Summary

act's v4 artifact server (pkg/artifacts/artifacts_v4.go) cannot complete an upload from actions/upload-artifact@v7 (and the matching download-artifact@v8). The artifact handoff between jobs fails, which breaks any workflow that uses the current major versions of the official artifact actions locally.

There are two independent failures:

1. unknown field "mime_type" (upload fails at CreateArtifact)

parseProtbufBody decodes request bodies with a strict protojson.Unmarshal, which errors on any field not present in act's vendored protobuf. upload-artifact@v7 adds a mime_type field to the artifact requests:

level=error msg="Error decode request body: proto: (line 1:184): unknown field \"mime_type\""

2. Error unauthorized (upload fails on the blob UploadArtifact PUT)

After fixing (1), the upload then fails the signature check. verifySignature decodes the sig query parameter with base64.URLEncoding, which requires = padding. The Azure storage SDK that upload-artifact@v7 uses for blob upload strips the = padding when it re-serializes the signed URL to append comp=block&blockid=.... The strict decode fails silently (error is discarded), yielding an empty signature, so the HMAC comparison rejects the request:

level=error msg="Error unauthorized"

expires, artifactName, and taskID all match — only the padding-stripped sig causes the mismatch.

Reproduction

# .github/workflows/roundtrip.yml
name: roundtrip
on: push
jobs:
  up:
    runs-on: ubuntu-latest
    steps:
      - run: mkdir -p out && echo hi > out/data.txt
      - uses: actions/upload-artifact@v7
        with: { name: blob, path: out/ }
  down:
    runs-on: ubuntu-latest
    needs: up
    steps:
      - uses: actions/download-artifact@v8
        with: { name: blob }
      - run: cat data.txt

act push --artifact-server-path /tmp/artifacts

upload-artifact@v4 / download-artifact@v4 work; @v7 / @v8 fail as above.

Environment

• act 0.2.89
• actions/upload-artifact@v7, actions/download-artifact@v8

Fix

Both are narrow, backward-compatible relaxations of the request parsing:

1. Decode protobuf bodies with protojson.UnmarshalOptions{DiscardUnknown: true} — act doesn't consume mime_type, so ignoring unknown optional fields is safe and forward-compatible.
2. Decode the sig with base64.RawURLEncoding after trimming any =, accepting both the padded (v4-era) and unpadded (v7+) forms.

PR incoming. Verified end-to-end with both v4↔v4 and v7↔v8 round-trips.