fix: wipe run artifacts before rerun (#12523)

Forgejo Actions keeps one set of artifacts per workflow run -- those of the latest workflow run. If a particular workflow run is rerun, Forgejo is supposed to remove outdated artifacts. However, it does not do that. As a result, the user is presented a mix of outdated and new artifacts, even within the same archive.

This is remedied by wiping the artifacts before each rerun. The same happens when only one or more jobs are rerun, which also matches the behaviour of GitHub Actions. In the example below, when only rerunning `artifacts-two`, `many-artifacts-one` would disappear and a new version of `many-artifacts-two` would be made available.

Reproducer:

```yaml
on:
  push:
jobs:
  artifacts-one:
    runs-on: ubuntu-latest
    steps:
      - run: mkdir -p artifacts-one
      - run: |
          if [[ "${{ github.run_attempt}}" == 1 ]] ; then echo "${{ github.run_attempt}}" > artifacts-one/ONE; fi
          echo "${{ github.run_attempt}}" > artifacts-one/TWO
      - uses: forgejo/upload-artifact@v4
        with:
          name: many-artifacts-one
          path: artifacts-one/
  artifacts-two:
    runs-on: ubuntu-latest
    steps:
      - run: mkdir -p artifacts-two
      - run: |
          if [[ "${{ github.run_attempt}}" == 1 ]] ; then echo "${{ github.run_attempt}}" > artifacts-two/ONE; fi
          echo "${{ github.run_attempt}}" > artifacts-two/TWO
      - uses: forgejo/upload-artifact@v4
        with:
          name: many-artifacts-two
          path: artifacts-two/
```

Resolves https://codeberg.org/forgejo/forgejo/issues/12163.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

(can be removed for JavaScript changes)

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Tests for JavaScript changes

(can be removed for Go changes)

- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

*The decision if the pull request will be shown in the release notes is up to the mergers / release team.*

The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12523
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>

services/actions/TestRerun_RerunAllJobs/action_artifact.yml

@@ -0,0 +1,11 @@
+- id: 59220
+  run_id: 455620
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  status: 2 # ArtifactStatusUploadConfirmed
+
+- id: 59230
+  run_id: 455630
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  status: 2 # ArtifactStatusUploadConfirmed

services/actions/TestRerun_RerunJob/action_artifact.yml

@@ -0,0 +1,11 @@
+- id: 59240
+  run_id: 455640
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  status: 2 # ArtifactStatusUploadConfirmed
+
+- id: 59250
+  run_id: 455650
+  repo_id: 62 # test_workflows
+  owner_id: 2 # user2
+  status: 2 # ArtifactStatusUploadConfirmed

services/actions/rerun.go

@@ -74,6 +74,12 @@ func RerunAllJobs(ctx context.Context, run *actions_model.ActionRun) ([]*actions
 			return fmt.Errorf("cannot prepare next attempt because run %d is active: %s", run.ID, run.Status.String())
 		}
 
+		// Wipe all artifacts before a rerun to prevent stale artifacts from polluting artifacts collected during the
+		// rerun.
+		if err := actions_model.SetArtifactsOfRunDeleted(ctx, run.ID); err != nil {
+			return fmt.Errorf("cannot remove artifacts of previous run of run %d: %w", run.ID, err)
+		}
+
 		run.PreviousDuration = run.Duration()
 
 		run.Status = actions_model.StatusWaiting
@@ -138,6 +144,14 @@ func RerunJob(ctx context.Context, job *actions_model.ActionRunJob) ([]*actions_
 			return fmt.Errorf("could not load jobs of run %d: %w", job.RunID, err)
 		}
 
+		// Wipe all artifacts before a rerun to prevent stale artifacts from polluting the artifacts collected during
+		// the rerun. Because artifacts are bound to a run and not to a job, it is not possible to only remove the
+		// artifacts of the jobs that are going to be rerun. That means that artifacts created by jobs that are not
+		// rerun will be lost. That matches GitHub Actions' behaviour as of May 2026.
+		if err := actions_model.SetArtifactsOfRunDeleted(ctx, job.RunID); err != nil {
+			return fmt.Errorf("cannot remove artifacts of previous run of run %d: %w", job.RunID, err)
+		}
+
 		for _, jobToRerun := range GetAllRerunJobs(job, jobs) {
 			canBeRerun, err := jobToRerun.CanBeRerun(ctx)
 			if err != nil {

services/actions/rerun_test.go

@@ -59,6 +59,11 @@ func TestRerun_RerunAllJobs(t *testing.T) {
 
 		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 455620})
 
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: run.ID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: run.ID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 0)
+
 		rerunJobs, err := RerunAllJobs(t.Context(), run)
 		require.NoError(t, err)
 
@@ -81,6 +86,10 @@ func TestRerun_RerunAllJobs(t *testing.T) {
 		assert.Equal(t, actions_model.StatusWaiting, rerunJobs[1].Status)
 		assert.Equal(t, timeutil.TimeStamp(0), rerunJobs[1].Started)
 		assert.Equal(t, timeutil.TimeStamp(0), rerunJobs[1].Stopped)
+
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: run.ID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 1)
 	})
 
 	t.Run("Error if workflow running", func(t *testing.T) {
@@ -89,6 +98,11 @@ func TestRerun_RerunAllJobs(t *testing.T) {
 
 		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: 455630})
 
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: run.ID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: run.ID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 0)
+
 		rerunJobs, err := RerunAllJobs(t.Context(), run)
 		require.ErrorContains(t, err, "workflow is still running")
 
@@ -100,6 +114,11 @@ func TestRerun_RerunAllJobs(t *testing.T) {
 		assert.Equal(t, time.Duration(0), run.PreviousDuration)
 
 		assert.Empty(t, rerunJobs)
+
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: run.ID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: run.ID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 0)
 	})
 
 	t.Run("Error if workflow invalid", func(t *testing.T) {
@@ -153,6 +172,11 @@ func TestRerun_RerunJob(t *testing.T) {
 
 		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683910})
 
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: job.RunID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: job.RunID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 0)
+
 		rerunJobs, err := RerunJob(t.Context(), job)
 
 		require.NoError(t, err)
@@ -166,6 +190,10 @@ func TestRerun_RerunJob(t *testing.T) {
 		assert.Equal(t, actions_model.StatusWaiting, job.Status)
 		assert.Equal(t, timeutil.TimeStamp(0), job.Started)
 		assert.Equal(t, timeutil.TimeStamp(0), job.Stopped)
+
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: job.RunID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 1)
 	})
 
 	t.Run("Rerun job needed by others", func(t *testing.T) {
@@ -225,6 +253,11 @@ func TestRerun_RerunJob(t *testing.T) {
 
 		job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: 683900})
 
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: job.RunID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: job.RunID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 0)
+
 		rerunJobs, err := RerunJob(t.Context(), job)
 
 		require.ErrorContains(t, err, "workflow is invalid")
@@ -236,6 +269,11 @@ func TestRerun_RerunJob(t *testing.T) {
 		assert.Equal(t, actions_model.StatusFailure, job.Status)
 		assert.Equal(t, timeutil.TimeStamp(0), job.Started)
 		assert.Equal(t, timeutil.TimeStamp(0), job.Stopped)
+
+		unittest.AssertCount(t, &actions_model.ActionArtifact{RunID: job.RunID}, 1)
+		unittest.AssertCount(t, &actions_model.ActionArtifact{
+			RunID: job.RunID, Status: int64(actions_model.ArtifactStatusPendingDeletion),
+		}, 0)
 	})
 
 	t.Run("Error if workflow disabled", func(t *testing.T) {