Include vendored artifact action entrypoint

.gitea/actions/upload-artifact/LICENSE

@@ -0,0 +1,22 @@
+
+The MIT License (MIT)
+
+Copyright (c) 2018 GitHub, Inc. and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

.gitea/actions/upload-artifact/action.yml

@@ -0,0 +1,62 @@
+# Vendored from gitea.com/actions/gitea-upload-artifact commit 81f940d004763f986ba3582c007fd842dd5cb0d7.
+name: 'Upload a Build Artifact'
+description: 'Upload a build artifact that can be used by subsequent workflow steps'
+author: 'GitHub'
+inputs:
+  name:
+    description: 'Artifact name'
+    default: 'artifact'
+  path:
+    description: 'A file, directory or wildcard pattern that describes what to upload'
+    required: true
+  if-no-files-found:
+    description: >
+      The desired behavior if no files are found using the provided path.
+
+      Available Options:
+        warn: Output a warning but do not fail the action
+        error: Fail the action with an error message
+        ignore: Do not output any warnings or errors, the action does not fail
+    default: 'warn'
+  retention-days:
+    description: >
+      Duration after which artifact will expire in days. 0 means using default retention.
+
+      Minimum 1 day.
+      Maximum 90 days unless changed from the repository settings page.
+  compression-level:
+    description: >
+      The level of compression for Zlib to be applied to the artifact archive.
+      The value can range from 0 to 9:
+      - 0: No compression
+      - 1: Best speed
+      - 6: Default compression (same as GNU Gzip)
+      - 9: Best compression
+      Higher levels will result in better compression, but will take longer to complete.
+      For large files that are not easily compressed, a value of 0 is recommended for significantly faster uploads.
+    default: '6'
+  overwrite:
+    description: >
+      If true, an artifact with a matching name will be deleted before a new one is uploaded.
+      If false, the action will fail if an artifact for the given name already exists.
+      Does not fail if the artifact does not exist.
+    default: 'false'
+
+outputs:
+  artifact-id:
+    description: >
+      A unique identifier for the artifact that was just uploaded. Empty if the artifact upload failed.
+
+      This ID can be used as input to other APIs to download, delete or get more information about an artifact: https://docs.github.com/en/rest/actions/artifacts
+  artifact-url:
+    description: >
+      A download URL for the artifact that was just uploaded. Empty if the artifact upload failed.
+
+      This download URL only works for requests Authenticated with GitHub. Anonymous downloads will be prompted to first login. 
+      If an anonymous download URL is needed than a short time restricted URL can be generated using the download artifact API: https://docs.github.com/en/rest/actions/artifacts#download-an-artifact    
+
+      This URL will be valid for as long as the artifact exists and the workflow run and repository exists. Once an artifact has expired this URL will no longer work.
+      Common uses cases for such a download URL can be adding download links to artifacts in descriptions or comments on pull requests or issues.
+runs:
+  using: 'node20'
+  main: 'dist/index.js'

.gitea/workflows/backend-quality-gate.yml

@@ -269,7 +269,7 @@ jobs:
             artifacts/staging-images/manifest.env "$GITEA_SHA" "$IMAGE_REPOSITORY" >/dev/null
 
       - name: Upload immutable staging image manifest
-        uses: https://gitea.com/actions/gitea-upload-artifact@v4
+        uses: ./.gitea/actions/upload-artifact
         with:
           name: staging-image-manifest-${{ gitea.sha }}-${{ gitea.run_attempt }}
           path: artifacts/staging-images/manifest.env

frontend/tests/staging-backend-workflows.test.ts

@@ -22,6 +22,14 @@ const giteaQualityWorkflow = new URL(
   "../../.gitea/workflows/backend-quality-gate.yml",
   import.meta.url,
 );
+const giteaUploadArtifactAction = new URL(
+  "../../.gitea/actions/upload-artifact/action.yml",
+  import.meta.url,
+);
+const giteaUploadArtifactEntrypoint = new URL(
+  "../../.gitea/actions/upload-artifact/dist/index.js",
+  import.meta.url,
+);
 const giteaDeployWorkflow = new URL(
   "../../.gitea/workflows/deploy-staging.yml",
   import.meta.url,
@@ -201,7 +209,10 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.match(workflow, /get\("os"\)=="linux"/);
   assert.match(workflow, /get\("architecture"\)=="amd64"/);
   assert.match(workflow, /node frontend\/scripts\/staging-image-manifest\.mjs/);
-  assert.match(workflow, /uses: https:\/\/gitea\.com\/actions\/gitea-upload-artifact@v4/);
+  assert.match(workflow, /uses: \.\/\.gitea\/actions\/upload-artifact/);
+  assert.match(read(giteaUploadArtifactAction), /main: ['"]dist\/index\.js['"]/);
+  assert.match(read(giteaUploadArtifactAction), /81f940d004763f986ba3582c007fd842dd5cb0d7/);
+  assert.ok(existsSync(fileURLToPath(giteaUploadArtifactEntrypoint)));
   assert.match(workflow, /name: staging-image-manifest-\$\{\{ gitea\.sha \}\}-\$\{\{ gitea\.run_attempt \}\}/);
   assertOrder(workflow, [
     "docker login",