name: Schmalz Download Artifact
description: >
  Download Forgejo Actions artifacts by name or pattern.
  Thin wrapper around forgejo/download-artifact, pinned to a specific SHA.

inputs:
  name:
    description: Exact artifact name or glob pattern (e.g. 'blob-report-*'). If omitted, all artifacts for the run are downloaded.
    required: false
    default: ""
  path:
    description: Local destination directory
    required: false
    default: "."
  merge-multiple:
    description: When true, merge all matched artifacts into a single directory
    required: false
    default: "false"

runs:
  using: composite
  steps:
    # Pinned to commit SHA instead of a tag to prevent supply chain attacks.
    # forgejo/download-artifact v4 — https://code.forgejo.org/forgejo/download-artifact/commits/tag/v4
    - name: Download artifact
      uses: https://code.forgejo.org/forgejo/download-artifact@d8d0a99033603453ad2255e58720b460a0555e1e
      with:
        name: ${{ inputs.name }}
        path: ${{ inputs.path }}
        merge-multiple: ${{ inputs.merge-multiple }}