review_comment` comments on specific lines, then call `submit_pull_request_review` with a brief body summarizing your review and event `COMMENT`. To test `reply_to_pull_request_review_comment`: use the `pull_request_read` tool (with `method: "get_review_comments"` and `pullNumber: ${{ github.event.pull_request.number }}`) to fetch the PR's existing review comments, then reply to the most recent one using `reply_to_pull_request_review_comment` with its actual numeric `id` as the `comment_id`. Note: `create_pull_request_review_comment` does not return a `comment_id` — you must fetch existing comment IDs from the GitHub API. If the PR has no existing review comments, skip the reply sub-test.
 
 ## Output
 

actions/setup/action.yml

@@ -10,6 +10,10 @@ inputs:
     description: 'Install @actions/github for handlers that use a per-handler github-token (creates Octokit via getOctokit)'
     required: false
     default: 'false'
+  safe-output-artifact-client:
+    description: 'Install @actions/artifact so upload_artifact.cjs can upload GitHub Actions artifacts via REST API directly'
+    required: false
+    default: 'false'
   job-name:
     description: 'Name of the job being set up. When OTEL_EXPORTER_OTLP_ENDPOINT is configured, a gh-aw.<job-name>.setup span is pushed to the OTLP endpoint.'
     required: false

actions/setup/js/package.json

@@ -1,5 +1,6 @@
 {
   "devDependencies": {
+    "@actions/artifact": "^6.0.0",
     "@actions/core": "^3.0.0",
     "@actions/exec": "^3.0.0",
     "@actions/github": "^9.0.0",

actions/setup/js/safe_output_handler_manager.cjs

@@ -74,6 +74,7 @@ const HANDLER_MAP = {
   create_project: "./create_project.cjs",
   create_project_status_update: "./create_project_status_update.cjs",
   update_project: "./update_project.cjs",
+  upload_artifact: "./upload_artifact.cjs",
 };
 
 /**