From ed1fbc5674cc0173f61174dc6cd25b79a269ac13 Mon Sep 17 00:00:00 2001
From: localai-org-maint-bot <bot-opensource@localaisrl.com>
Date: Sun, 4 Oct 2026 08:46:59 +0200
Subject: [PATCH] fix(ci): list all release digest artifacts (#12467)

Large release runs exceed the artifact API limit of 1,000 items.
Use authenticated public API pagination and set its limit from the run
artifact count so manifest jobs can find their existing digests.

Assisted-by: Codex:gpt-6

Co-authored-by: localai-org-maint-bot <306269227+localai-org-maint-bot@users.noreply.github.com>
---
 .github/workflows/backend_merge.yml | 14 ++++++++++++++
 .github/workflows/image_merge.yml   | 16 ++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/.github/workflows/backend_merge.yml b/.github/workflows/backend_merge.yml
index 9aa996011..f6cbc987e 100644
--- a/.github/workflows/backend_merge.yml
+++ b/.github/workflows/backend_merge.yml
@@ -36,6 +36,7 @@ jobs:
     # signs each pushed manifest. Without this permission the runner
     # cannot mint the token, and `cosign sign` fails with "no token".
     permissions:
+      actions: read
       contents: read
       id-token: write
     env:
@@ -59,9 +60,22 @@ jobs:
       # backends whose tag-suffix happens to be a prefix of ours
       # (e.g. -cpu-vllm vs -cpu-vllm-omni). Must stay in sync with the
       # upload-artifact name in backend_build.yml.
+      # The internal artifact API truncates large release runs at 1,000 items.
+      # Use the paginated public API with a limit taken from this run.
+      - name: Count run artifacts
+        id: artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          count=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts?per_page=1" --jq .total_count)
+          echo "count=$count" >> "$GITHUB_OUTPUT"
+
       - name: Download digests
         uses: actions/download-artifact@v8
+        env:
+          ACTIONS_ARTIFACT_MAX_ARTIFACT_COUNT: ${{ steps.artifacts.outputs.count }}
         with:
+          github-token: ${{ github.token }}
           pattern: digests${{ inputs.tag-suffix }}--*
           merge-multiple: true
           path: /tmp/digests
diff --git a/.github/workflows/image_merge.yml b/.github/workflows/image_merge.yml
index 18d64d407..94fc0aeff 100644
--- a/.github/workflows/image_merge.yml
+++ b/.github/workflows/image_merge.yml
@@ -30,6 +30,9 @@ on:
 jobs:
   merge:
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
     env:
       quay_username: ${{ secrets.quayUsername }}
     steps:
@@ -42,9 +45,22 @@ jobs:
             .github/scripts
           sparse-checkout-cone-mode: false
 
+      # The internal artifact API truncates large release runs at 1,000 items.
+      # Use the paginated public API with a limit taken from this run.
+      - name: Count run artifacts
+        id: artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          count=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts?per_page=1" --jq .total_count)
+          echo "count=$count" >> "$GITHUB_OUTPUT"
+
       - name: Download digests
         uses: actions/download-artifact@v8
+        env:
+          ACTIONS_ARTIFACT_MAX_ARTIFACT_COUNT: ${{ steps.artifacts.outputs.count }}
         with:
+          github-token: ${{ github.token }}
           # `--` separator anchors the glob so we don't over-match sibling
           # tag-suffixes (e.g. -nvidia-l4t-arm64 vs -nvidia-l4t-arm64-cuda-13).
           # Must stay in sync with image_build.yml's upload-artifact name.