[llvm] workflows/upload-release-artifact: Make this action self-contained (PR #213484)

[Tom Stellard via llvm-commits]

https://github.com/tstellar created https://github.com/llvm/llvm-project/pull/213484

The action now checks out its own files so calling worklfows don't need
to do this.  This helps prevent mistakes where the calling workflow
does not checkout the right files causing this action to fail.

>From 8f972e354b85d8722bade6fc3b38c429b1996d96 Mon Sep 17 00:00:00 2001
From: Tom Stellard <tstellar at redhat.com>
Date: Fri, 31 Jul 2026 14:38:10 -0700
Subject: [PATCH 1/2] workflows/upload-release-artifact: Use new
 self-repository reference

This is for composite actions.

https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax/
---
 .github/workflows/upload-release-artifact/action.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/upload-release-artifact/action.yml b/.github/workflows/upload-release-artifact/action.yml
index ce0ec9a13b9b9..81a7e906ae150 100644
--- a/.github/workflows/upload-release-artifact/action.yml
+++ b/.github/workflows/upload-release-artifact/action.yml
@@ -42,7 +42,7 @@ runs:
   using: "composite"
   steps:
     - name: Validate Input
-      uses: ./.github/workflows/validate-release-version
+      uses: $/.github/workflows/validate-release-version
       with:
         release-version: ${{ inputs.release-version }}
 
@@ -102,7 +102,7 @@ runs:
         pip install --require-hashes -r ./llvm/utils/git/requirements.txt
 
     - name: Check Permissions
-      uses: ./.github/workflows/require-team-membership
+      uses: $/.github/workflows/require-team-membership
       with:
         team-slug: llvm-release-managers
         LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ inputs.LLVM_TOKEN_GENERATOR_CLIENT_ID }}

>From eb7ff99507472154f3b8a9405434f9bac155ed77 Mon Sep 17 00:00:00 2001
From: Tom Stellard <tstellar at redhat.com>
Date: Sat, 1 Aug 2026 09:28:18 -0700
Subject: [PATCH 2/2] workflows/upload-release-artifact: Make this action
 self-contained

The action now checks out its own files so calling worklfows don't need
to do this.  This helps prevent mistakes where the calling workflow
does not checkout the right files causing this action to fail.
---
 .../upload-release-artifact/action.yml        | 28 +++++++++++++------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/upload-release-artifact/action.yml b/.github/workflows/upload-release-artifact/action.yml
index 81a7e906ae150..0ad5100f8de71 100644
--- a/.github/workflows/upload-release-artifact/action.yml
+++ b/.github/workflows/upload-release-artifact/action.yml
@@ -41,6 +41,23 @@ inputs:
 runs:
   using: "composite"
   steps:
+    - name: Check Permissions
+      uses: $/.github/workflows/require-team-membership
+      with:
+        team-slug: llvm-release-managers
+        LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ inputs.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
+        LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ inputs.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}
+
+    # Checkout the files used by this action.
+     - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+       with:
+         persist-credentials: false
+         path: upload-release-artifact
+         sparse-checkout: |
+            llvm/utils/release/github-upload-release.py
+            llvm/utils/git/requirements.txt
+         sparse-checkout-cone-mode: false
+
     - name: Validate Input
       uses: $/.github/workflows/validate-release-version
       with:
@@ -99,14 +116,7 @@ runs:
       if: inputs.upload == 'true'
       shell: bash
       run: |
-        pip install --require-hashes -r ./llvm/utils/git/requirements.txt
-
-    - name: Check Permissions
-      uses: $/.github/workflows/require-team-membership
-      with:
-        team-slug: llvm-release-managers
-        LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ inputs.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
-        LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ inputs.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}
+        pip install --require-hashes -r ./upload-release-artifact/llvm/utils/git/requirements.txt
 
     - name: Upload Release
       shell: bash
@@ -115,7 +125,7 @@ runs:
         INPUTS_RELEASE_VERSION: ${{ inputs.release-version }}
         DOWNLOAD_PATH: ${{ steps.download-artifact.outputs.download-path }}
       run: |
-        ./llvm/utils/release/github-upload-release.py \
+        ./upload-release-artifact/llvm/utils/release/github-upload-release.py \
         --token ${{ github.token }} \
         --release "$INPUTS_RELEASE_VERSION" \
         upload \