artifact_metadata fine-grained permission

[smokedlinq]

Why are you starting this discussion?

Question

What GitHub Actions topic or product is this about?

Workflow Configuration

Discussion Details

I need a couple points of clarification on the latest change blog announcement regarding the artifact_metadata permission.

1. What actions does this impact? (I'm assuming this will be needed when using upload or download artifact actions...)
2. What do they mean by deprecation, will it just stop working on February 3rd?

[DavitEgoian]

• Remove artifact_metadata from your permissions: list in YAML.
• Ensure your workflows have the standard contents or actions permissions required for artifact handling.

[saitejabandaru-in]

[jsoref]

@saitejabandaru-in was this written by AI? Do you have any support for your statement?

If not, I'd hope @queenofcorgis could explain why what you posted is unwelcome.

[jsoref]

@nebuk89 the announcement in https://github.blog/changelog/2026-01-13-new-fine-grained-permission-for-artifact-metadata-is-now-generally-available/ is pretty frustrating.
Note that often the blog entries point to a corresponding discussion post. This one didn't.

It also doesn't make any mention of GHES. Which, while not something I really like to think about, is something that action authors need to think about.

There is no mention of permissions: in:

• https://github.com/actions/download-artifact/blob/main/README.md
• https://github.com/actions/upload-artifact/blob/main/README.md

This contrasts with:

• https://github.com/github/codeql-action/blob/main/README.md#workflow-permissions which while not including pemissions: (which is bad for SEO), at least includes security-events: write and a reference to contents: read.
• https://github.com/actions/labeler/blob/main/README.md#create-workflow which has permissions: and a reference to pull-requests: write
• https://github.com/actions/deploy-pages/blob/main/README.md#usage which has permissions: and references to pages: write and id-token: write

My guess is that upload-artifact + download-artifact don't count.

If I'm wrong, then it feels like this change would break any on: pull_request workflow from forks.

I think there are a whole bunch of different things all confusingly called "artifact":

• job related artifacts (upload-artifact + download-artifact)
• pages artifacts
• release artifacts
• environment things
• container registry artifacts

@indigo: This text does not help humans:
https://github.com/actions/languageservices/blob/1baa74a67edfb7d408f60973333cca930e8a5044/workflow-parser/src/workflow-v1.0.json#L1589-L1592

"artifact-metadata": {
  "type": "permission-level-any",
  "description": "Storage and deployment records for build artifacts."
},

• Create Artifact Metadata Storage Record on registry push actions/attest#313 added:
  https://github.com/actions/attest/blob/main/README.md#usage

  The id-token permission gives the action the ability to mint the OIDC token necessary to request a Sigstore signing certificate. The attestations permission is necessary to persist the attestation. The artifact-metadata permission is necessary to create the artifact storage record.

  https://github.com/actions/attest/blob/main/README.md#container-image

  If the push-to-registry option is set to true, the Action will also emit an Artifact Metadata Storage Record. If you do not want to emit a storage record, set create-storage-record to false.

• https://docs.github.com/en/code-security/tutorials/secure-your-organization/prioritize-alerts-in-production-code#storage-record-api talks about this stuff, it does not appear to be related to upload/download-artifact. It feels like it's related to provenance/attestation (and not limited to the GHCR, since the references are to JFrog and others.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬