Refactor ddb-publish action to use action repository for artifact downloads and improve error handling

Author: m-houston

actions/ddb-publish/action.yml

@@ -28,7 +28,8 @@ runs:
       shell: bash
       env:
         GH_TOKEN: ${{ github.token }}
-        REPO: ${{ github.repository }}
+        CALLER_REPO: ${{ github.repository }}
+        ACTION_REPO: ${{ github.action_repository }}
         ACTION_REF: ${{ github.action_ref }}
         RELEASE_ASSET_NAME: ddb-publish-bundle.tgz
         WORKFLOW_ARTIFACT_NAME: ddb-publish-bundle
@@ -40,42 +41,58 @@ runs:
 
         mkdir -p "${download_dir}" "${unpack_dir}"
 
-        echo "[ddb-publish] repo=${REPO}"
+        echo "[ddb-publish] caller_repo=${CALLER_REPO}"
+        echo "[ddb-publish] action_repo=${ACTION_REPO}"
         echo "[ddb-publish] action_ref=${ACTION_REF:-<empty>}"
 
         if [[ -z "${ACTION_REF}" ]]; then
           echo "ERROR: github.action_ref is empty; unable to locate release asset or branch artifact." >&2
           exit 1
         fi
 
-        # Prefer release assets when the action ref is a tag with a matching release.
-        if gh release view "${ACTION_REF}" --repo "${REPO}" >/dev/null 2>&1; then
-          echo "[ddb-publish] Found release for ref '${ACTION_REF}'. Downloading release asset '${RELEASE_ASSET_NAME}'."
-          gh release download "${ACTION_REF}" --repo "${REPO}" --pattern "${RELEASE_ASSET_NAME}" --dir "${download_dir}"
+        if [[ -z "${ACTION_REPO}" ]]; then
+          echo "ERROR: github.action_repository is empty; unable to determine where to fetch bundle artifacts." >&2
+          exit 1
+        fi
+
+        # Prefer release assets when the action ref is a tag with a matching release in the action repo.
+        if gh release view "${ACTION_REF}" --repo "${ACTION_REPO}" >/dev/null 2>&1; then
+          echo "[ddb-publish] Found release for ref '${ACTION_REF}' in '${ACTION_REPO}'. Downloading '${RELEASE_ASSET_NAME}'."
+          gh release download "${ACTION_REF}" --repo "${ACTION_REPO}" --pattern "${RELEASE_ASSET_NAME}" --dir "${download_dir}"
           tar -xzf "${download_dir}/${RELEASE_ASSET_NAME}" -C "${unpack_dir}"
           echo "[ddb-publish] Bundle extracted from release asset."
           exit 0
         fi
 
-        # Otherwise treat the ref as a branch-like ref and fetch the latest successful CI artifact.
+        # Otherwise treat the ref as a branch-like ref and fetch the latest successful CI artifact from the action repo.
         branch="${ACTION_REF#refs/heads/}"
-        echo "[ddb-publish] No release found for ref '${ACTION_REF}'. Falling back to latest workflow artifact on branch '${branch}'."
+        echo "[ddb-publish] No release found for ref '${ACTION_REF}'. Falling back to latest workflow artifact on branch '${branch}' from '${ACTION_REPO}'."
 
+        set +e
         run_id="$(gh run list \
-          --repo "${REPO}" \
+          --repo "${ACTION_REPO}" \
           --workflow "stage-3-build.yaml" \
           --branch "${branch}" \
           --status success \
           --json databaseId \
-          --jq '.[0].databaseId')"
+          --jq '.[0].databaseId' 2>/tmp/ddb_publish_run_list_err.log)"
+        rc=$?
+        set -e
+
+        if [[ $rc -ne 0 ]]; then
+          echo "ERROR: Failed to query workflow runs from '${ACTION_REPO}'." >&2
+          cat /tmp/ddb_publish_run_list_err.log >&2 || true
+          echo "HINT: ensure the token has read access to '${ACTION_REPO}' and workflow permissions allow actions read." >&2
+          exit 1
+        fi
 
         if [[ -z "${run_id}" || "${run_id}" == "null" ]]; then
-          echo "ERROR: Could not find a successful 'stage-3-build.yaml' run for branch '${branch}' to download artifact '${WORKFLOW_ARTIFACT_NAME}'." >&2
+          echo "ERROR: Could not find a successful 'stage-3-build.yaml' run for branch '${branch}' in '${ACTION_REPO}' to download artifact '${WORKFLOW_ARTIFACT_NAME}'." >&2
           exit 1
         fi
 
-        echo "[ddb-publish] Downloading artifact '${WORKFLOW_ARTIFACT_NAME}' from workflow run ${run_id}."
-        gh run download "${run_id}" --repo "${REPO}" --name "${WORKFLOW_ARTIFACT_NAME}" --dir "${download_dir}"
+        echo "[ddb-publish] Downloading artifact '${WORKFLOW_ARTIFACT_NAME}' from workflow run ${run_id} in '${ACTION_REPO}'."
+        gh run download "${run_id}" --repo "${ACTION_REPO}" --name "${WORKFLOW_ARTIFACT_NAME}" --dir "${download_dir}"
 
         tarball_path="${download_dir}/${RELEASE_ASSET_NAME}"
         if [[ ! -f "${tarball_path}" ]]; then