# download-artifact

Download Forgejo Actions artifacts by name or pattern. Thin wrapper around `forgejo/download-artifact` pinned to a specific commit SHA to prevent supply chain attacks.

## Inputs

| Input | Required | Default | Description |
|-------|----------|---------|-------------|
| `name` | No | `""` | Exact artifact name or glob pattern (e.g. `blob-report-*`). If omitted, all artifacts for the run are downloaded. |
| `path` | No | `.` | Local destination directory |
| `merge-multiple` | No | `false` | When true, merge all matched artifacts into a single directory |

## Usage

Download a single artifact by name:

```yaml
- uses: https://schmalz-git.git.onstackit.cloud/schmalz/shared-actions/download-artifact@download-artifact-v1
  with:
    name: my-artifact
    path: dist/
```

Download all artifacts matching a pattern and merge into one directory:

```yaml
- uses: https://schmalz-git.git.onstackit.cloud/schmalz/shared-actions/download-artifact@download-artifact-v1
  with:
    name: blob-report-*
    path: all-blob-reports/
    merge-multiple: "true"
```

Download all artifacts for the run:

```yaml
- uses: https://schmalz-git.git.onstackit.cloud/schmalz/shared-actions/download-artifact@download-artifact-v1
  with:
    path: artifacts/
```

## Notes

- Wraps `forgejo/download-artifact` v4 (node20), compatible with Ubuntu 22 runners.
- The underlying action is pinned to a commit SHA rather than a mutable tag to prevent supply chain attacks.
- When `merge-multiple` is false (default), each matched artifact is extracted into its own subdirectory under `path`.