How can I verify restored data integrity when using GitHub Actions artifact backup and restore?

Answer

Use the SHA‑256 digest that actions/upload-artifact returns as an output named digest. The subsequent actions/download-artifact step automatically recomputes the digest and compares it; a mismatch is reported as a warning in the UI and job logs.

How to implement

1. Upload the artifact and capture its digest:

- name: Upload build output
  uses: actions/upload-artifact@v4
  with:
    name: my-artifact
    path: ./dist
  id: upload
- name: Save digest for later reference
  run: echo "artifact_digest=${{ steps.upload.outputs.digest }}" >> $GITHUB_ENV

2. Download the artifact in a later job or workflow run:

- name: Download artifact
  uses: actions/download-artifact@v5
  with:
    name: my-artifact
  id: download

3. Rely on built‑in validation: The download step automatically calculates a SHA‑256 digest of the downloaded content and compares it to the digest from the upload step. If the values differ, GitHub Actions shows a warning in the workflow run UI and writes a warning to the job logs.
4. Optional manual verification: If you want to log the digest for auditing, you can read the upload step’s output (saved in the environment variable above) and, after download, compute a local checksum with sha256sum to confirm the built‑in check.

No extra tools are required; the integrity check is performed by the official artifact actions themselves.