I think you’re seeing a bug. I filed an issue.
The main point of create_artifact() is to compute the hash of the artifact contents. It creates a directory and passes it to the function (artifact_dir here). You then fill that directory with whatever you want the contents to be, and after your function returns it will compute the hash. In my script here get the files by downloading a tarball and unpacking into the given directory. I also need to compute the hash of the tarball itself, which I do manually and save it into tarball_hash. Then when I call bind_artifact! I’m actually writing to the Artifacts.toml file. The download_info list needs the tarball hash, which I assume it validates after downloading.
Arguably this script uses some things that might be considered internal to Pkg, but I’m not sure if there’s a better way. @staticfloat would you mind weighing in on whether this is the right way to add a tarball as an artifact?