fix(upload_assets): search all candidate staging dirs to resolve path-prefix mismatch (#39885)

The upload_assets (Push assets) job was failing with
  ERR_SYSTEM: Asset file not found: .../safeoutputs/assets/<file>.png
even though the agent job succeeded, because assets were staged under a
different base prefix than the job was reading from.

Prior fixes (#39900, #40062) aligned individual paths, but the consumer
still derived a single assetsDir — so any remaining producer/consumer
prefix disagreement (e.g. RUNNER_TEMP=/home/runner/work/_temp vs the
artifact download path /tmp/gh-aw) still hard-failed the whole job.

Fix: build a de-duplicated list of candidate staging directories
  1. parent of GH_AW_AGENT_OUTPUT (where the artifact was downloaded)
  2. RUNNER_TEMP/gh-aw (where the MCP handler staged the file at runtime)
  3. /tmp/gh-aw (canonical fallback)

The first candidate that contains the file wins. The existing fail-soft
behaviour (warn per missing file, only fail when all are missing) is
preserved. The missing-file warning now lists every directory searched.

Adds a regression test for the cross-prefix case.

Closes #39885

Author: dsyme

actions/setup/js/upload_assets.cjs

@@ -86,13 +86,28 @@ async function main() {
 
   core.info(`Found ${uploadItems.length} upload-asset item(s)`);
 
-  // Derive the base directory from GH_AW_AGENT_OUTPUT when available.
-  // In the upload_assets job, the agent artifact (including safeoutputs/assets/)
-  // is downloaded to the same parent directory as agent_output.json, which may
-  // differ from RUNNER_TEMP when the download path is explicitly set to /tmp/gh-aw/.
+  // Resolve the candidate asset staging directories.
+  //
+  // Assets can be staged under different base prefixes depending on the job and
+  // execution mode: the agent-output download directory (parent of
+  // agent_output.json), RUNNER_TEMP/gh-aw, or the canonical /tmp/gh-aw. The
+  // producer (the upload_asset MCP handler) and this consumer job do not always
+  // agree on the prefix — for example RUNNER_TEMP is /home/runner/work/_temp on
+  // GitHub-hosted runners but the artifact is downloaded to /tmp/gh-aw. Searching
+  // every candidate makes asset resolution robust to these path-prefix
+  // mismatches instead of failing the whole job.
   const agentOutputFile = process.env.GH_AW_AGENT_OUTPUT;
-  const baseDir = agentOutputFile ? path.dirname(agentOutputFile) : path.join(process.env.RUNNER_TEMP || "/tmp", "gh-aw");
-  const assetsDir = path.join(baseDir, "safeoutputs", "assets");
+  const candidateBaseDirs = [];
+  if (agentOutputFile) {
+    candidateBaseDirs.push(path.dirname(agentOutputFile));
+  }
+  if (process.env.RUNNER_TEMP) {
+    candidateBaseDirs.push(path.join(process.env.RUNNER_TEMP, "gh-aw"));
+  }
+  candidateBaseDirs.push("/tmp/gh-aw");
+  // Build the per-directory assets paths, de-duplicated while preserving order.
+  const assetsDirs = [...new Set(candidateBaseDirs.map(dir => path.join(dir, "safeoutputs", "assets")))];
+  core.info(`Searching for staged assets in: ${assetsDirs.join(", ")}`);
   let uploadCount = 0;
   let missingAssetCount = 0;
   let hasChanges = false;
@@ -130,10 +145,17 @@ async function main() {
         return;
       }
 
-      // Check if file exists in artifacts
-      const assetSourcePath = path.join(assetsDir, fileName);
-      if (!fs.existsSync(assetSourcePath)) {
-        core.warning(`${ERR_SYSTEM}: Asset file not found: ${assetSourcePath} — skipping`);
+      // Check if file exists in any of the candidate staging directories
+      let assetSourcePath = null;
+      for (const dir of assetsDirs) {
+        const candidate = path.join(dir, fileName);
+        if (fs.existsSync(candidate)) {
+          assetSourcePath = candidate;
+          break;
+        }
+      }
+      if (!assetSourcePath) {
+        core.warning(`${ERR_SYSTEM}: Asset file not found in any staging directory (${assetsDirs.join(", ")}) for ${fileName} — skipping`);
         missingAssetCount++;
         continue;
       }

actions/setup/js/upload_assets.test.cjs

@@ -175,5 +175,38 @@ const mockCore = { debug: vi.fn(), info: vi.fn(), notice: vi.fn(), warning: vi.f
             fs.existsSync(path.join(process.cwd(), presentTargetFile)) && fs.unlinkSync(path.join(process.cwd(), presentTargetFile));
           });
         });
+        describe("staging directory resolution", () => {
+          it("should find assets staged under RUNNER_TEMP when agent output dir differs", async () => {
+            process.env.GH_AW_ASSETS_BRANCH = "assets/test-workflow";
+            process.env.GH_AW_SAFE_OUTPUTS_STAGED = "false";
+            // Stage the asset under a RUNNER_TEMP-based directory, NOT under the
+            // agent-output directory (tempBase), to simulate a path-prefix mismatch.
+            const runnerTempBase = fs.mkdtempSync(path.join("/tmp", "test-gh-aw-rt-"));
+            process.env.RUNNER_TEMP = runnerTempBase;
+            const runnerAssetsDir = path.join(runnerTempBase, "gh-aw", "safeoutputs", "assets");
+            fs.mkdirSync(runnerAssetsDir, { recursive: !0 });
+            const assetSourcePath = path.join(runnerAssetsDir, "chart.png");
+            fs.writeFileSync(assetSourcePath, "chart content");
+            const crypto = require("crypto"),
+              fileContent = fs.readFileSync(assetSourcePath),
+              targetFile = "chart-uploaded.png";
+            setAgentOutput({
+              items: [{ type: "upload_asset", fileName: "chart.png", sha: crypto.createHash("sha256").update(fileContent).digest("hex"), size: fileContent.length, targetFileName: targetFile, url: "https://example.com/chart.png" }],
+            });
+            mockExec.exec.mockImplementation(async (command, args) => {
+              const fullCommand = Array.isArray(args) ? `${command} ${args.join(" ")}` : command;
+              if (fullCommand.includes("rev-parse")) throw new Error("Branch does not exist");
+              return 0;
+            });
+            await executeScript();
+            expect(mockCore.setFailed).not.toHaveBeenCalled();
+            const uploadCountCall = mockCore.setOutput.mock.calls.find(call => "upload_count" === call[0]);
+            expect(uploadCountCall).toBeDefined();
+            uploadCountCall && expect(uploadCountCall[1]).toBe("1");
+            delete process.env.RUNNER_TEMP;
+            fs.existsSync(runnerTempBase) && fs.rmSync(runnerTempBase, { recursive: !0, force: !0 });
+            fs.existsSync(path.join(process.cwd(), targetFile)) && fs.unlinkSync(path.join(process.cwd(), targetFile));
+          });
+        });
       }));
   }));