[llvm-branch-commits] [llvm] release/23.x: workflows/upload-release-artifact: Make this action self-contained (#213828) (PR #214290)

[Douglas Yung via llvm-branch-commits]

https://github.com/dyung updated https://github.com/llvm/llvm-project/pull/214290

>From fdf8b84c79164e6f8bcbabcf7f6f79cbe4e20b1f Mon Sep 17 00:00:00 2001
From: Tom Stellard <tstellar at redhat.com>
Date: Wed, 5 Aug 2026 10:25:05 -0700
Subject: [PATCH] workflows/upload-release-artifact: Make this action
 self-contained (#213828)

The action now checks out its own files so calling workflows don't need
to do this.  This helps prevent mistakes where the calling workflow
does not checkout the right files causing this action to fail.

(cherry picked from commit 4e725a2c756f32c4fe7512d9b30c6bf831e4d4a5)
---
 .../upload-release-artifact/action.yml        | 29 +++++++++++++------
 1 file changed, 20 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/upload-release-artifact/action.yml b/.github/workflows/upload-release-artifact/action.yml
index 81a7e906ae150..c91e238ac0fab 100644
--- a/.github/workflows/upload-release-artifact/action.yml
+++ b/.github/workflows/upload-release-artifact/action.yml
@@ -41,6 +41,13 @@ inputs:
 runs:
   using: "composite"
   steps:
+    - name: Check Permissions
+      uses: $/.github/workflows/require-team-membership
+      with:
+        team-slug: llvm-release-managers
+        LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ inputs.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
+        LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ inputs.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}
+
     - name: Validate Input
       uses: $/.github/workflows/validate-release-version
       with:
@@ -94,19 +101,23 @@ runs:
         name: ${{ inputs.attestation-name }}
         path: |
           *.jsonl
+    
+    # Checkout the files used by this action.
+    - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      if: inputs.upload == 'true'
+      with:
+        persist-credentials: false
+        path: upload-release-artifact
+        sparse-checkout: |
+           llvm/utils/release/github-upload-release.py
+           llvm/utils/git/requirements.txt
+        sparse-checkout-cone-mode: false
 
     - name: Install Python Requirements
       if: inputs.upload == 'true'
       shell: bash
       run: |
-        pip install --require-hashes -r ./llvm/utils/git/requirements.txt
-
-    - name: Check Permissions
-      uses: $/.github/workflows/require-team-membership
-      with:
-        team-slug: llvm-release-managers
-        LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ inputs.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
-        LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ inputs.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}
+        pip install --require-hashes -r ./upload-release-artifact/llvm/utils/git/requirements.txt
 
     - name: Upload Release
       shell: bash
@@ -115,7 +126,7 @@ runs:
         INPUTS_RELEASE_VERSION: ${{ inputs.release-version }}
         DOWNLOAD_PATH: ${{ steps.download-artifact.outputs.download-path }}
       run: |
-        ./llvm/utils/release/github-upload-release.py \
+        ./upload-release-artifact/llvm/utils/release/github-upload-release.py \
         --token ${{ github.token }} \
         --release "$INPUTS_RELEASE_VERSION" \
         upload \