immutable update fails on a technicality with the container-image-artifact-download

[teolemon]

Task

• immutable update fails on a technicality with the container-image-artifact-download
• PR with the error: build(deps-dev): bump immutable from 5.1.5 to 5.1.9 #14043
• Failing run https://github.com/openfoodfacts/openfoodfacts-server/actions/runs/29907013926/job/90277663904

Failing run log

1s
Node 20 is being deprecated. This workflow is running with Node 24 by default. If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Run ishworkh/container-image-artifact-download@v2.1.0
(node:2593) [DEP0040] DeprecationWarning: The punycode module is deprecated. Please use a userland alternative instead.
(Use node --trace-deprecation ... to show where the warning was created)
Error: ArtifactNotFoundError: Artifact not found for name: action_image_artifact_openfoodfacts-server_frontend_dev
Please ensure that your artifact is not expired and the artifact was uploaded using a compatible version of toolkit/upload-artifact.
For more information, visit the GitHub Artifacts FAQ: https://github.com/actions/toolkit/blob/main/packages/artifact/docs/faq.md

Gemini analysis

The error ArtifactNotFoundError indicates that the GitHub Action ishworkh/container-image-artifact-download@v2.1.0 is looking for an artifact named action_image_artifact_openfoodfacts-server_frontend_dev, but it cannot find it on the current workflow run.

This typically happens due to one of a few common issues in GitHub Actions workflows:

1. The Build and Download Jobs Are in Different Workflows or Split Jobs
   GitHub Actions artifacts uploaded in one job are not automatically available in a separate job unless that job explicitly depends on the upload job via needs: [upload_job_name], or if they are running across completely different workflow files (where artifacts cannot be shared directly).

2. Artifact Expiration or Missing Upload Step
   Missing Upload: The workflow that builds the container image (openfoodfacts-server/frontend:dev) might not actually be executing the upload step, or the naming convention for the uploaded artifact doesn't match what the download action expects (action_image_artifact_openfoodfacts-server_frontend_dev).

Expired Artifact: If you are trying to rerun a failed job or reference an artifact from an older workflow run, the artifact may have expired (default retention is usually 90 days, but can be configured to fewer days).

3. Branch or Fork Security Context
   If this workflow is triggering from a Pull Request originating from a fork, GitHub restricts access to secrets and sometimes artifact sharing across security boundaries for untrusted code, which can cause steps attempting to fetch built artifacts to fail.

How to Fix It
Check the Upload Step: Look at the preceding job in your .github/workflows/pull_request.yml (around line referenced: 683ea8d) that is responsible for building or saving the container image. Make sure it uses actions/upload-artifact and that the artifact name matches precisely what ishworkh/container-image-artifact-download is trying to consume.

Verify Job Dependencies (needs): Ensure the job running ishworkh/container-image-artifact-download has a needs: statement pointing directly to the job that uploaded the container image artifact.

Node 20 Warning Note: The warning [DEP0040] DeprecationWarning: The punycode module is deprecated comes from an older dependency inside the action itself running on newer Node runtimes (like Node 24). While it's just a warning and not what's causing the ArtifactNotFoundError, the action maintainer will likely need to update their dependencies.