[aw-failures] P1: upload_artifact safe-output sends malformed CreateArtifact request → 400, fails safe_outputs job

[github-actions]

Problem

The upload_artifact safe-output handler emits a malformed CreateArtifact request to the GitHub Actions artifact API, returning HTTP 400 and failing the entire safe_outputs job — even though the agent and all other safe-outputs (e.g. create_discussion) succeed.

Affected workflows & runs

• Smoke Copilot — run 27451309410 (confirmed). Agent succeeded (19 turns, 873k tokens); create_discussion succeeded (discussion #38988); only upload_artifact failed and marked the whole job failed.
• Smoke Copilot family failed repeatedly in the last 6h: runs 27451309410, 27447675349, 27444195593, 27443692618, 27439104838. Smoke Copilot is at ~95% failure (19/20 recent runs).
• Related but distinct: [aw] Smoke Copilot - AOAI (apikey) is missing required tool #38991 / [aw] Smoke Copilot is missing required tool #38967 report upload_artifact as "tool not available" in AOAI variants — confirm whether the same handler path is involved.

Evidence

✗ Message 1 (upload_artifact) failed: ERR_VALIDATION: upload_artifact: failed to upload
artifact "gh-aw": artifact twirp CreateArtifact failed (400):
{"code":"malformed","msg":"the json request could not be decoded"}

Probable root cause

The upload_artifact handler constructs an invalid JSON body for the artifact-service CreateArtifact (twirp) endpoint, so the server rejects it with 400 malformed: the json request could not be decoded. Because a single failed safe-output message fails the whole safe_outputs job, a non-critical artifact upload takes down the run.

Proposed remediation

1. Inspect the upload_artifact request-body construction; validate it against the current artifact-service CreateArtifact schema (field names/types, encoding).
2. Add request-payload validation + a clear error before the API call.
3. Treat a failed optional upload_artifact as non-fatal to the safe_outputs job (or make it configurable), so one bad upload does not fail otherwise-successful runs.

Success criteria

• Smoke Copilot safe_outputs job passes; upload_artifact produces a well-formed CreateArtifact request (no 400 malformed).
• A failing optional artifact upload no longer fails the entire safe_outputs job.

Context

Filed by [aw] Failure Investigator (6h) — analyzed run 27452598516. Parent: Workflow Health Manager Issue Group #29109.
Related to #29109

Generated by 🔍 [aw] Failure Investigator (6h) · 371.9 AIC · ⌖ 13.4 AIC · ⊞ 5.1K · ◷

• expires on Jun 19, 2026, 5:50 PM UTC-08:00

---

Still recurring — 5 fresh upload_artifact→safe_outputs failures in the 2026-06-13 19:13Z 6h window (agent step succeeded, only Process Safe Outputs failed): Smoke Copilot §27471858644, Smoke Codex §27471836485, Smoke Claude §27471836462, Design Decision Gate §27471832454, PR Sous Chef §27471203716. The failing job sets upload_artifact_count / upload_artifact_slot_0_tmp_id outputs, confirming the same handler path. No fix landed yet — keeping open.

Generated by 🔍 [aw] Failure Investigator (6h) · 395.8 AIC · ⌖ 14.4 AIC · ⊞ 5.1K · ◷

---

Signature shift — the upload_artifact CreateArtifact 400 did NOT reproduce in the 2026-06-14 01:38Z 6h window; the safe_outputs job now fails on a different handler.

Fresh audit of the Smoke safe-outputs failures this window — Smoke Claude §27480363196, Smoke Claude §27478319746, Smoke Copilot §27481382799:

1. The upload_artifact safe-output handler and the actions/upload-artifact step both succeeded in every run (artifacts finalized; upload_artifact_count / upload_artifact_slot_0_tmp_id outputs set). The CreateArtifact (400) malformed signature was not observed.
2. The safe_outputs job still fails (agent job = success), but on a distinct handler permission/context signature:
   • add_comment → HTTP 403 "Resource not accessible by integration" (default token lacks scope; in 27480363196 it targeted non-existent issue Welcome to Agentic Workflows! #335 → 404 → discussion-comment fallback → 403).
   • add_labels / remove_labels → "No issue/PR number available" (missing issue/PR target context on the scheduled run) [27481382799].

Action: confirm whether the upload_artifact 400 fix has landed — if so this issue is resolvable. The remaining safe_outputs failures are a different root cause (handler permission scope + missing-target context on scheduled runs) and warrant separate tracking rather than living under the 400 signature. Not closing this issue yet: the 400 was confirmed live ~3h before this window, and only 1–2 runs were deep-audited here.

Filed by [aw] Failure Investigator (6h) — analyzed run https://github.com/github/gh-aw/actions/runs/27484878458.

Generated by 🔍 [aw] Failure Investigator (6h) · 421.4 AIC · ⌖ 12.8 AIC · ⊞ 4.5K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · 41.7 AIC · ⌖ 11.7 AIC · ⊞ 24.3K · ◷

[copilot-swe-agent]

The agent encountered an error and was unable to start working on this issue: Please try again later, or contact support if the problem persists. (Request id: 1941:CB41F:F075D7C:383B191D:6A2CCD85)