From 82c608a0bd96119877d6f7b4bb2a5bf107878d41 Mon Sep 17 00:00:00 2001
From: Quaternion8192 <70364461+Quaternion8192@users.noreply.github.com>
Date: Fri, 9 Oct 2026 08:29:22 +0800
Subject: [PATCH] ci: restrict uploaded artifacts to release and test evidence

---
 .github/workflows/ci.yml      | 47 ++++++++++++++++++++++++-----------
 .github/workflows/preview.yml | 15 ++++++++---
 .github/workflows/release.yml | 15 ++++++++---
 3 files changed, 55 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 76d10ee..55f2df4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,7 +49,7 @@ jobs:
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: dependency-audit
-          path: artifacts/dependency-audit/**
+          path: artifacts/dependency-audit/*.json
           if-no-files-found: error
 
       - name: Verify formatting
@@ -71,7 +71,7 @@ jobs:
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: runtime-boundaries
-          path: artifacts/runtime-boundaries/**
+          path: artifacts/runtime-boundaries/*/publish.log
           if-no-files-found: error
 
       - name: Test
@@ -96,9 +96,15 @@ jobs:
         with:
           name: package-capabilities-x64
           path: |
-            artifacts/package-capabilities/**/manifest.json
-            artifacts/package-capabilities/**/consumer-smoke/packages.lock.json
-            artifacts/package-capabilities/**/packages/*
+            artifacts/package-capabilities/*/manifest.json
+            artifacts/package-capabilities/*/sbom.spdx.json
+            artifacts/package-capabilities/*/release-notes.md
+            artifacts/package-capabilities/*/support-matrix.md
+            artifacts/package-capabilities/*/consumer-smoke/PreviewConsumer.csproj
+            artifacts/package-capabilities/*/consumer-smoke/Program.cs
+            artifacts/package-capabilities/*/consumer-smoke/packages.lock.json
+            artifacts/package-capabilities/*/packages/*.nupkg
+            artifacts/package-capabilities/*/packages/*.snupkg
           if-no-files-found: ignore
 
       - name: Upload test results
@@ -106,14 +112,18 @@ jobs:
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: test-results
-          path: "**/TestResults/**"
+          path: |
+            **/TestResults/**/*.trx
+            **/TestResults/**/*.xml
           if-no-files-found: ignore
 
       - name: Upload packages
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: packages
-          path: artifacts/packages/*
+          path: |
+            artifacts/packages/*.nupkg
+            artifacts/packages/*.snupkg
 
   test-arm64:
     runs-on: windows-11-arm
@@ -171,11 +181,17 @@ jobs:
         with:
           name: test-results-arm64
           path: |
-            **/TestResults/**
-            artifacts/runtime-boundaries/**
-            artifacts/package-capabilities/**/manifest.json
-            artifacts/package-capabilities/**/consumer-smoke/packages.lock.json
-            artifacts/package-capabilities/**/packages/*
+            **/TestResults/**/*.trx
+            artifacts/runtime-boundaries/*/publish.log
+            artifacts/package-capabilities/*/manifest.json
+            artifacts/package-capabilities/*/sbom.spdx.json
+            artifacts/package-capabilities/*/release-notes.md
+            artifacts/package-capabilities/*/support-matrix.md
+            artifacts/package-capabilities/*/consumer-smoke/PreviewConsumer.csproj
+            artifacts/package-capabilities/*/consumer-smoke/Program.cs
+            artifacts/package-capabilities/*/consumer-smoke/packages.lock.json
+            artifacts/package-capabilities/*/packages/*.nupkg
+            artifacts/package-capabilities/*/packages/*.snupkg
           if-no-files-found: error
 
   native-abi-x64:
@@ -231,7 +247,7 @@ jobs:
           name: native-abi-x64
           path: |
             artifacts/abi-probe/x64.json
-            tests/CfSharp.Native.Tests/TestResults/**
+            tests/CfSharp.Native.Tests/TestResults/**/*.trx
           if-no-files-found: error
 
   long-soak:
@@ -269,5 +285,8 @@ jobs:
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: long-soak-evidence-${{ matrix.architecture }}
-          path: artifacts/soak/**
+          path: |
+            artifacts/soak/*.json
+            artifacts/soak/*.trx
+            artifacts/soak/*.log
           if-no-files-found: error
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index 059b891..035ff13 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -103,10 +103,17 @@ jobs:
         with:
           name: preview-${{ steps.version.outputs.version }}
           path: |
-            artifacts/preview/${{ steps.version.outputs.version }}/**
-            artifacts/preview-version.json
-            artifacts/abi-probe/**
-            **/TestResults/**
+            artifacts/preview/${{ steps.version.outputs.version }}/packages/*.nupkg
+            artifacts/preview/${{ steps.version.outputs.version }}/packages/*.snupkg
+            artifacts/preview/${{ steps.version.outputs.version }}/manifest.json
+            artifacts/preview/${{ steps.version.outputs.version }}/sbom.spdx.json
+            artifacts/preview/${{ steps.version.outputs.version }}/release-notes.md
+            artifacts/preview/${{ steps.version.outputs.version }}/support-matrix.md
+            artifacts/preview/${{ steps.version.outputs.version }}/consumer-smoke/PreviewConsumer.csproj
+            artifacts/preview/${{ steps.version.outputs.version }}/consumer-smoke/Program.cs
+            artifacts/preview/${{ steps.version.outputs.version }}/consumer-smoke/packages.lock.json
+            artifacts/abi-probe/x64.json
+            **/TestResults/**/*.trx
           if-no-files-found: error
           retention-days: 90
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 867a0ee..30df188 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -104,10 +104,17 @@ jobs:
         with:
           name: stable-${{ steps.version.outputs.version }}
           path: |
-            artifacts/preview/${{ steps.version.outputs.version }}/**
-            artifacts/stable-version.json
-            artifacts/abi-probe/**
-            **/TestResults/**
+            artifacts/preview/${{ steps.version.outputs.version }}/packages/*.nupkg
+            artifacts/preview/${{ steps.version.outputs.version }}/packages/*.snupkg
+            artifacts/preview/${{ steps.version.outputs.version }}/manifest.json
+            artifacts/preview/${{ steps.version.outputs.version }}/sbom.spdx.json
+            artifacts/preview/${{ steps.version.outputs.version }}/release-notes.md
+            artifacts/preview/${{ steps.version.outputs.version }}/support-matrix.md
+            artifacts/preview/${{ steps.version.outputs.version }}/consumer-smoke/PreviewConsumer.csproj
+            artifacts/preview/${{ steps.version.outputs.version }}/consumer-smoke/Program.cs
+            artifacts/preview/${{ steps.version.outputs.version }}/consumer-smoke/packages.lock.json
+            artifacts/abi-probe/x64.json
+            **/TestResults/**/*.trx
           if-no-files-found: error
           retention-days: 365