< woml />
View on GitHub

Durable Artifacts

Durable artifacts preserve files with a verified SHA-256 digest without putting file bytes or private paths in workflow context. Use them for plans, reports, dumps, and other evidence that must survive a restart.

Store and consume a file

The file must be under an operator-approved read root. These step fragments belong inside <steps>:

WOML
<step id="preservePlan">
  <script>
    const artifact = await services.artifacts.put(
      ".woml/artifact-input/release.tfplan",
      { name: "release-plan", contentType: "application/octet-stream", retention: "30d" }
    );
    return { artifact };
  </script>
</step>

<step id="verifyPlan">
  <script>
    const artifact = context.steps.preservePlan.artifact;
    const metadata = await services.artifacts.head(artifact);
    const path = await services.artifacts.materialize(artifact);
    return { artifact, integrity: metadata.integrity, readable: Boolean(path) };
  </script>
</step>

put returns a small reference. head verifies the record and bytes; materialize creates a private file for the current attempt. The path is removed when that attempt settles, so pass the reference—not the temporary path—to later steps. A reference is neither a public URL nor general authorization.

Configure storage and inspect evidence

An operator selects the backend, roots, size and retention limits, and secret-scanning rules with an Artifact Policy:

Terminal
woml run workflow.woml --artifact-policy ./artifact-policy.json
woml artifacts inspect artifact_<id> --json
woml artifacts export artifact_<id> --output ./reviewed-plan.tfplan --artifact-policy ./artifact-policy.json

Export verifies bytes and refuses to overwrite an existing file. Normal run inspection shows bounded metadata, not the body. Artifact-aware backup and retention preserve reachable data and protect active runs.