What’s changed
This release adds a new pure-Go ZIP extraction path for directory artifacts, available as an opt-in feature flag. When enabled, the step extracts ZIP artifacts with go-utils/v2/ziputil (ziputil.UnZip) instead of shelling out to the system unzip CLI. The pure-Go extractor includes zip-slip and symlink-escape protections and removes the dependency on a system unzip binary.
Default behavior is unchanged: with the flag off, ZIP artifacts are still extracted via the unzip CLI. The tar extraction path is unaffected.
- Add ziputil v2 (pure-Go) ZIP extraction behind a feature flag by @lpusok in #31
How to enable
The feature is gated behind the BITRISE_STEP_PULL_ARTIFACT_USE_ZIP_V2 environment variable. To turn it on, add it as an app-level environment variable in your bitrise.yml:
app:
envs:
- BITRISE_STEP_PULL_ARTIFACT_USE_ZIP_V2: "true"
This makes the flag available to every workflow and build in the app, so the Pull intermediate files step picks it up automatically — no Script step required.
Leaving the variable unset, or setting it to any value other than true, keeps the legacy unzip CLI behavior.
Changelog: 1.3.6…1.3.7