[siracozmen01]

Problem

cpp.yml uploads only out/<preset>/Testing/Temporary/ when a cell fails. A server a test fixture starts writes its own logs elsewhere, so a failure in it leaves no evidence: maul-audio's PipeWire failure on #6 had no daemon logs to read.

Change

A logs input takes more paths, one per line, uploaded in the same artifact as the test logs. It defaults to none, so callers that do not set it upload what they did before.

Verification

zizmor reports no findings; the workflow parses. upload-artifact ignores the empty line the default leaves.

[siracozmen01]

Review of 9e591a6. Ready. gh pr checks reported no checks on the branch when I looked.

Empty input. With the default, path is the old line plus a trailing newline. core.getInput trims the value, and @actions/glob also skips empty lines, so upload-artifact sees one search pattern, as before. The artifact root is the least common ancestor of the search paths. With one path that is still out/<preset>/Testing/Temporary/, so the artifact's layout is unchanged for every current caller. The ${{ }} substitution happens after YAML parsing, so a multi-line value is not affected by the block scalar's indentation.

Escape and secrets. A caller can name any path, including an absolute one or one outside the workspace. It is the caller's own with: value, though, and setup already runs the caller's code with eval in the same job. So logs gives a caller nothing it does not already have. The job holds contents: read only, and the checkout keeps persist-credentials: false, so no token sits on disk for a path to pick up. Nothing else reaches the input: it comes from the calling workflow file, never from event data.

zizmor. Its template-injection audit covers code sinks (run:, github-script's script:). A with: path of upload-artifact is not one, so a clean run is the expected result, not a gap.

Non-blocking, for callers. Once logs is set, the root becomes the common ancestor, so the test logs move under out/<preset>/Testing/Temporary/ inside the artifact. upload-artifact v7 skips hidden files by default. It may also fail on a socket if a caller passes a whole sound-server directory with its run/ sockets in it. A glob such as out/<preset>/sound-server/*.log avoids both.