[BUG] CI / report-coverage (pull_request) is consistently failing

[cwperks]

What is the bug?

The CI check CI / report-coverage (pull_request) is consistently failing with the following error message:

Error: An error occurred trying to start process '/usr/bin/bash' with working directory '/home/runner/work/security/security/downloaded-artifacts'. No such file or directory

Seen here: https://github.com/opensearch-project/security/actions/runs/7277273234/job/19829594705?pr=3810

[peternied]

I've mitigated the issue by reverting a change to which version of the download-artifacts plugin we were using. This bug was introduced in [2] due to a breaking change [3] in how artifacts are uploaded and downloaded.

I'd recommend we re-write the the workflow to stop using alehechka/upload-tartifact@v2 and switch to using actions/upload-artifacts@v4 actions/download-artifacts@v4

• [1] Mitigation Revert "Bump actions/download-artifact from 3 to 4" #3892
• [2] Introduction PR Bump actions/download-artifact from 3 to 4 #3860
• [3] v4 Breaking Changes https://github.com/actions/download-artifact?tab=readme-ov-file#v4---whats-new

[stephen-crawford]

[Triage] Craig and Peter have some work to hopefully fix this shortly. This is certainly something we want fixed.

[reta]

@peternied The weird part that on GA restart, it succeeds, recent example here:

• Bump com.google.googlejavaformat:google-java-format from 1.19.1 to 1.19.2 #3930
• https://github.com/opensearch-project/security/actions/runs/7443924751/job/20262398934?pr=3930 - 3 are failing, 4 succeeds on restart