[Feature] : API ENDPOINTS PR 7: Test Artifacts

[pulk17]

[FEATURE]

In raising this pull request, I confirm the following (please check boxes):

• I have read and understood the contributors guide.
• I have checked that another pull request for this purpose does not exist.
• I have considered, and confirmed that this submission will be valuable to others.
• I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
• I give this submission freely, and claim no ownership to its content.

My familiarity with the project is as follows (check one):

• I have never used the project.
• I have used the project briefly.
• I have used the project extensively, but have not contributed previously.
• I am an active contributor to the project.

---

Overview

Final PR of the CI API stack (#1130 → #1141, merge bottom-up). Today, when a CI run finishes, the VM is deleted and everything not in TestResults/ dies with it — debugging a crash means re-running the whole job and hoping. This PR preserves the three artifacts that matter for post-mortem debugging — the built binary, the coredump (Linux), and the combined stdout log — and exposes them through the API.

How it works

VM side (install/ci-vm/ci-linux/ci/runCI, install/ci-vm/ci-windows/ci/runCI.bat)
After the test phase, the scripts upload artifacts through a new artifactupload type on the existing token-authenticated progress-reporter endpoint — no new auth surface. Upload robustness:

• curl --fail + explicit exit-code logging on failure, so a failed upload appears in the run log instead of dying silently
• The Windows script's crash detection switched from if errorlevel 1 to the || operator: %ERRORLEVEL% expands at parse time inside parenthesized blocks, and if errorlevel 1 misses the negative NTSTATUS codes that actual crashes produce. A comment in the script documents this for the next person.

Server side (mod_ci/controllers.py)
Handles artifactupload next to the existing upload types. Target filenames are derived server-side from artifact type + platform (ccextractor / ccextractorwinfull.exe, coredump, combined_stdout.log) — never trusted from the uploaded filename. Files land under SAMPLE_REPOSITORY/test_artifacts/{run_id}/.

API side (GET /runs/{id}/artifacts, results:read)
Lists binary/coredump/stdout artifacts alongside the build log and per-test output files, with ?type filter, sizes, storage_status, and download URLs. Heavy metadata (signed URLs, file sizes) is resolved only for the returned page.

CI — new ci-vm-scripts.yml workflow shellchecks the Linux VM scripts on any PR touching them.

Deployment notes

• SAMPLE_REPOSITORY is bucket-backed in production (the same mechanism that serves TestResults/ signed URLs), so download_url resolves with zero new GCS code. On a local/dev install, storage_status: degraded signals a local-only file.
• Deploy-order independent: VM scripts are copied at deploy time atomically with the server code, and a new-script/old-server (or vice-versa) window just logs and skips the upload — runs still complete normally.

Testing

11 new tests (7 in tests/test_ci for the upload handler — filename derivation, type validation, rejection paths; 4 API tests for the listing endpoint, missing-storage handling, and ?type filtering). 189 API + 212 CI tests total at this layer; bash -n and shellcheck clean.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.4% Duplication on New Code

See analysis details on SonarQube Cloud