chore: fix env-file download to not require actions read permission

[muhammad-tahir-nawaz]

Summary

Follow-up to #41. That PR merged a version of the env-file download that requested actions: read and used gh run download, which makes both reusable workflows invalid for every caller. Switch to actions/download-artifact@v4 re-run up to 3 times with backoff — the runtime-token auth needs no actions: permission, so callers work unchanged.

Why

#41 broke callers with:

The nested job 'deploy' is requesting 'actions: read',
but is only allowed 'actions: none'.

A reusable workflow cannot request a permission the caller's job doesn't already grant. Callers set top-level permissions: without actions:, so the nested job is capped at actions: none and the whole workflow is rejected. gh run download needs actions: read; actions/download-artifact@v4 does not (it authenticates via the injected run-scoped runtime token) — which is why the pre-#41 code worked without any actions: permission.

The original goal still holds: on ephemeral ARC pods the Artifacts v4 results service is occasionally not yet consistent for the run when the pod starts, returning a transient 404. Re-running the download absorbs that window.

Changes

• Replace gh run download with actions/download-artifact@v4, re-run up to 3 times (continue-on-error, gated on the prior attempt's outcome, 15s then 30s backoff). No actions: permission required.
• deployment.yaml: a final env_artifact step yields one stable outcome (success iff a .env was downloaded), so the existing downstream outcome == 'success' gates are unchanged and a genuinely absent artifact still skips cleanly.
• Removed the actions: read lines added in chore: retry env-file artifact download on ARC to fix flaky 404 #41 from both jobs.

QA Report

• No QA report required — CI/CD workflow change, no user-facing API.

Integration Tests

• No integration tests required — modifies the CI/CD workflows themselves; YAML validated locally.

[greptile-apps]

Greptile Summary

This PR fixes a reusable-workflow breakage introduced in #41 by replacing gh run download (which requires actions: read) with actions/download-artifact@v4 (which authenticates via the injected runtime token and needs no actions: permission). The actions: read lines are removed from both workflow permissions blocks.

• deployment.yaml: Three discrete download attempts with 15 s / 30 s backoff replace the five-attempt shell loop; a final find-based env_artifact step provides the stable outcome signal that downstream env-injection gates already key on, so the graceful "deploy without secrets" fallback is preserved.
• integration-tests.yaml: Same three-attempt retry chain, but the third attempt intentionally omits continue-on-error so a genuinely absent env-file artifact still fails the job \u2014 matching the previous exit 1 behaviour.

Confidence Score: 4/5

Safe to merge — the permission regression is correctly fixed and the retry/outcome chain logic is sound in both workflows.

The core fix is correct and well-reasoned. The retry chain logic is correctly wired in both files: each subsequent attempt is gated on the previous outcome, the continue-on-error discipline differs intentionally between the two workflows, and the downstream env_artifact outcome gates in deployment.yaml are unaffected. The two observations — an unused id: dl3 and a find call that emits stderr noise when the download directory was never created — do not affect correctness.

Both files are straightforward; deployment.yaml has the slightly more complex outcome-resolution logic and is worth a second read.

Important Files Changed

Filename	Overview
.github/workflows/deployment.yaml	Removes actions: read permission and replaces the gh run download shell loop (5 attempts) with three discrete actions/download-artifact@v4 steps plus a final find-based env_artifact resolver. Retry logic, continue-on-error gating, and downstream outcome checks are correct; the unused id: dl3 on the third attempt is cosmetic.
.github/workflows/integration-tests.yaml	Removes actions: read permission and switches to actions/download-artifact@v4 with a three-attempt retry chain. The final attempt intentionally has no continue-on-error, so a genuinely missing env-file artifact still fails the job — symmetric with the old exit 1 behaviour.

_{Reviews (1): Last reviewed commit: "chore: fix env-file download to not requ..." | Re-trigger Greptile}

[greptile-apps]

Unused step id on final download attempt

id: dl3 is declared on the third download attempt but never referenced downstream — the env_artifact step uses a find check rather than inspecting steps.dl3.outcome. The id has no effect and can be dropped to reduce noise, though it is harmless as-is.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Suppressing stderr from find keeps the log clean when all download attempts fail and the directory was never created — the existing logic (grep -q . exits 1, then exit 1) is already correct, but without redirection the No such file or directory message appears in CI output alongside the intentional "env-file not downloaded" message.

Suggested change

	if find "${{ runner.temp }}/env-file" -name '.env' -type f | grep -q .; then
	if find "${{ runner.temp }}/env-file" -name '.env' -type f 2>/dev/null | grep -q .; then