Regression: `Setup Scripts` step in `activation` job jumped ~1s → ~1m39s (npm install of @actions/artifact when AI-credits guardrail enabled)

[yskopets]

🤖 This issue has been generated by Claude Code.

Summary

After upgrading the gh-aw compiler/runtime from v0.77.5 → v0.79.1, the Setup Scripts step in the activation job regressed from ~1 second to ~1 minute 39 seconds.

The cause is the new safe-output-artifact-client input on github/gh-aw-actions/setup. When the AI-credits daily guardrail is active (i.e. GH_AW_MAX_DAILY_AI_CREDITS resolves to a non-empty value — which is now the default), the activation job's setup step runs an on-the-fly npm install @actions/artifact that pulls 254 packages with no cache, taking ~1m33s on every run.

Before vs. after

Same workflow, same activation job, observed in a private repository using gh-aw:

	Before	After
Setup action	github/gh-aw-actions/setup@v0.77.5	github/gh-aw-actions/setup@v0.79.1
safe-output-artifact-client input	false	true
Setup Scripts step duration	~1s	~1m39s
Daily guardrail metric	GH_AW_MAX_DAILY_EFFECTIVE_TOKENS	GH_AW_MAX_DAILY_AI_CREDITS

Before (v0.77.5) — Setup Scripts just copies files

Run github/gh-aw-actions/setup@3ea13c02d765410340d533515cb31a7eef2baaf0
  safe-output-artifact-client: false
Successfully copied 398 files to .../gh-aw/actions
Successfully copied 25 mcp-scripts files to .../gh-aw/mcp-scripts
Successfully copied 68 safe-outputs files to .../gh-aw/safeoutputs

After (v0.79.1) — Setup Scripts additionally runs npm install

Run github/gh-aw-actions/setup@ed887f6fa57b5076d3fbe1ed3963a5b0fd9ce427
  safe-output-artifact-client: true
Successfully copied 75 safe-outputs files to .../gh-aw/safeoutputs
Artifact client enabled - installing @actions/artifact package in .../gh-aw/actions...
[18:42:16] (install starts)
[18:43:50] added 254 packages, and audited 255 packages in 1m
✓ Successfully installed @actions/artifact package

The ~93s gap between those two timestamps is the entire regression; the file-copy portion is still ~1–2s in both versions.

Why it triggers

In the compiled activation job, the setup step is gated like this:

- name: Setup Scripts
  id: setup
  uses: github/gh-aw-actions/setup@<v0.79.1 sha>
  with:
    destination: ${{ runner.temp }}/gh-aw/actions
    job-name: ${{ github.job }}
    safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
  env:
    GH_AW_MAX_DAILY_AI_CREDITS: "<resolved value>"   # non-empty -> true

Because the AI-credits daily guardrail defaults to a non-empty value (5000), safe-output-artifact-client is effectively true for most workflows, so almost every activation run now pays this ~1.5-minute npm-install tax. The pre_activation job (which does not enable the artifact client) still completes its Setup Scripts in ~1s, confirming the install is the sole cause.

Impact

• Adds ~1.5 min of wall-clock and billable runner time to every workflow run that has an AI-credits daily guardrail (now the default), on the critical path before the agent even starts.
• The previous effective-tokens daily guardrail computed its budget without this setup-time install, so this is a net regression introduced alongside the ET → AIC migration.

Suggested remedies (any one would help)

1. Vendor / pre-bundle @actions/artifact into the setup action's shipped assets so no runtime npm install is needed.
2. Cache node_modules for the artifact client across runs (keyed on the package version).
3. Fall back to a lighter mechanism for downloading prior-run usage artifacts (e.g. gh CLI / actions/download-artifact) that doesn't require installing the full @actions/artifact dependency tree at setup time.

Environment

• gh-aw compiler/runtime: v0.79.1 (regressed from v0.77.5)
• Setup action: github/gh-aw-actions/setup@v0.79.1
• Runner: ubuntu-slim (GitHub-hosted)
• Engine: claude

Repository and run URLs are omitted because the affected runs are in a private repository; the relevant log excerpts are reproduced above.

[pelikhan]

Fix incoming

[pelikhan]

v0.79.8