ci: Add job to test artifact downloads

Downgrade the artifact upload/download actions to v3 since none of the
v4 versions seem to address the "Not a valid zip file" issue.

Modified the codesign job to additionally run on PRs, so that when
Renovate upgrades the upload/download artifacts, we can tell from the PR
if the ZIP file issue is fixed.

For more info, see:

- https://github.com/actions/download-artifact/issues/328
- https://github.com/docker/build-push-action/issues/1167

.github/actions/download-tar/action.yml

@@ -15,7 +15,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/download-artifact@v4.1.7
+    - uses: actions/download-artifact@v3.0.2
       with:
         name: ${{ inputs.name }}
         path: ${{ inputs.path }}

.github/actions/upload-tar/action.yml

@@ -18,7 +18,7 @@ runs:
       shell: bash
       working-directory: ${{ inputs.path }}
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v3.1.3
       with:
         name: ${{ inputs.name }}
         path: ${{ inputs.path }}/artifact.tar

.github/workflows/build.yml

@@ -61,8 +61,11 @@ jobs:
   codesign:
     name: Apple Signing
     runs-on: macos-latest
-    # Ignore pull requests & non-master branches
-    if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v')
+    # non-master branches
+    if: |
+      github.event_name == 'pull_request' ||
+      github.ref == 'refs/heads/master' ||
+      startsWith(github.ref, 'refs/tags/v')
     needs: [build-osx]
     strategy:
       matrix:
@@ -124,6 +127,26 @@ jobs:
     uses: ./.github/workflows/reusable-docker.yml
     secrets: inherit
 
+  #############################################
+  test-artifact-download:
+    name: Test Artifact Download
+    runs-on: ubuntu-latest
+    needs:
+      - build-win
+      - build-linux
+      - codesign # Depends on build-osx
+      - docker # Depends on build-musl
+    env:
+      XZ_OPT: "-T0 -9"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download Artifacts
+        uses: ./.github/actions/download-tar
+        with:
+          path: publish
+
   #############################################
   release:
     name: Release
@@ -132,8 +155,8 @@ jobs:
     needs:
       - build-win
       - build-linux
-      - codesign # Depends on build-osx
-      - docker # Only for preventing a release if docker build & publish fails
+      - build-musl
+      - codesign # Depends on build-osx, and reuploads artifacts after signing
     env:
       XZ_OPT: "-T0 -9"
     steps:

.github/workflows/reusable-docker.yml

@@ -68,6 +68,9 @@ jobs:
 
       - name: Build & Push Image
         uses: docker/build-push-action@v6
+        env:
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
         with:
           context: .
           push: ${{ env.SHOULD_PUBLISH == 'true' }}