@actions/artifact checks the expected hash against the response but not the file on the disk

[richRubie]

Thank you 🙇‍♀ for wanting to create an issue in this repository. Before you do, please ensure you are filing the issue in the right place. Issues should only be opened on if the issue relates to code in this repository.

• If you have found a security issue please submit it here
• If you have questions about writing workflows or action files, then please visit the GitHub Community Forum's Actions Board
• If you are having an issue or question about GitHub Actions then please contact customer support

If your issue is relevant to this repository, please include the information below:

Describe the bug
We had a transient issue which meant that a file was only partially downloaded.
This code succedded, where I think it whould have failed.
It looks like you check the expected digest against the response but you don't check it against the file on the disk.
You print the digest fo the file on the disk.

To Reproduce
sorry i don't know how you could reproduce this realiably.

Expected behavior
I would expect the expectedDigest to be checked agaisnt the extractResponse.sha256Digest AND the "SHA256 digest of downloaded artifact"

Screenshots
This screen shot shows the list of artifacts and includes the expected digest

This screen shot shows the "successes" which don't include a matching hashset

On other runs of this the action the hashsets match

Desktop (please complete the following information):

• OS: [e.g. iOS]
• Browser [e.g. chrome, safari]
• Version [e.g. 22]

Smartphone (please complete the following information):

• Device: [e.g. iPhone6]
• OS: [e.g. iOS8.1]
• Browser [e.g. stock browser, safari]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

[richRubie]

here is the areas of code I think are the issue
This is where it checks against the response digest

Here is where it calculates the size of the file on disk.