Safe Directory v2 update (#764 )

* set safe directory when running checkout
2026-06-26 18:03:53 +08:00 · 2022-04-14 12:12:00 -04:00
26 changed files with 224 additions and 447 deletions
--- a/.github/workflows/check-dist.yml
+++ b/.github/workflows/check-dist.yml
@@ -22,12 +22,12 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2

-      - name: Set Node.js 16.x
+      - name: Set Node.js 12.x
        uses: actions/setup-node@v1
        with:
-          node-version: 16.x
+          node-version: 12.x

      - name: Install dependencies
        run: npm ci
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -39,7 +39,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v2

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v1
--- a/.github/workflows/licensed.yml
+++ b/.github/workflows/licensed.yml
@@ -9,6 +9,6 @@ jobs:
    runs-on: ubuntu-latest
    name: Check licenses
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
      - run: npm ci
      - run: npm run licensed-check
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,8 +13,8 @@ jobs:
    steps:
      - uses: actions/setup-node@v1
        with:
-          node-version: 16.x
-      - uses: actions/checkout@v3
+          node-version: 12.x
+      - uses: actions/checkout@v2
      - run: npm ci
      - run: npm run build
      - run: npm run format-check
@@ -32,7 +32,7 @@ jobs:
    steps:
      # Clone this repo
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2

      # Basic checkout
      - name: Checkout basic
@@ -150,7 +150,7 @@ jobs:
    steps:
      # Clone this repo
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2

      # Basic checkout using git
      - name: Checkout basic
@@ -182,7 +182,7 @@ jobs:
    steps:
      # Clone this repo
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2

      # Basic checkout using git
      - name: Checkout basic
@@ -205,41 +205,3 @@ jobs:
          path: basic
      - name: Verify basic
        run: __test__/verify-basic.sh --archive
-    
-  test-git-container:
-    runs-on: ubuntu-latest
-    container: bitnami/git:latest
-    steps:
-      # Clone this repo
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          path: v3
-
-      # Basic checkout using git
-      - name: Checkout basic
-        uses: ./v3
-        with:
-          ref: test-data/v2/basic
-      - name: Verify basic
-        run: |
-          if [ ! -f "./basic-file.txt" ]; then
-              echo "Expected basic file does not exist"
-              exit 1
-          fi
-
-          # Verify .git folder
-          if [ ! -d "./.git" ]; then
-            echo "Expected ./.git folder to exist"
-            exit 1
-          fi
-
-          # Verify auth token
-          git config --global --add safe.directory "*"
-          git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
-
-      # needed to make checkout post cleanup succeed
-      - name: Fix Checkout v3
-        uses: actions/checkout@v3
-        with:
-          path: v3
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,4 @@
 __test__/_temp
 _temp/
 lib/
-node_modules/
-.vscode/
+node_modules/
--- a/.licenses/npm/node-fetch.dep.yml
+++ b/.licenses/npm/node-fetch.dep.yml
@@ -1,6 +1,6 @@
 ---
 name: node-fetch
-version: 2.6.7
+version: 2.6.5
 type: npm
 summary: A light-weight module that brings window.fetch to node.js
 homepage: https://github.com/bitinn/node-fetch
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,20 +1,13 @@
 # Changelog

-## v3.0.2
- [Add input `set-safe-directory`](https://github.com/actions/checkout/pull/770)
-
-## v3.0.1
- [Fixed an issue where checkout failed to run in container jobs due to the new git setting `safe.directory`](https://github.com/actions/checkout/pull/762)
- [Bumped various npm package versions](https://github.com/actions/checkout/pull/744)
-
-## v3.0.0
-
- [Update to node 16](https://github.com/actions/checkout/pull/689)
+## v2.4.1
+- [Set the safe directory option on git to prevent git commands failing when running in containers](https://github.com/actions/checkout/pull/762)

 ## v2.3.1

 - [Fix default branch resolution for .wiki and when using SSH](https://github.com/actions/checkout/pull/284)

+
 ## v2.3.0

 - [Fallback to the default branch](https://github.com/actions/checkout/pull/278)
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
  <a href="https://github.com/actions/checkout"><img alt="GitHub Actions status" src="https://github.com/actions/checkout/workflows/test-local/badge.svg"></a>
 </p>

-# Checkout V3
+# Checkout V2

 This action checks-out your repository under `$GITHUB_WORKSPACE`, so your workflow can access it.

@@ -14,14 +14,27 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl

 # What's new

- Updated to the node16 runtime by default
-  - This requires a minimum [Actions Runner](https://github.com/actions/runner/releases/tag/v2.285.0) version of v2.285.0 to run, which is by default available in GHES 3.4 or later.
+- Improved performance
+  - Fetches only a single commit by default
+- Script authenticated git commands
+  - Auth token persisted in the local git config
+- Supports SSH
+- Creates a local branch
+  - No longer detached HEAD when checking out a branch
+- Improved layout
+  - The input `path` is always relative to $GITHUB_WORKSPACE
+  - Aligns better with container actions, where $GITHUB_WORKSPACE gets mapped in
+- Fallback to REST API download
+  - When Git 2.18 or higher is not in the PATH, the REST API will be used to download the files
+  - When using a job container, the container's PATH is used
+
+Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous versions.

 # Usage

 <!-- start usage -->
 ```yaml
- uses: actions/checkout@v3
+- uses: actions/checkout@v2
  with:
    # Repository name with owner. For example, actions/checkout
    # Default: ${{ github.repository }}
@@ -92,17 +105,6 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl
    #
    # Default: false
    submodules: ''
-
-    # Add repository path as safe.directory for Git global config by running `git
-    # config --global --add safe.directory <path>`
-    # Default: true
-    set-safe-directory: ''
-
-    # The base URL for the GitHub instance that you are trying to clone from, will use
-    # environment defaults to fetch from the same instance that the workflow is
-    # running from unless specified. Example URLs are https://github.com or
-    # https://my-ghes-server.example.com
-    github-server-url: ''
 ```
 <!-- end usage -->

@@ -121,7 +123,7 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl
 ## Fetch all history for all tags and branches

 ```yaml
- uses: actions/checkout@v3
+- uses: actions/checkout@v2
  with:
    fetch-depth: 0
 ```
@@ -129,7 +131,7 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl
 ## Checkout a different branch

 ```yaml
- uses: actions/checkout@v3
+- uses: actions/checkout@v2
  with:
    ref: my-branch
 ```
@@ -137,7 +139,7 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl
 ## Checkout HEAD^

 ```yaml
- uses: actions/checkout@v3
+- uses: actions/checkout@v2
  with:
    fetch-depth: 2
 - run: git checkout HEAD^
@@ -147,12 +149,12 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl

 ```yaml
 - name: Checkout
-  uses: actions/checkout@v3
+  uses: actions/checkout@v2
  with:
    path: main

 - name: Checkout tools repo
-  uses: actions/checkout@v3
+  uses: actions/checkout@v2
  with:
    repository: my-org/my-tools
    path: my-tools
@@ -162,10 +164,10 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl

 ```yaml
 - name: Checkout
-  uses: actions/checkout@v3
+  uses: actions/checkout@v2

 - name: Checkout tools repo
-  uses: actions/checkout@v3
+  uses: actions/checkout@v2
  with:
    repository: my-org/my-tools
    path: my-tools
@@ -175,12 +177,12 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl

 ```yaml
 - name: Checkout
-  uses: actions/checkout@v3
+  uses: actions/checkout@v2
  with:
    path: main

 - name: Checkout private tools
-  uses: actions/checkout@v3
+  uses: actions/checkout@v2
  with:
    repository: my-org/my-private-tools
    token: ${{ secrets.GH_PAT }} # `GH_PAT` is a secret that contains your PAT
@@ -193,7 +195,7 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl
 ## Checkout pull request HEAD commit instead of merge commit

 ```yaml
- uses: actions/checkout@v3
+- uses: actions/checkout@v2
  with:
    ref: ${{ github.event.pull_request.head.sha }}
 ```
@@ -209,7 +211,7 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
 ```

 ## Push a commit using the built-in token
@@ -220,7 +222,7 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
      - run: |
          date > generated.txt
          git config user.name github-actions
--- a/test/git-auth-helper.test.ts
+++ b/test/git-auth-helper.test.ts
@@ -20,7 +20,6 @@ let tempHomedir: string
 let git: IGitCommandManager & {env: {[key: string]: string}}
 let settings: IGitSourceSettings
 let sshPath: string
-let githubServerUrl: string

 describe('git-auth-helper tests', () => {
  beforeAll(async () => {
@@ -68,18 +67,11 @@ describe('git-auth-helper tests', () => {
    }
  })

-  async function testAuthHeader(
-    testName: string,
-    serverUrl: string | undefined = undefined
-  ) {
+  const configureAuth_configuresAuthHeader =
+    'configureAuth configures auth header'
+  it(configureAuth_configuresAuthHeader, async () => {
    // Arrange
-    let expectedServerUrl = 'https://github.com'
-    if (serverUrl) {
-      githubServerUrl = serverUrl
-      expectedServerUrl = githubServerUrl
-    }
-
-    await setup(testName)
+    await setup(configureAuth_configuresAuthHeader)
    expect(settings.authToken).toBeTruthy() // sanity check
    const authHelper = gitAuthHelper.createAuthHelper(git, settings)

@@ -96,33 +88,9 @@ describe('git-auth-helper tests', () => {
    ).toString('base64')
    expect(
      configContent.indexOf(
-        `http.${expectedServerUrl}/.extraheader AUTHORIZATION: basic ${basicCredential}`
+        `http.https://github.com/.extraheader AUTHORIZATION: basic ${basicCredential}`
      )
    ).toBeGreaterThanOrEqual(0)
-  }
-
-  const configureAuth_configuresAuthHeader =
-    'configureAuth configures auth header'
-  it(configureAuth_configuresAuthHeader, async () => {
-    await testAuthHeader(configureAuth_configuresAuthHeader)
-  })
-
-  const configureAuth_AcceptsGitHubServerUrl =
-    'inject https://my-ghes-server.com as github server url'
-  it(configureAuth_AcceptsGitHubServerUrl, async () => {
-    await testAuthHeader(
-      configureAuth_AcceptsGitHubServerUrl,
-      'https://my-ghes-server.com'
-    )
-  })
-
-  const configureAuth_AcceptsGitHubServerUrlSetToGHEC =
-    'inject https://github.com as github server url'
-  it(configureAuth_AcceptsGitHubServerUrlSetToGHEC, async () => {
-    await testAuthHeader(
-      configureAuth_AcceptsGitHubServerUrl,
-      'https://github.com'
-    )
  })

  const configureAuth_configuresAuthHeaderEvenWhenPersistCredentialsFalse =
@@ -809,9 +777,7 @@ async function setup(testName: string): Promise<void> {
    sshKey: sshPath ? 'some ssh private key' : '',
    sshKnownHosts: '',
    sshStrict: true,
-    workflowOrganizationId: 123456,
-    setSafeDirectory: true,
-    githubServerUrl: githubServerUrl
+    workflowOrganizationId: 123456
  }
 }

--- a/test/input-helper.test.ts
+++ b/test/input-helper.test.ts
@@ -85,7 +85,6 @@ describe('input-helper tests', () => {
    expect(settings.repositoryName).toBe('some-repo')
    expect(settings.repositoryOwner).toBe('some-owner')
    expect(settings.repositoryPath).toBe(gitHubWorkspace)
-    expect(settings.setSafeDirectory).toBe(true)
  })

  it('qualifies ref', async () => {
--- a/action.yml
+++ b/action.yml
@@ -68,13 +68,7 @@ inputs:
      When the `ssh-key` input is not provided, SSH URLs beginning with `git@github.com:` are
      converted to HTTPS.
    default: false
-  set-safe-directory:
-    description: Add repository path as safe.directory for Git global config by running `git config --global --add safe.directory <path>`
-    default: true
-  github-server-url:
-    description: The base URL for the GitHub instance that you are trying to clone from, will use environment defaults to fetch from the same instance that the workflow is running from unless specified. Example URLs are https://github.com or https://my-ghes-server.example.com
-    required: false
 runs:
-  using: node16
+  using: node12
  main: dist/index.js
  post: dist/index.js
--- a/dist/index.js
+++ b/dist/index.js
@@ -1935,13 +1935,13 @@ var __importStar = (this && this.__importStar) || function (mod) {
    return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isGhes = exports.getServerApiUrl = exports.getServerUrl = exports.getFetchUrl = void 0;
+exports.getServerUrl = exports.getFetchUrl = void 0;
 const assert = __importStar(__webpack_require__(357));
 const url_1 = __webpack_require__(835);
 function getFetchUrl(settings) {
    assert.ok(settings.repositoryOwner, 'settings.repositoryOwner must be defined');
    assert.ok(settings.repositoryName, 'settings.repositoryName must be defined');
-    const serviceUrl = getServerUrl(settings.githubServerUrl);
+    const serviceUrl = getServerUrl();
    const encodedOwner = encodeURIComponent(settings.repositoryOwner);
    const encodedName = encodeURIComponent(settings.repositoryName);
    if (settings.sshKey) {
@@ -1951,27 +1951,13 @@ function getFetchUrl(settings) {
    return `${serviceUrl.origin}/${encodedOwner}/${encodedName}`;
 }
 exports.getFetchUrl = getFetchUrl;
-function getServerUrl(url) {
-    let urlValue = url && url.trim().length > 0
-        ? url
-        : process.env['GITHUB_SERVER_URL'] || 'https://github.com';
-    return new url_1.URL(urlValue);
+function getServerUrl() {
+    // todo: remove GITHUB_URL after support for GHES Alpha is no longer needed
+    return new url_1.URL(process.env['GITHUB_SERVER_URL'] ||
+        process.env['GITHUB_URL'] ||
+        'https://github.com');
 }
 exports.getServerUrl = getServerUrl;
-function getServerApiUrl(url) {
-    let apiUrl = 'https://api.github.com';
-    if (isGhes(url)) {
-        const serverUrl = getServerUrl(url);
-        apiUrl = new url_1.URL(`${serverUrl.origin}/api/v3`).toString();
-    }
-    return apiUrl;
-}
-exports.getServerApiUrl = getServerApiUrl;
-function isGhes(url) {
-    const ghUrl = getServerUrl(url);
-    return ghUrl.hostname.toUpperCase() !== 'GITHUB.COM';
-}
-exports.isGhes = isGhes;


 /***/ }),
@@ -3606,7 +3592,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
    return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setSafeDirectory = exports.setSshKnownHostsPath = exports.setSshKeyPath = exports.setRepositoryPath = exports.SshKnownHostsPath = exports.SshKeyPath = exports.PostSetSafeDirectory = exports.RepositoryPath = exports.IsPost = void 0;
+exports.setSshKnownHostsPath = exports.setSshKeyPath = exports.setRepositoryPath = exports.SshKnownHostsPath = exports.SshKeyPath = exports.RepositoryPath = exports.IsPost = void 0;
 const coreCommand = __importStar(__webpack_require__(431));
 /**
 * Indicates whether the POST action is running
@@ -3616,10 +3602,6 @@ exports.IsPost = !!process.env['STATE_isPost'];
 * The repository path for the POST action. The value is empty during the MAIN action.
 */
 exports.RepositoryPath = process.env['STATE_repositoryPath'] || '';
-/**
- * The set-safe-directory for the POST action. The value is set if input: 'safe-directory' is set during the MAIN action.
- */
-exports.PostSetSafeDirectory = process.env['STATE_setSafeDirectory'] === 'true';
 /**
 * The SSH key path for the POST action. The value is empty during the MAIN action.
 */
@@ -3649,13 +3631,6 @@ function setSshKnownHostsPath(sshKnownHostsPath) {
    coreCommand.issueCommand('save-state', { name: 'sshKnownHostsPath' }, sshKnownHostsPath);
 }
 exports.setSshKnownHostsPath = setSshKnownHostsPath;
-/**
- * Save the sef-safe-directory input so the POST action can retrieve the value.
- */
-function setSafeDirectory() {
-    coreCommand.issueCommand('save-state', { name: 'setSafeDirectory' }, 'true');
-}
-exports.setSafeDirectory = setSafeDirectory;
 // Publish a variable so that when the POST action runs, it can determine it should run the cleanup logic.
 // This is necessary since we don't have a separate entry point.
 if (!exports.IsPost) {
@@ -4080,51 +4055,6 @@ function authenticationPlugin(octokit, options) {
 }


-/***/ }),
-
-/***/ 195:
-/***/ (function(__unusedmodule, exports, __webpack_require__) {
-
-"use strict";
-
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getOctokit = exports.Octokit = void 0;
-const github = __importStar(__webpack_require__(469));
-const url_helper_1 = __webpack_require__(81);
-// Centralize all Octokit references by re-exporting
-var rest_1 = __webpack_require__(0);
-Object.defineProperty(exports, "Octokit", { enumerable: true, get: function () { return rest_1.Octokit; } });
-function getOctokit(authToken, opts) {
-    const options = {
-        baseUrl: (0, url_helper_1.getServerApiUrl)(opts.baseUrl)
-    };
-    if (opts.userAgent) {
-        options.userAgent = opts.userAgent;
-    }
-    return new github.GitHub(authToken, options);
-}
-exports.getOctokit = getOctokit;
-
-
 /***/ }),

 /***/ 197:
@@ -4299,7 +4229,7 @@ module.exports = require("punycode");
 /***/ 215:
 /***/ (function(module) {

-module.exports = {"name":"@octokit/rest","version":"16.43.1","publishConfig":{"access":"public"},"description":"GitHub REST API client for Node.js","keywords":["octokit","github","rest","api-client"],"author":"Gregor Martynus (https://github.com/gr2m)","contributors":[{"name":"Mike de Boer","email":"info@mikedeboer.nl"},{"name":"Fabian Jakobs","email":"fabian@c9.io"},{"name":"Joe Gallo","email":"joe@brassafrax.com"},{"name":"Gregor Martynus","url":"https://github.com/gr2m"}],"repository":"https://github.com/octokit/rest.js","dependencies":{"@octokit/auth-token":"^2.4.0","@octokit/plugin-paginate-rest":"^1.1.1","@octokit/plugin-request-log":"^1.0.0","@octokit/plugin-rest-endpoint-methods":"2.4.0","@octokit/request":"^5.2.0","@octokit/request-error":"^1.0.2","atob-lite":"^2.0.0","before-after-hook":"^2.0.0","btoa-lite":"^1.0.0","deprecation":"^2.0.0","lodash.get":"^4.4.2","lodash.set":"^4.3.2","lodash.uniq":"^4.5.0","octokit-pagination-methods":"^1.1.0","once":"^1.4.0","universal-user-agent":"^4.0.0"},"devDependencies":{"@gimenete/type-writer":"^0.1.3","@octokit/auth":"^1.1.1","@octokit/fixtures-server":"^5.0.6","@octokit/graphql":"^4.2.0","@types/node":"^13.1.0","bundlesize":"^0.18.0","chai":"^4.1.2","compression-webpack-plugin":"^3.1.0","cypress":"^3.0.0","glob":"^7.1.2","http-proxy-agent":"^4.0.0","lodash.camelcase":"^4.3.0","lodash.merge":"^4.6.1","lodash.upperfirst":"^4.3.1","lolex":"^5.1.2","mkdirp":"^1.0.0","mocha":"^7.0.1","mustache":"^4.0.0","nock":"^11.3.3","npm-run-all":"^4.1.2","nyc":"^15.0.0","prettier":"^1.14.2","proxy":"^1.0.0","semantic-release":"^17.0.0","sinon":"^8.0.0","sinon-chai":"^3.0.0","sort-keys":"^4.0.0","string-to-arraybuffer":"^1.0.0","string-to-jsdoc-comment":"^1.0.0","typescript":"^3.3.1","webpack":"^4.0.0","webpack-bundle-analyzer":"^3.0.0","webpack-cli":"^3.0.0"},"types":"index.d.ts","scripts":{"coverage":"nyc report --reporter=html && open coverage/index.html","lint":"prettier --check '{lib,plugins,scripts,test}/**/*.{js,json,ts}' 'docs/*.{js,json}' 'docs/src/**/*' index.js README.md package.json","lint:fix":"prettier --write '{lib,plugins,scripts,test}/**/*.{js,json,ts}' 'docs/*.{js,json}' 'docs/src/**/*' index.js README.md package.json","pretest":"npm run -s lint","test":"nyc mocha test/mocha-node-setup.js \"test/*/**/*-test.js\"","test:browser":"cypress run --browser chrome","build":"npm-run-all build:*","build:ts":"npm run -s update-endpoints:typescript","prebuild:browser":"mkdirp dist/","build:browser":"npm-run-all build:browser:*","build:browser:development":"webpack --mode development --entry . --output-library=Octokit --output=./dist/octokit-rest.js --profile --json > dist/bundle-stats.json","build:browser:production":"webpack --mode production --entry . --plugin=compression-webpack-plugin --output-library=Octokit --output-path=./dist --output-filename=octokit-rest.min.js --devtool source-map","generate-bundle-report":"webpack-bundle-analyzer dist/bundle-stats.json --mode=static --no-open --report dist/bundle-report.html","update-endpoints":"npm-run-all update-endpoints:*","update-endpoints:fetch-json":"node scripts/update-endpoints/fetch-json","update-endpoints:typescript":"node scripts/update-endpoints/typescript","prevalidate:ts":"npm run -s build:ts","validate:ts":"tsc --target es6 --noImplicitAny index.d.ts","postvalidate:ts":"tsc --noEmit --target es6 test/typescript-validate.ts","start-fixtures-server":"octokit-fixtures-server"},"license":"MIT","files":["index.js","index.d.ts","lib","plugins"],"nyc":{"ignore":["test"]},"release":{"publish":["@semantic-release/npm",{"path":"@semantic-release/github","assets":["dist/*","!dist/*.map.gz"]}]},"bundlesize":[{"path":"./dist/octokit-rest.min.js.gz","maxSize":"33 kB"}]};
+module.exports = {"name":"@octokit/rest","version":"16.43.1","publishConfig":{"access":"public"},"description":"GitHub REST API client for Node.js","keywords":["octokit","github","rest","api-client"],"author":"Gregor Martynus (https://github.com/gr2m)","contributors":[{"name":"Mike de Boer","email":"info@mikedeboer.nl"},{"name":"Fabian Jakobs","email":"fabian@c9.io"},{"name":"Joe Gallo","email":"joe@brassafrax.com"},{"name":"Gregor Martynus","url":"https://github.com/gr2m"}],"repository":"https://github.com/octokit/rest.js","dependencies":{"@octokit/auth-token":"^2.4.0","@octokit/plugin-paginate-rest":"^1.1.1","@octokit/plugin-request-log":"^1.0.0","@octokit/plugin-rest-endpoint-methods":"2.4.0","@octokit/request":"^5.2.0","@octokit/request-error":"^1.0.2","atob-lite":"^2.0.0","before-after-hook":"^2.0.0","btoa-lite":"^1.0.0","deprecation":"^2.0.0","lodash.get":"^4.4.2","lodash.set":"^4.3.2","lodash.uniq":"^4.5.0","octokit-pagination-methods":"^1.1.0","once":"^1.4.0","universal-user-agent":"^4.0.0"},"devDependencies":{"@gimenete/type-writer":"^0.1.3","@octokit/auth":"^1.1.1","@octokit/fixtures-server":"^5.0.6","@octokit/graphql":"^4.2.0","@types/node":"^13.1.0","bundlesize":"^0.18.0","chai":"^4.1.2","compression-webpack-plugin":"^3.1.0","cypress":"^3.0.0","glob":"^7.1.2","http-proxy-agent":"^4.0.0","lodash.camelcase":"^4.3.0","lodash.merge":"^4.6.1","lodash.upperfirst":"^4.3.1","lolex":"^5.1.2","mkdirp":"^1.0.0","mocha":"^7.0.1","mustache":"^4.0.0","nock":"^11.3.3","npm-run-all":"^4.1.2","nyc":"^15.0.0","prettier":"^1.14.2","proxy":"^1.0.0","semantic-release":"^17.0.0","sinon":"^8.0.0","sinon-chai":"^3.0.0","sort-keys":"^4.0.0","string-to-arraybuffer":"^1.0.0","string-to-jsdoc-comment":"^1.0.0","typescript":"^3.3.1","webpack":"^4.0.0","webpack-bundle-analyzer":"^3.0.0","webpack-cli":"^3.0.0"},"types":"index.d.ts","scripts":{"coverage":"nyc report --reporter=html && open coverage/index.html","lint":"prettier --check '{lib,plugins,scripts,test}/**/*.{js,json,ts}' 'docs/*.{js,json}' 'docs/src/**/*' index.js README.md package.json","lint:fix":"prettier --write '{lib,plugins,scripts,test}/**/*.{js,json,ts}' 'docs/*.{js,json}' 'docs/src/**/*' index.js README.md package.json","pretest":"npm run -s lint","test":"nyc mocha test/mocha-node-setup.js \"test/*/**/*-test.js\"","test:browser":"cypress run --browser chrome","build":"npm-run-all build:*","build:ts":"npm run -s update-endpoints:typescript","prebuild:browser":"mkdirp dist/","build:browser":"npm-run-all build:browser:*","build:browser:development":"webpack --mode development --entry . --output-library=Octokit --output=./dist/octokit-rest.js --profile --json > dist/bundle-stats.json","build:browser:production":"webpack --mode production --entry . --plugin=compression-webpack-plugin --output-library=Octokit --output-path=./dist --output-filename=octokit-rest.min.js --devtool source-map","generate-bundle-report":"webpack-bundle-analyzer dist/bundle-stats.json --mode=static --no-open --report dist/bundle-report.html","update-endpoints":"npm-run-all update-endpoints:*","update-endpoints:fetch-json":"node scripts/update-endpoints/fetch-json","update-endpoints:typescript":"node scripts/update-endpoints/typescript","prevalidate:ts":"npm run -s build:ts","validate:ts":"tsc --target es6 --noImplicitAny index.d.ts","postvalidate:ts":"tsc --noEmit --target es6 test/typescript-validate.ts","start-fixtures-server":"octokit-fixtures-server"},"license":"MIT","files":["index.js","index.d.ts","lib","plugins"],"nyc":{"ignore":["test"]},"release":{"publish":["@semantic-release/npm",{"path":"@semantic-release/github","assets":["dist/*","!dist/*.map.gz"]}]},"bundlesize":[{"path":"./dist/octokit-rest.min.js.gz","maxSize":"33 kB"}],"_resolved":"https://registry.npmjs.org/@octokit/rest/-/rest-16.43.1.tgz","_integrity":"sha512-gfFKwRT/wFxq5qlNjnW2dh+qh74XgTQ2B179UX5K1HYCluioWj8Ndbgqw2PVqa1NnVJkGHp2ovMpVn/DImlmkw==","_from":"@octokit/rest@16.43.1"};

 /***/ }),

@@ -4338,10 +4268,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkCommitInfo = exports.testRef = exports.getRefSpec = exports.getRefSpecForAllHistory = exports.getCheckoutInfo = exports.tagsRefSpec = void 0;
+const url_1 = __webpack_require__(835);
 const core = __importStar(__webpack_require__(470));
 const github = __importStar(__webpack_require__(469));
-const octokit_provider_1 = __webpack_require__(195);
-const url_helper_1 = __webpack_require__(81);
 exports.tagsRefSpec = '+refs/tags/*:refs/tags/*';
 function getCheckoutInfo(git, ref, commit) {
    return __awaiter(this, void 0, void 0, function* () {
@@ -4491,12 +4420,12 @@ function testRef(git, ref, commit) {
    });
 }
 exports.testRef = testRef;
-function checkCommitInfo(token, commitInfo, repositoryOwner, repositoryName, ref, commit, baseUrl) {
+function checkCommitInfo(token, commitInfo, repositoryOwner, repositoryName, ref, commit) {
    var _a, _b;
    return __awaiter(this, void 0, void 0, function* () {
        try {
            // GHES?
-            if ((0, url_helper_1.isGhes)(baseUrl)) {
+            if (isGhes()) {
                return;
            }
            // Auth token?
@@ -4541,8 +4470,7 @@ function checkCommitInfo(token, commitInfo, repositoryOwner, repositoryName, ref
            const actualHeadSha = match[1];
            if (actualHeadSha !== expectedHeadSha) {
                core.debug(`Expected head sha ${expectedHeadSha}; actual head sha ${actualHeadSha}`);
-                const octokit = (0, octokit_provider_1.getOctokit)(token, {
-                    baseUrl: baseUrl,
+                const octokit = new github.GitHub(token, {
                    userAgent: `actions-checkout-tracepoint/1.0 (code=STALE_MERGE;owner=${repositoryOwner};repo=${repositoryName};pr=${fromPayload('number')};run_id=${process.env['GITHUB_RUN_ID']};expected_head_sha=${expectedHeadSha};actual_head_sha=${actualHeadSha})`
                });
                yield octokit.repos.get({ owner: repositoryOwner, repo: repositoryName });
@@ -4568,6 +4496,10 @@ function select(obj, path) {
    const key = path.substr(0, i);
    return select(obj[key], path.substr(i + 1));
 }
+function isGhes() {
+    const ghUrl = new url_1.URL(process.env['GITHUB_SERVER_URL'] || 'https://github.com');
+    return ghUrl.hostname.toUpperCase() !== 'GITHUB.COM';
+}


 /***/ }),
@@ -6618,7 +6550,7 @@ class GitAuthHelper {
        this.git = gitCommandManager;
        this.settings = gitSourceSettings || {};
        // Token auth header
-        const serverUrl = urlHelper.getServerUrl(this.settings.githubServerUrl);
+        const serverUrl = urlHelper.getServerUrl();
        this.tokenConfigKey = `http.${serverUrl.origin}/.extraheader`; // "origin" is SCHEME://HOSTNAME[:PORT]
        const basicCredential = Buffer.from(`x-access-token:${this.settings.authToken}`, 'utf8').toString('base64');
        core.setSecret(basicCredential);
@@ -6640,7 +6572,7 @@ class GitAuthHelper {
            yield this.configureToken();
        });
    }
-    configureTempGlobalConfig() {
+    configureTempGlobalConfig(repositoryPath) {
        var _a, _b;
        return __awaiter(this, void 0, void 0, function* () {
            // Already setup global config
@@ -6676,6 +6608,14 @@ class GitAuthHelper {
            // Override HOME
            core.info(`Temporarily overriding HOME='${this.temporaryHomePath}' before making global git config changes`);
            this.git.setEnvironmentVariable('HOME', this.temporaryHomePath);
+            // Setup the workspace as a safe directory, so if we pass this into a container job with a different user it doesn't fail
+            // Otherwise all git commands we run in a container fail
+            core.info(`Adding working directory to the temporary git global config as a safe directory`);
+            yield this.git
+                .config('safe.directory', repositoryPath !== null && repositoryPath !== void 0 ? repositoryPath : this.settings.repositoryPath, true, true)
+                .catch(error => {
+                core.info(`Failed to initialize safe directory with error: ${error}`);
+            });
            return newGitConfigPath;
        });
    }
@@ -7412,18 +7352,7 @@ function getSource(settings) {
        try {
            if (git) {
                authHelper = gitAuthHelper.createAuthHelper(git, settings);
-                if (settings.setSafeDirectory) {
-                    // Setup the repository path as a safe directory, so if we pass this into a container job with a different user it doesn't fail
-                    // Otherwise all git commands we run in a container fail
-                    yield authHelper.configureTempGlobalConfig();
-                    core.info(`Adding repository directory to the temporary git global config as a safe directory`);
-                    yield git
-                        .config('safe.directory', settings.repositoryPath, true, true)
-                        .catch(error => {
-                        core.info(`Failed to initialize safe directory with error: ${error}`);
-                    });
-                    stateHelper.setSafeDirectory();
-                }
+                yield authHelper.configureTempGlobalConfig();
            }
            // Prepare existing directory, otherwise recreate
            if (isExisting) {
@@ -7439,7 +7368,7 @@ function getSource(settings) {
                else if (settings.sshKey) {
                    throw new Error(`Input 'ssh-key' not supported when falling back to download using the GitHub REST API. To create a local Git repository instead, add Git ${gitCommandManager.MinimumGitVersion} or higher to the PATH.`);
                }
-                yield githubApiHelper.downloadRepository(settings.authToken, settings.repositoryOwner, settings.repositoryName, settings.ref, settings.commit, settings.repositoryPath, settings.githubServerUrl);
+                yield githubApiHelper.downloadRepository(settings.authToken, settings.repositoryOwner, settings.repositoryName, settings.ref, settings.commit, settings.repositoryPath);
                return;
            }
            // Save state for POST action
@@ -7472,7 +7401,7 @@ function getSource(settings) {
                    settings.ref = yield git.getDefaultBranch(repositoryUrl);
                }
                else {
-                    settings.ref = yield githubApiHelper.getDefaultBranch(settings.authToken, settings.repositoryOwner, settings.repositoryName, settings.githubServerUrl);
+                    settings.ref = yield githubApiHelper.getDefaultBranch(settings.authToken, settings.repositoryOwner, settings.repositoryName);
                }
                core.endGroup();
            }
@@ -7538,7 +7467,7 @@ function getSource(settings) {
            // Log commit sha
            yield git.log1("--format='%H'");
            // Check for incorrect pull request merge commit
-            yield refHelper.checkCommitInfo(settings.authToken, commitInfo, settings.repositoryOwner, settings.repositoryName, settings.ref, settings.commit, settings.githubServerUrl);
+            yield refHelper.checkCommitInfo(settings.authToken, commitInfo, settings.repositoryOwner, settings.repositoryName, settings.ref, settings.commit);
        }
        finally {
            // Remove auth
@@ -7571,17 +7500,7 @@ function cleanup(repositoryPath) {
        // Remove auth
        const authHelper = gitAuthHelper.createAuthHelper(git);
        try {
-            if (stateHelper.PostSetSafeDirectory) {
-                // Setup the repository path as a safe directory, so if we pass this into a container job with a different user it doesn't fail
-                // Otherwise all git commands we run in a container fail
-                yield authHelper.configureTempGlobalConfig();
-                core.info(`Adding repository directory to the temporary git global config as a safe directory`);
-                yield git
-                    .config('safe.directory', repositoryPath, true, true)
-                    .catch(error => {
-                    core.info(`Failed to initialize safe directory with error: ${error}`);
-                });
-            }
+            yield authHelper.configureTempGlobalConfig(repositoryPath);
            yield authHelper.removeAuth();
        }
        finally {
@@ -10309,7 +10228,7 @@ Object.defineProperty(Response.prototype, Symbol.toStringTag, {
 });

 const INTERNALS$2 = Symbol('Request internals');
-const URL = Url.URL || whatwgUrl.URL;
+const URL = whatwgUrl.URL;

 // fix an issue where "format", "parse" aren't a named export for node <10
 const parse_url = Url.parse;
@@ -10572,17 +10491,9 @@ AbortError.prototype = Object.create(Error.prototype);
 AbortError.prototype.constructor = AbortError;
 AbortError.prototype.name = 'AbortError';

-const URL$1 = Url.URL || whatwgUrl.URL;
-
 // fix an issue where "PassThrough", "resolve" aren't a named export for node <10
 const PassThrough$1 = Stream.PassThrough;
-
-const isDomainOrSubdomain = function isDomainOrSubdomain(destination, original) {
-	const orig = new URL$1(original).hostname;
-	const dest = new URL$1(destination).hostname;
-
-	return orig === dest || orig[orig.length - dest.length - 1] === '.' && orig.endsWith(dest);
-};
+const resolve_url = Url.resolve;

 /**
 * Fetch function
@@ -10670,19 +10581,7 @@ function fetch(url, opts) {
 				const location = headers.get('Location');

 				// HTTP fetch step 5.3
-				let locationURL = null;
-				try {
-					locationURL = location === null ? null : new URL$1(location, request.url).toString();
-				} catch (err) {
-					// error here can only be invalid URL in Location: header
-					// do not throw when options.redirect == manual
-					// let the user extract the errorneous redirect URL
-					if (request.redirect !== 'manual') {
-						reject(new FetchError(`uri requested responds with an invalid redirect URL: ${location}`, 'invalid-redirect'));
-						finalize();
-						return;
-					}
-				}
+				const locationURL = location === null ? null : resolve_url(request.url, location);

 				// HTTP fetch step 5.5
 				switch (request.redirect) {
@@ -10730,12 +10629,6 @@ function fetch(url, opts) {
 							size: request.size
 						};

-						if (!isDomainOrSubdomain(request.url, locationURL)) {
-							for (const name of ['authorization', 'www-authenticate', 'cookie', 'cookie2']) {
-								requestOpts.headers.delete(name);
-							}
-						}
-
 						// HTTP-redirect fetch step 9
 						if (res.statusCode !== 303 && request.body && getTotalBytes(request) === null) {
 							reject(new FetchError('Cannot follow redirect with body being a readable stream', 'unsupported-redirect'));
@@ -11023,24 +10916,24 @@ exports.getDefaultBranch = exports.downloadRepository = void 0;
 const assert = __importStar(__webpack_require__(357));
 const core = __importStar(__webpack_require__(470));
 const fs = __importStar(__webpack_require__(747));
+const github = __importStar(__webpack_require__(469));
 const io = __importStar(__webpack_require__(1));
 const path = __importStar(__webpack_require__(622));
 const retryHelper = __importStar(__webpack_require__(587));
 const toolCache = __importStar(__webpack_require__(533));
 const v4_1 = __importDefault(__webpack_require__(826));
-const octokit_provider_1 = __webpack_require__(195);
 const IS_WINDOWS = process.platform === 'win32';
-function downloadRepository(authToken, owner, repo, ref, commit, repositoryPath, baseUrl) {
+function downloadRepository(authToken, owner, repo, ref, commit, repositoryPath) {
    return __awaiter(this, void 0, void 0, function* () {
        // Determine the default branch
        if (!ref && !commit) {
            core.info('Determining the default branch');
-            ref = yield getDefaultBranch(authToken, owner, repo, baseUrl);
+            ref = yield getDefaultBranch(authToken, owner, repo);
        }
        // Download the archive
        let archiveData = yield retryHelper.execute(() => __awaiter(this, void 0, void 0, function* () {
            core.info('Downloading the archive');
-            return yield downloadArchive(authToken, owner, repo, ref, commit, baseUrl);
+            return yield downloadArchive(authToken, owner, repo, ref, commit);
        }));
        // Write archive to disk
        core.info('Writing archive to disk');
@@ -11084,12 +10977,12 @@ exports.downloadRepository = downloadRepository;
 /**
 * Looks up the default branch name
 */
-function getDefaultBranch(authToken, owner, repo, baseUrl) {
+function getDefaultBranch(authToken, owner, repo) {
    return __awaiter(this, void 0, void 0, function* () {
        return yield retryHelper.execute(() => __awaiter(this, void 0, void 0, function* () {
            var _a;
            core.info('Retrieving the default branch name');
-            const octokit = (0, octokit_provider_1.getOctokit)(authToken, { baseUrl: baseUrl });
+            const octokit = new github.GitHub(authToken);
            let result;
            try {
                // Get the default branch from the repo info
@@ -11119,9 +11012,9 @@ function getDefaultBranch(authToken, owner, repo, baseUrl) {
    });
 }
 exports.getDefaultBranch = getDefaultBranch;
-function downloadArchive(authToken, owner, repo, ref, commit, baseUrl) {
+function downloadArchive(authToken, owner, repo, ref, commit) {
    return __awaiter(this, void 0, void 0, function* () {
-        const octokit = (0, octokit_provider_1.getOctokit)(authToken, { baseUrl: baseUrl });
+        const octokit = new github.GitHub(authToken);
        const params = {
            owner: owner,
            repo: repo,
@@ -17384,12 +17277,6 @@ function getInputs() {
            (core.getInput('persist-credentials') || 'false').toUpperCase() === 'TRUE';
        // Workflow organization ID
        result.workflowOrganizationId = yield workflowContextHelper.getOrganizationId();
-        // Set safe.directory in git global config.
-        result.setSafeDirectory =
-            (core.getInput('set-safe-directory') || 'true').toUpperCase() === 'TRUE';
-        // Determine the GitHub URL that the repository is being hosted from
-        result.githubServerUrl = core.getInput('github-server-url');
-        core.debug(`GitHub Host URL = ${result.githubServerUrl}`);
        return result;
    });
 }
--- a/package-lock.json
+++ b/package-lock.json
@@ -1929,6 +1929,12 @@
            "picomatch": "^2.2.3"
          }
        },
+        "minimist": {
+          "version": "1.2.5",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
+          "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+          "dev": true
+        },
        "normalize-path": {
          "version": "3.0.0",
          "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
@@ -3319,6 +3325,12 @@
            "picomatch": "^2.2.3"
          }
        },
+        "minimist": {
+          "version": "1.2.5",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
+          "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+          "dev": true
+        },
        "normalize-path": {
          "version": "3.0.0",
          "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
@@ -5377,6 +5389,12 @@
            "picomatch": "^2.2.3"
          }
        },
+        "minimist": {
+          "version": "1.2.5",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
+          "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+          "dev": true
+        },
        "normalize-path": {
          "version": "3.0.0",
          "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
@@ -7696,6 +7714,12 @@
            "minimist": "^1.2.5"
          }
        },
+        "minimist": {
+          "version": "1.2.5",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
+          "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+          "dev": true
+        },
        "semver": {
          "version": "6.3.0",
          "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
@@ -9344,6 +9368,12 @@
            "picomatch": "^2.2.3"
          }
        },
+        "minimist": {
+          "version": "1.2.5",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
+          "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+          "dev": true
+        },
        "normalize-path": {
          "version": "3.0.0",
          "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
@@ -11359,6 +11389,12 @@
            "picomatch": "^2.2.3"
          }
        },
+        "minimist": {
+          "version": "1.2.5",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
+          "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+          "dev": true
+        },
        "normalize-path": {
          "version": "3.0.0",
          "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
@@ -12904,6 +12940,12 @@
            "picomatch": "^2.2.3"
          }
        },
+        "minimist": {
+          "version": "1.2.5",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
+          "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+          "dev": true
+        },
        "normalize-path": {
          "version": "3.0.0",
          "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
@@ -13658,6 +13700,12 @@
            "picomatch": "^2.2.3"
          }
        },
+        "minimist": {
+          "version": "1.2.5",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
+          "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+          "dev": true
+        },
        "normalize-path": {
          "version": "3.0.0",
          "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
@@ -14585,6 +14633,12 @@
          "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
          "dev": true
        },
+        "minimist": {
+          "version": "1.2.5",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
+          "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+          "dev": true
+        },
        "normalize-path": {
          "version": "3.0.0",
          "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
@@ -15676,6 +15730,14 @@
      "dev": true,
      "requires": {
        "minimist": "^1.2.0"
+      },
+      "dependencies": {
+        "minimist": {
+          "version": "1.2.5",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
+          "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+          "dev": true
+        }
      }
    },
    "kleur": {
@@ -15872,9 +15934,9 @@
      }
    },
    "minimist": {
-      "version": "1.2.6",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
-      "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
+      "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
      "dev": true
    },
    "ms": {
@@ -15895,9 +15957,9 @@
      "integrity": "sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ=="
    },
    "node-fetch": {
-      "version": "2.6.7",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz",
-      "integrity": "sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==",
+      "version": "2.6.5",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.5.tgz",
+      "integrity": "sha512-mmlIVHJEu5rnIxgEgez6b9GgWXbkZj5YZ7fx+2r94a2E+Uirsp6HsPTPlomfdHtpt/B0cdKviwkoaM6pyvUOpQ==",
      "requires": {
        "whatwg-url": "^5.0.0"
      },
--- a/src/git-auth-helper.ts
+++ b/src/git-auth-helper.ts
@@ -19,7 +19,7 @@ export interface IGitAuthHelper {
  configureAuth(): Promise<void>
  configureGlobalAuth(): Promise<void>
  configureSubmoduleAuth(): Promise<void>
-  configureTempGlobalConfig(): Promise<string>
+  configureTempGlobalConfig(repositoryPath?: string): Promise<string>
  removeAuth(): Promise<void>
  removeGlobalConfig(): Promise<void>
 }
@@ -52,7 +52,7 @@ class GitAuthHelper {
    this.settings = gitSourceSettings || (({} as unknown) as IGitSourceSettings)

    // Token auth header
-    const serverUrl = urlHelper.getServerUrl(this.settings.githubServerUrl)
+    const serverUrl = urlHelper.getServerUrl()
    this.tokenConfigKey = `http.${serverUrl.origin}/.extraheader` // "origin" is SCHEME://HOSTNAME[:PORT]
    const basicCredential = Buffer.from(
      `x-access-token:${this.settings.authToken}`,
@@ -81,7 +81,7 @@ class GitAuthHelper {
    await this.configureToken()
  }

-  async configureTempGlobalConfig(): Promise<string> {
+  async configureTempGlobalConfig(repositoryPath?: string): Promise<string> {
    // Already setup global config
    if (this.temporaryHomePath?.length > 0) {
      return path.join(this.temporaryHomePath, '.gitconfig')
@@ -121,6 +121,21 @@ class GitAuthHelper {
    )
    this.git.setEnvironmentVariable('HOME', this.temporaryHomePath)

+    // Setup the workspace as a safe directory, so if we pass this into a container job with a different user it doesn't fail
+    // Otherwise all git commands we run in a container fail
+    core.info(
+      `Adding working directory to the temporary git global config as a safe directory`
+    )
+    await this.git
+      .config(
+        'safe.directory',
+        repositoryPath ?? this.settings.repositoryPath,
+        true,
+        true
+      )
+      .catch(error => {
+        core.info(`Failed to initialize safe directory with error: ${error}`)
+      })
    return newGitConfigPath
  }

--- a/src/git-source-provider.ts
+++ b/src/git-source-provider.ts
@@ -40,24 +40,7 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
  try {
    if (git) {
      authHelper = gitAuthHelper.createAuthHelper(git, settings)
-      if (settings.setSafeDirectory) {
-        // Setup the repository path as a safe directory, so if we pass this into a container job with a different user it doesn't fail
-        // Otherwise all git commands we run in a container fail
-        await authHelper.configureTempGlobalConfig()
-        core.info(
-          `Adding repository directory to the temporary git global config as a safe directory`
-        )
-
-        await git
-          .config('safe.directory', settings.repositoryPath, true, true)
-          .catch(error => {
-            core.info(
-              `Failed to initialize safe directory with error: ${error}`
-            )
-          })
-
-        stateHelper.setSafeDirectory()
-      }
+      await authHelper.configureTempGlobalConfig()
    }

    // Prepare existing directory, otherwise recreate
@@ -93,8 +76,7 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
        settings.repositoryName,
        settings.ref,
        settings.commit,
-        settings.repositoryPath,
-        settings.githubServerUrl
+        settings.repositoryPath
      )
      return
    }
@@ -139,8 +121,7 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
        settings.ref = await githubApiHelper.getDefaultBranch(
          settings.authToken,
          settings.repositoryOwner,
-          settings.repositoryName,
-          settings.githubServerUrl
+          settings.repositoryName
        )
      }
      core.endGroup()
@@ -234,8 +215,7 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
      settings.repositoryOwner,
      settings.repositoryName,
      settings.ref,
-      settings.commit,
-      settings.githubServerUrl
+      settings.commit
    )
  } finally {
    // Remove auth
@@ -269,21 +249,7 @@ export async function cleanup(repositoryPath: string): Promise<void> {
  // Remove auth
  const authHelper = gitAuthHelper.createAuthHelper(git)
  try {
-    if (stateHelper.PostSetSafeDirectory) {
-      // Setup the repository path as a safe directory, so if we pass this into a container job with a different user it doesn't fail
-      // Otherwise all git commands we run in a container fail
-      await authHelper.configureTempGlobalConfig()
-      core.info(
-        `Adding repository directory to the temporary git global config as a safe directory`
-      )
-
-      await git
-        .config('safe.directory', repositoryPath, true, true)
-        .catch(error => {
-          core.info(`Failed to initialize safe directory with error: ${error}`)
-        })
-    }
-
+    await authHelper.configureTempGlobalConfig(repositoryPath)
    await authHelper.removeAuth()
  } finally {
    await authHelper.removeGlobalConfig()
--- a/src/git-source-settings.ts
+++ b/src/git-source-settings.ts
@@ -78,14 +78,4 @@ export interface IGitSourceSettings {
   * Organization ID for the currently running workflow (used for auth settings)
   */
  workflowOrganizationId: number | undefined
-
-  /**
-   * Indicates whether to add repositoryPath as safe.directory in git global config
-   */
-  setSafeDirectory: boolean
-
-  /**
-   * User override on the GitHub Server/Host URL that hosts the repository to be cloned
-   */
-  githubServerUrl: string | undefined
 }
--- a/src/github-api-helper.ts
+++ b/src/github-api-helper.ts
@@ -1,12 +1,13 @@
 import * as assert from 'assert'
 import * as core from '@actions/core'
 import * as fs from 'fs'
+import * as github from '@actions/github'
 import * as io from '@actions/io'
 import * as path from 'path'
 import * as retryHelper from './retry-helper'
 import * as toolCache from '@actions/tool-cache'
 import {default as uuid} from 'uuid/v4'
-import {getOctokit, Octokit} from './octokit-provider'
+import {Octokit} from '@octokit/rest'

 const IS_WINDOWS = process.platform === 'win32'

@@ -16,19 +17,18 @@ export async function downloadRepository(
  repo: string,
  ref: string,
  commit: string,
-  repositoryPath: string,
-  baseUrl?: string
+  repositoryPath: string
 ): Promise<void> {
  // Determine the default branch
  if (!ref && !commit) {
    core.info('Determining the default branch')
-    ref = await getDefaultBranch(authToken, owner, repo, baseUrl)
+    ref = await getDefaultBranch(authToken, owner, repo)
  }

  // Download the archive
  let archiveData = await retryHelper.execute(async () => {
    core.info('Downloading the archive')
-    return await downloadArchive(authToken, owner, repo, ref, commit, baseUrl)
+    return await downloadArchive(authToken, owner, repo, ref, commit)
  })

  // Write archive to disk
@@ -79,12 +79,11 @@ export async function downloadRepository(
 export async function getDefaultBranch(
  authToken: string,
  owner: string,
-  repo: string,
-  baseUrl?: string
+  repo: string
 ): Promise<string> {
  return await retryHelper.execute(async () => {
    core.info('Retrieving the default branch name')
-    const octokit = getOctokit(authToken, {baseUrl: baseUrl})
+    const octokit = new github.GitHub(authToken)
    let result: string
    try {
      // Get the default branch from the repo info
@@ -122,10 +121,9 @@ async function downloadArchive(
  owner: string,
  repo: string,
  ref: string,
-  commit: string,
-  baseUrl?: string
+  commit: string
 ): Promise<Buffer> {
-  const octokit = getOctokit(authToken, {baseUrl: baseUrl})
+  const octokit = new github.GitHub(authToken)
  const params: Octokit.ReposGetArchiveLinkParams = {
    owner: owner,
    repo: repo,
--- a/src/input-helper.ts
+++ b/src/input-helper.ts
@@ -122,13 +122,5 @@ export async function getInputs(): Promise<IGitSourceSettings> {
  // Workflow organization ID
  result.workflowOrganizationId = await workflowContextHelper.getOrganizationId()

-  // Set safe.directory in git global config.
-  result.setSafeDirectory =
-    (core.getInput('set-safe-directory') || 'true').toUpperCase() === 'TRUE'
-
-  // Determine the GitHub URL that the repository is being hosted from
-  result.githubServerUrl = core.getInput('github-server-url')
-  core.debug(`GitHub Host URL = ${result.githubServerUrl}`)
-
  return result
 }
--- a/src/misc/generate-docs.ts
+++ b/src/misc/generate-docs.ts
@@ -120,7 +120,7 @@ function updateUsage(
 }

 updateUsage(
-  'actions/checkout@v3',
+  'actions/checkout@v2',
  path.join(__dirname, '..', '..', 'action.yml'),
  path.join(__dirname, '..', '..', 'README.md')
 )
--- a/src/misc/licensed-check.sh
+++ b/src/misc/licensed-check.sh
@@ -5,4 +5,4 @@ set -e
 src/misc/licensed-download.sh

 echo 'Running: licensed cached'
-_temp/licensed-3.6.0/licensed status
+_temp/licensed-3.3.1/licensed status
--- a/src/misc/licensed-download.sh
+++ b/src/misc/licensed-download.sh
@@ -2,23 +2,23 @@

 set -e

-if [ ! -f _temp/licensed-3.6.0.done ]; then
+if [ ! -f _temp/licensed-3.3.1.done ]; then
  echo 'Clearing temp'
-  rm -rf _temp/licensed-3.6.0 || true
+  rm -rf _temp/licensed-3.3.1 || true

  echo 'Downloading licensed'
-  mkdir -p _temp/licensed-3.6.0
-  pushd _temp/licensed-3.6.0
+  mkdir -p _temp/licensed-3.3.1
+  pushd _temp/licensed-3.3.1
  if [[ "$OSTYPE" == "darwin"* ]]; then
-    curl -Lfs -o licensed.tar.gz https://github.com/github/licensed/releases/download/3.6.0/licensed-3.6.0-darwin-x64.tar.gz
+    curl -Lfs -o licensed.tar.gz https://github.com/github/licensed/releases/download/3.3.1/licensed-3.3.1-darwin-x64.tar.gz
  else
-    curl -Lfs -o licensed.tar.gz https://github.com/github/licensed/releases/download/3.6.0/licensed-3.6.0-linux-x64.tar.gz
+    curl -Lfs -o licensed.tar.gz https://github.com/github/licensed/releases/download/3.3.1/licensed-3.3.1-linux-x64.tar.gz
  fi

  echo 'Extracting licenesed'
  tar -xzf licensed.tar.gz
  popd
-  touch _temp/licensed-3.6.0.done
+  touch _temp/licensed-3.3.1.done
 else
  echo 'Licensed already downloaded'
 fi
--- a/src/misc/licensed-generate.sh
+++ b/src/misc/licensed-generate.sh
@@ -5,4 +5,4 @@ set -e
 src/misc/licensed-download.sh

 echo 'Running: licensed cached'
-_temp/licensed-3.6.0/licensed cache
+_temp/licensed-3.3.1/licensed cache
--- a/src/octokit-provider.ts
+++ b/src/octokit-provider.ts
@@ -1,23 +0,0 @@
-import * as github from '@actions/github'
-import {Octokit} from '@octokit/rest'
-import {getServerApiUrl} from './url-helper'
-
-// Centralize all Octokit references by re-exporting
-export {Octokit} from '@octokit/rest'
-
-export type OctokitOptions = {
-  baseUrl?: string
-  userAgent?: string
-}
-
-export function getOctokit(authToken: string, opts: OctokitOptions) {
-  const options: Octokit.Options = {
-    baseUrl: getServerApiUrl(opts.baseUrl)
-  }
-
-  if (opts.userAgent) {
-    options.userAgent = opts.userAgent
-  }
-
-  return new github.GitHub(authToken, options)
-}
--- a/src/ref-helper.ts
+++ b/src/ref-helper.ts
@@ -1,8 +1,7 @@
+import {URL} from 'url'
 import {IGitCommandManager} from './git-command-manager'
 import * as core from '@actions/core'
 import * as github from '@actions/github'
-import {getOctokit} from './octokit-provider'
-import {isGhes} from './url-helper'

 export const tagsRefSpec = '+refs/tags/*:refs/tags/*'

@@ -184,12 +183,11 @@ export async function checkCommitInfo(
  repositoryOwner: string,
  repositoryName: string,
  ref: string,
-  commit: string,
-  baseUrl?: string
+  commit: string
 ): Promise<void> {
  try {
    // GHES?
-    if (isGhes(baseUrl)) {
+    if (isGhes()) {
      return
    }

@@ -245,8 +243,7 @@ export async function checkCommitInfo(
      core.debug(
        `Expected head sha ${expectedHeadSha}; actual head sha ${actualHeadSha}`
      )
-      const octokit = getOctokit(token, {
-        baseUrl: baseUrl,
+      const octokit = new github.GitHub(token, {
        userAgent: `actions-checkout-tracepoint/1.0 (code=STALE_MERGE;owner=${repositoryOwner};repo=${repositoryName};pr=${fromPayload(
          'number'
        )};run_id=${
@@ -279,3 +276,10 @@ function select(obj: any, path: string): any {
  const key = path.substr(0, i)
  return select(obj[key], path.substr(i + 1))
 }
+
+function isGhes(): boolean {
+  const ghUrl = new URL(
+    process.env['GITHUB_SERVER_URL'] || 'https://github.com'
+  )
+  return ghUrl.hostname.toUpperCase() !== 'GITHUB.COM'
+}
--- a/src/state-helper.ts
+++ b/src/state-helper.ts
@@ -11,12 +11,6 @@ export const IsPost = !!process.env['STATE_isPost']
 export const RepositoryPath =
  (process.env['STATE_repositoryPath'] as string) || ''

-/**
- * The set-safe-directory for the POST action. The value is set if input: 'safe-directory' is set during the MAIN action.
- */
-export const PostSetSafeDirectory =
-  (process.env['STATE_setSafeDirectory'] as string) === 'true'
-
 /**
 * The SSH key path for the POST action. The value is empty during the MAIN action.
 */
@@ -57,13 +51,6 @@ export function setSshKnownHostsPath(sshKnownHostsPath: string) {
  )
 }

-/**
- * Save the sef-safe-directory input so the POST action can retrieve the value.
- */
-export function setSafeDirectory() {
-  coreCommand.issueCommand('save-state', {name: 'setSafeDirectory'}, 'true')
-}
-
 // Publish a variable so that when the POST action runs, it can determine it should run the cleanup logic.
 // This is necessary since we don't have a separate entry point.
 if (!IsPost) {
--- a/src/url-helper.ts
+++ b/src/url-helper.ts
@@ -1,6 +1,6 @@
 import * as assert from 'assert'
-import {URL} from 'url'
 import {IGitSourceSettings} from './git-source-settings'
+import {URL} from 'url'

 export function getFetchUrl(settings: IGitSourceSettings): string {
  assert.ok(
@@ -8,7 +8,7 @@ export function getFetchUrl(settings: IGitSourceSettings): string {
    'settings.repositoryOwner must be defined'
  )
  assert.ok(settings.repositoryName, 'settings.repositoryName must be defined')
-  const serviceUrl = getServerUrl(settings.githubServerUrl)
+  const serviceUrl = getServerUrl()
  const encodedOwner = encodeURIComponent(settings.repositoryOwner)
  const encodedName = encodeURIComponent(settings.repositoryName)
  if (settings.sshKey) {
@@ -19,27 +19,11 @@ export function getFetchUrl(settings: IGitSourceSettings): string {
  return `${serviceUrl.origin}/${encodedOwner}/${encodedName}`
 }

-export function getServerUrl(url?: string): URL {
-  let urlValue =
-    url && url.trim().length > 0
-      ? url
-      : process.env['GITHUB_SERVER_URL'] || 'https://github.com'
-  return new URL(urlValue)
-}
-
-export function getServerApiUrl(url?: string): string {
-  let apiUrl = 'https://api.github.com'
-
-  if (isGhes(url)) {
-    const serverUrl = getServerUrl(url)
-    apiUrl = new URL(`${serverUrl.origin}/api/v3`).toString()
-  }
-
-  return apiUrl
-}
-
-export function isGhes(url?: string): boolean {
-  const ghUrl = getServerUrl(url)
-
-  return ghUrl.hostname.toUpperCase() !== 'GITHUB.COM'
+export function getServerUrl(): URL {
+  // todo: remove GITHUB_URL after support for GHES Alpha is no longer needed
+  return new URL(
+    process.env['GITHUB_SERVER_URL'] ||
+      process.env['GITHUB_URL'] ||
+      'https://github.com'
+  )
 }