Update and rename dependabot.yml to package.yml

* Update README to include Node.js 24 support details and requirements

* Update

.eslintignore

@@ -1,3 +0,0 @@
-dist/
-lib/
-node_modules/

.eslintrc.json

@@ -1,53 +0,0 @@
-{
-  "plugins": ["jest", "@typescript-eslint"],
-  "extends": ["plugin:github/recommended"],
-  "parser": "@typescript-eslint/parser",
-  "parserOptions": {
-    "ecmaVersion": 9,
-    "sourceType": "module",
-    "project": "./tsconfig.json"
-  },
-  "rules": {
-    "eslint-comments/no-use": "off",
-    "import/no-namespace": "off",
-    "no-unused-vars": "off",
-    "@typescript-eslint/no-unused-vars": "error",
-    "@typescript-eslint/explicit-member-accessibility": ["error", {"accessibility": "no-public"}],
-    "@typescript-eslint/no-require-imports": "error",
-    "@typescript-eslint/array-type": "error",
-    "@typescript-eslint/await-thenable": "error",
-    "camelcase": "off",
-    "@typescript-eslint/explicit-function-return-type": ["error", {"allowExpressions": true}],
-    "@typescript-eslint/func-call-spacing": ["error", "never"],
-    "@typescript-eslint/no-array-constructor": "error",
-    "@typescript-eslint/no-empty-interface": "error",
-    "@typescript-eslint/no-explicit-any": "error",
-    "@typescript-eslint/no-extraneous-class": "error",
-    "@typescript-eslint/no-floating-promises": "error",
-    "@typescript-eslint/no-for-in-array": "error",
-    "@typescript-eslint/no-inferrable-types": "error",
-    "@typescript-eslint/no-misused-new": "error",
-    "@typescript-eslint/no-namespace": "error",
-    "@typescript-eslint/no-non-null-assertion": "warn",
-    "@typescript-eslint/no-unnecessary-qualifier": "error",
-    "@typescript-eslint/no-unnecessary-type-assertion": "error",
-    "@typescript-eslint/no-useless-constructor": "error",
-    "@typescript-eslint/no-var-requires": "error",
-    "@typescript-eslint/prefer-for-of": "warn",
-    "@typescript-eslint/prefer-function-type": "warn",
-    "@typescript-eslint/prefer-includes": "error",
-    "@typescript-eslint/prefer-string-starts-ends-with": "error",
-    "@typescript-eslint/promise-function-async": "error",
-    "@typescript-eslint/require-array-sort-compare": "error",
-    "@typescript-eslint/restrict-plus-operands": "error",
-    "semi": "off",
-    "@typescript-eslint/semi": ["error", "never"],
-    "@typescript-eslint/type-annotation-spacing": "error",
-    "@typescript-eslint/unbound-method": "error"
-  },
-  "env": {
-    "node": true,
-    "es6": true,
-    "jest/globals": true
-  }
-}

.gitattributes

@@ -1 +1 @@
-.licenses/** -diff linguist-generated=true
+.licenses/**

.github/package.yml

@@ -3,7 +3,7 @@ version: 2
 
 updates:
 - package-ecosystem: "npm"
-  directory: "/"
+  directory: "npm/actions"
   schedule:
     interval: "weekly"
   groups:
@@ -11,7 +11,7 @@ updates:
       # NPM: Only group minor and patch updates (we want to carefully review major updates)
       update-types: [minor, patch]
 - package-ecosystem: "github-actions"
-  directory: "/"
+  directory: "github/actions"
   schedule:
     interval: "weekly"
   groups:

.github/workflows/publish-immutable-actions.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: android-latest
     permissions:
       contents: read
       id-token: write

.github/workflows/update-test-ubuntu-git.yml

@@ -1,59 +0,0 @@
-name: Publish test-ubuntu-git Container
-
-on:
-  # Use an on demand workflow trigger.  
-  # (Forked copies of actions/checkout won't have permission to update GHCR.io/actions, 
-  #  so avoid trigger events that run automatically.)
-  workflow_dispatch:
-    inputs:
-      publish:
-        description:  'Publish to ghcr.io? (main branch only)'
-        type: boolean
-        required: true
-        default: false
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: actions/test-ubuntu-git
-
-jobs:
-  build-and-push-image:
-    runs-on: ubuntu-latest
-    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
-    permissions:
-      contents: read
-      packages: write
- 
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      # Use `docker/login-action` to log in to GHCR.io. 
-      # Once published, the packages are scoped to the account defined here.
-      - name: Log in to the ghcr.io container registry
-        uses: docker/login-action@v3.3.0
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Format Timestamp
-        id: timestamp
-        # Use `date` with a custom format to achieve the key=value format GITHUB_OUTPUT expects.
-        run: date -u "+now=%Y%m%d.%H%M%S.%3NZ" >> "$GITHUB_OUTPUT"
-
-      - name: Issue Image Publish Warning
-        if:  ${{ inputs.publish && github.ref_name != 'main' }}
-        run: echo "::warning::test-ubuntu-git images can only be published from the actions/checkout 'main' branch.  Workflow will continue with push/publish disabled."
-
-      # Use `docker/build-push-action` to build (and optionally publish) the image. 
-      - name: Build Docker Image (with optional Push)
-        uses: docker/build-push-action@v6.5.0
-        with:
-          context: .
-          file: images/test-ubuntu-git.Dockerfile
-          # For now, attempts to push to ghcr.io must target the `main` branch.
-          # In the future, consider also allowing attempts from `releases/*` branches.
-          push: ${{ inputs.publish && github.ref_name == 'main' }}
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}.${{ steps.timestamp.outputs.now }}

.gitignore

@@ -1,5 +1,3 @@
 __test__/_temp
 _temp/
-lib/
 node_modules/
-.vscode/

.licensed.yml

@@ -1,5 +1,6 @@
 sources:
   npm: true
+  github: true
 
 allowed:
   - apache-2.0
@@ -7,8 +8,3 @@ allowed:
   - bsd-3-clause
   - isc
   - mit
-  - cc0-1.0
-  - unlicense
-
-reviewed:
-  npm:

.prettierrc.json

@@ -1,11 +0,0 @@
-{
-  "printWidth": 80,
-  "tabWidth": 2,
-  "useTabs": false,
-  "semi": false,
-  "singleQuote": true,
-  "trailingComma": "none",
-  "bracketSpacing": false,
-  "arrowParens": "avoid",
-  "parser": "typescript"
-}

README.md

@@ -2,7 +2,11 @@
 
 # Checkout V5
 
-Checkout v5 now supports Node.js 24
+## What's new
+
+- Updated to the node24 runtime
+  - This requires a minimum Actions Runner version of [v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) to run.
+
 
 # Checkout V4
 
@@ -148,24 +152,16 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
     # running from unless specified. Example URLs are https://github.com or
     # https://my-ghes-server.example.com
     github-server-url: ''
-
-    # Required to check out fork pull request code from a workflow triggered by
-    # `pull_request_target` or `workflow_run`. These workflows run with the base
-    # repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner
-    # access; fetching and executing a fork's code in that trusted context commonly
-    # leads to "pwn request" vulnerabilities. Set to `true` only after reviewing the
-    # risks at https://gh.io/securely-using-pull_request_target.
-    # Default: false
-    allow-unsafe-pr-checkout: ''
 ```
 <!-- end usage -->
 
 # Scenarios
 
 - [Checkout V5](#checkout-v5)
+  - [What's new](#whats-new)
 - [Checkout V4](#checkout-v4)
     - [Note](#note)
-- [What's new](#whats-new)
+- [What's new](#whats-new-1)
 - [Usage](#usage)
 - [Scenarios](#scenarios)
   - [Fetch only the root files](#fetch-only-the-root-files)

__test__/git-command-manager.test.ts

@@ -1,378 +0,0 @@
-import * as exec from '@actions/exec'
-import * as fshelper from '../lib/fs-helper'
-import * as commandManager from '../lib/git-command-manager'
-
-let git: commandManager.IGitCommandManager
-let mockExec = jest.fn()
-
-describe('git-auth-helper tests', () => {
-  beforeAll(async () => {})
-
-  beforeEach(async () => {
-    jest.spyOn(fshelper, 'fileExistsSync').mockImplementation(jest.fn())
-    jest.spyOn(fshelper, 'directoryExistsSync').mockImplementation(jest.fn())
-  })
-
-  afterEach(() => {
-    jest.restoreAllMocks()
-  })
-
-  afterAll(() => {})
-
-  it('branch list matches', async () => {
-    mockExec.mockImplementation((path, args, options) => {
-      console.log(args, options.listeners.stdout)
-
-      if (args.includes('version')) {
-        options.listeners.stdout(Buffer.from('2.18'))
-        return 0
-      }
-
-      if (args.includes('rev-parse')) {
-        options.listeners.stdline(Buffer.from('refs/heads/foo'))
-        options.listeners.stdline(Buffer.from('refs/heads/bar'))
-        return 0
-      }
-
-      return 1
-    })
-    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
-    const workingDirectory = 'test'
-    const lfs = false
-    const doSparseCheckout = false
-    git = await commandManager.createCommandManager(
-      workingDirectory,
-      lfs,
-      doSparseCheckout
-    )
-
-    let branches = await git.branchList(false)
-
-    expect(branches).toHaveLength(2)
-    expect(branches.sort()).toEqual(['foo', 'bar'].sort())
-  })
-
-  it('ambiguous ref name output is captured', async () => {
-    mockExec.mockImplementation((path, args, options) => {
-      console.log(args, options.listeners.stdout)
-
-      if (args.includes('version')) {
-        options.listeners.stdout(Buffer.from('2.18'))
-        return 0
-      }
-
-      if (args.includes('rev-parse')) {
-        options.listeners.stdline(Buffer.from('refs/heads/foo'))
-        // If refs/tags/v1 and refs/heads/tags/v1 existed on this repository
-        options.listeners.errline(
-          Buffer.from("error: refname 'tags/v1' is ambiguous")
-        )
-        return 0
-      }
-
-      return 1
-    })
-    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
-    const workingDirectory = 'test'
-    const lfs = false
-    const doSparseCheckout = false
-    git = await commandManager.createCommandManager(
-      workingDirectory,
-      lfs,
-      doSparseCheckout
-    )
-
-    let branches = await git.branchList(false)
-
-    expect(branches).toHaveLength(1)
-    expect(branches.sort()).toEqual(['foo'].sort())
-  })
-})
-
-describe('Test fetchDepth and fetchTags options', () => {
-  beforeEach(async () => {
-    jest.spyOn(fshelper, 'fileExistsSync').mockImplementation(jest.fn())
-    jest.spyOn(fshelper, 'directoryExistsSync').mockImplementation(jest.fn())
-    mockExec.mockImplementation((path, args, options) => {
-      console.log(args, options.listeners.stdout)
-
-      if (args.includes('version')) {
-        options.listeners.stdout(Buffer.from('2.18'))
-      }
-
-      return 0
-    })
-  })
-
-  afterEach(() => {
-    jest.restoreAllMocks()
-  })
-
-  it('should call execGit with the correct arguments when fetchDepth is 0 and fetchTags is true', async () => {
-    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
-    const workingDirectory = 'test'
-    const lfs = false
-    const doSparseCheckout = false
-    git = await commandManager.createCommandManager(
-      workingDirectory,
-      lfs,
-      doSparseCheckout
-    )
-
-    const refSpec = ['refspec1', 'refspec2']
-    const options = {
-      filter: 'filterValue',
-      fetchDepth: 0,
-      fetchTags: true
-    }
-
-    await git.fetch(refSpec, options)
-
-    expect(mockExec).toHaveBeenCalledWith(
-      expect.any(String),
-      [
-        '-c',
-        'protocol.version=2',
-        'fetch',
-        '--prune',
-        '--no-recurse-submodules',
-        '--filter=filterValue',
-        'origin',
-        'refspec1',
-        'refspec2'
-      ],
-      expect.any(Object)
-    )
-  })
-
-  it('should call execGit with the correct arguments when fetchDepth is 0 and fetchTags is false', async () => {
-    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
-
-    const workingDirectory = 'test'
-    const lfs = false
-    const doSparseCheckout = false
-    git = await commandManager.createCommandManager(
-      workingDirectory,
-      lfs,
-      doSparseCheckout
-    )
-    const refSpec = ['refspec1', 'refspec2']
-    const options = {
-      filter: 'filterValue',
-      fetchDepth: 0,
-      fetchTags: false
-    }
-
-    await git.fetch(refSpec, options)
-
-    expect(mockExec).toHaveBeenCalledWith(
-      expect.any(String),
-      [
-        '-c',
-        'protocol.version=2',
-        'fetch',
-        '--no-tags',
-        '--prune',
-        '--no-recurse-submodules',
-        '--filter=filterValue',
-        'origin',
-        'refspec1',
-        'refspec2'
-      ],
-      expect.any(Object)
-    )
-  })
-
-  it('should call execGit with the correct arguments when fetchDepth is 1 and fetchTags is false', async () => {
-    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
-
-    const workingDirectory = 'test'
-    const lfs = false
-    const doSparseCheckout = false
-    git = await commandManager.createCommandManager(
-      workingDirectory,
-      lfs,
-      doSparseCheckout
-    )
-    const refSpec = ['refspec1', 'refspec2']
-    const options = {
-      filter: 'filterValue',
-      fetchDepth: 1,
-      fetchTags: false
-    }
-
-    await git.fetch(refSpec, options)
-
-    expect(mockExec).toHaveBeenCalledWith(
-      expect.any(String),
-      [
-        '-c',
-        'protocol.version=2',
-        'fetch',
-        '--no-tags',
-        '--prune',
-        '--no-recurse-submodules',
-        '--filter=filterValue',
-        '--depth=1',
-        'origin',
-        'refspec1',
-        'refspec2'
-      ],
-      expect.any(Object)
-    )
-  })
-
-  it('should call execGit with the correct arguments when fetchDepth is 1 and fetchTags is true', async () => {
-    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
-
-    const workingDirectory = 'test'
-    const lfs = false
-    const doSparseCheckout = false
-    git = await commandManager.createCommandManager(
-      workingDirectory,
-      lfs,
-      doSparseCheckout
-    )
-    const refSpec = ['refspec1', 'refspec2']
-    const options = {
-      filter: 'filterValue',
-      fetchDepth: 1,
-      fetchTags: true
-    }
-
-    await git.fetch(refSpec, options)
-
-    expect(mockExec).toHaveBeenCalledWith(
-      expect.any(String),
-      [
-        '-c',
-        'protocol.version=2',
-        'fetch',
-        '--prune',
-        '--no-recurse-submodules',
-        '--filter=filterValue',
-        '--depth=1',
-        'origin',
-        'refspec1',
-        'refspec2'
-      ],
-      expect.any(Object)
-    )
-  })
-
-  it('should call execGit with the correct arguments when showProgress is true', async () => {
-    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
-
-    const workingDirectory = 'test'
-    const lfs = false
-    const doSparseCheckout = false
-    git = await commandManager.createCommandManager(
-      workingDirectory,
-      lfs,
-      doSparseCheckout
-    )
-    const refSpec = ['refspec1', 'refspec2']
-    const options = {
-      filter: 'filterValue',
-      showProgress: true
-    }
-
-    await git.fetch(refSpec, options)
-
-    expect(mockExec).toHaveBeenCalledWith(
-      expect.any(String),
-      [
-        '-c',
-        'protocol.version=2',
-        'fetch',
-        '--no-tags',
-        '--prune',
-        '--no-recurse-submodules',
-        '--progress',
-        '--filter=filterValue',
-        'origin',
-        'refspec1',
-        'refspec2'
-      ],
-      expect.any(Object)
-    )
-  })
-
-  it('should call execGit with the correct arguments when fetchDepth is 42 and showProgress is true', async () => {
-    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
-
-    const workingDirectory = 'test'
-    const lfs = false
-    const doSparseCheckout = false
-    git = await commandManager.createCommandManager(
-      workingDirectory,
-      lfs,
-      doSparseCheckout
-    )
-    const refSpec = ['refspec1', 'refspec2']
-    const options = {
-      filter: 'filterValue',
-      fetchDepth: 42,
-      showProgress: true
-    }
-
-    await git.fetch(refSpec, options)
-
-    expect(mockExec).toHaveBeenCalledWith(
-      expect.any(String),
-      [
-        '-c',
-        'protocol.version=2',
-        'fetch',
-        '--no-tags',
-        '--prune',
-        '--no-recurse-submodules',
-        '--progress',
-        '--filter=filterValue',
-        '--depth=42',
-        'origin',
-        'refspec1',
-        'refspec2'
-      ],
-      expect.any(Object)
-    )
-  })
-
-  it('should call execGit with the correct arguments when fetchTags is true and showProgress is true', async () => {
-    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
-
-    const workingDirectory = 'test'
-    const lfs = false
-    const doSparseCheckout = false
-    git = await commandManager.createCommandManager(
-      workingDirectory,
-      lfs,
-      doSparseCheckout
-    )
-    const refSpec = ['refspec1', 'refspec2']
-    const options = {
-      filter: 'filterValue',
-      fetchTags: true,
-      showProgress: true
-    }
-
-    await git.fetch(refSpec, options)
-
-    expect(mockExec).toHaveBeenCalledWith(
-      expect.any(String),
-      [
-        '-c',
-        'protocol.version=2',
-        'fetch',
-        '--prune',
-        '--no-recurse-submodules',
-        '--progress',
-        '--filter=filterValue',
-        'origin',
-        'refspec1',
-        'refspec2'
-      ],
-      expect.any(Object)
-    )
-  })
-})

__test__/git-directory-helper.test.ts

@@ -1,519 +0,0 @@
-import * as core from '@actions/core'
-import * as fs from 'fs'
-import * as gitDirectoryHelper from '../lib/git-directory-helper'
-import * as io from '@actions/io'
-import * as path from 'path'
-import {IGitCommandManager} from '../lib/git-command-manager'
-
-const testWorkspace = path.join(__dirname, '_temp', 'git-directory-helper')
-let repositoryPath: string
-let repositoryUrl: string
-let clean: boolean
-let ref: string
-let git: IGitCommandManager
-
-describe('git-directory-helper tests', () => {
-  beforeAll(async () => {
-    // Clear test workspace
-    await io.rmRF(testWorkspace)
-  })
-
-  beforeEach(() => {
-    // Mock error/warning/info/debug
-    jest.spyOn(core, 'error').mockImplementation(jest.fn())
-    jest.spyOn(core, 'warning').mockImplementation(jest.fn())
-    jest.spyOn(core, 'info').mockImplementation(jest.fn())
-    jest.spyOn(core, 'debug').mockImplementation(jest.fn())
-  })
-
-  afterEach(() => {
-    // Unregister mocks
-    jest.restoreAllMocks()
-  })
-
-  const cleansWhenCleanTrue = 'cleans when clean true'
-  it(cleansWhenCleanTrue, async () => {
-    // Arrange
-    await setup(cleansWhenCleanTrue)
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files.sort()).toEqual(['.git', 'my-file'])
-    expect(git.tryClean).toHaveBeenCalled()
-    expect(git.tryReset).toHaveBeenCalled()
-    expect(core.warning).not.toHaveBeenCalled()
-  })
-
-  const checkoutDetachWhenNotDetached = 'checkout detach when not detached'
-  it(checkoutDetachWhenNotDetached, async () => {
-    // Arrange
-    await setup(checkoutDetachWhenNotDetached)
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files.sort()).toEqual(['.git', 'my-file'])
-    expect(git.checkoutDetach).toHaveBeenCalled()
-  })
-
-  const doesNotCheckoutDetachWhenNotAlreadyDetached =
-    'does not checkout detach when already detached'
-  it(doesNotCheckoutDetachWhenNotAlreadyDetached, async () => {
-    // Arrange
-    await setup(doesNotCheckoutDetachWhenNotAlreadyDetached)
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    const mockIsDetached = git.isDetached as jest.Mock<any, any>
-    mockIsDetached.mockImplementation(async () => {
-      return true
-    })
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files.sort()).toEqual(['.git', 'my-file'])
-    expect(git.checkoutDetach).not.toHaveBeenCalled()
-  })
-
-  const doesNotCleanWhenCleanFalse = 'does not clean when clean false'
-  it(doesNotCleanWhenCleanFalse, async () => {
-    // Arrange
-    await setup(doesNotCleanWhenCleanFalse)
-    clean = false
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files.sort()).toEqual(['.git', 'my-file'])
-    expect(git.isDetached).toHaveBeenCalled()
-    expect(git.branchList).toHaveBeenCalled()
-    expect(core.warning).not.toHaveBeenCalled()
-    expect(git.tryClean).not.toHaveBeenCalled()
-    expect(git.tryReset).not.toHaveBeenCalled()
-  })
-
-  const removesContentsWhenCleanFails = 'removes contents when clean fails'
-  it(removesContentsWhenCleanFails, async () => {
-    // Arrange
-    await setup(removesContentsWhenCleanFails)
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    let mockTryClean = git.tryClean as jest.Mock<any, any>
-    mockTryClean.mockImplementation(async () => {
-      return false
-    })
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files).toHaveLength(0)
-    expect(git.tryClean).toHaveBeenCalled()
-    expect(core.warning).toHaveBeenCalled()
-    expect(git.tryReset).not.toHaveBeenCalled()
-  })
-
-  const removesContentsWhenDifferentRepositoryUrl =
-    'removes contents when different repository url'
-  it(removesContentsWhenDifferentRepositoryUrl, async () => {
-    // Arrange
-    await setup(removesContentsWhenDifferentRepositoryUrl)
-    clean = false
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    const differentRepositoryUrl =
-      'https://github.com/my-different-org/my-different-repo'
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      differentRepositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files).toHaveLength(0)
-    expect(core.warning).not.toHaveBeenCalled()
-    expect(git.isDetached).not.toHaveBeenCalled()
-  })
-
-  const removesContentsWhenNoGitDirectory =
-    'removes contents when no git directory'
-  it(removesContentsWhenNoGitDirectory, async () => {
-    // Arrange
-    await setup(removesContentsWhenNoGitDirectory)
-    clean = false
-    await io.rmRF(path.join(repositoryPath, '.git'))
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files).toHaveLength(0)
-    expect(core.warning).not.toHaveBeenCalled()
-    expect(git.isDetached).not.toHaveBeenCalled()
-  })
-
-  const removesContentsWhenResetFails = 'removes contents when reset fails'
-  it(removesContentsWhenResetFails, async () => {
-    // Arrange
-    await setup(removesContentsWhenResetFails)
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    let mockTryReset = git.tryReset as jest.Mock<any, any>
-    mockTryReset.mockImplementation(async () => {
-      return false
-    })
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files).toHaveLength(0)
-    expect(git.tryClean).toHaveBeenCalled()
-    expect(git.tryReset).toHaveBeenCalled()
-    expect(core.warning).toHaveBeenCalled()
-  })
-
-  const removesContentsWhenUndefinedGitCommandManager =
-    'removes contents when undefined git command manager'
-  it(removesContentsWhenUndefinedGitCommandManager, async () => {
-    // Arrange
-    await setup(removesContentsWhenUndefinedGitCommandManager)
-    clean = false
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      undefined,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files).toHaveLength(0)
-    expect(core.warning).not.toHaveBeenCalled()
-  })
-
-  const removesLocalBranches = 'removes local branches'
-  it(removesLocalBranches, async () => {
-    // Arrange
-    await setup(removesLocalBranches)
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    const mockBranchList = git.branchList as jest.Mock<any, any>
-    mockBranchList.mockImplementation(async (remote: boolean) => {
-      return remote ? [] : ['local-branch-1', 'local-branch-2']
-    })
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files.sort()).toEqual(['.git', 'my-file'])
-    expect(git.branchDelete).toHaveBeenCalledWith(false, 'local-branch-1')
-    expect(git.branchDelete).toHaveBeenCalledWith(false, 'local-branch-2')
-  })
-
-  const cleanWhenSubmoduleStatusIsFalse =
-    'cleans when submodule status is false'
-
-  it(cleanWhenSubmoduleStatusIsFalse, async () => {
-    // Arrange
-    await setup(cleanWhenSubmoduleStatusIsFalse)
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-
-    //mock bad submodule
-
-    const submoduleStatus = git.submoduleStatus as jest.Mock<any, any>
-    submoduleStatus.mockImplementation(async (remote: boolean) => {
-      return false
-    })
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files).toHaveLength(0)
-    expect(git.tryClean).toHaveBeenCalled()
-  })
-
-  const doesNotCleanWhenSubmoduleStatusIsTrue =
-    'does not clean when submodule status is true'
-
-  it(doesNotCleanWhenSubmoduleStatusIsTrue, async () => {
-    // Arrange
-    await setup(doesNotCleanWhenSubmoduleStatusIsTrue)
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-
-    const submoduleStatus = git.submoduleStatus as jest.Mock<any, any>
-    submoduleStatus.mockImplementation(async (remote: boolean) => {
-      return true
-    })
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files.sort()).toEqual(['.git', 'my-file'])
-    expect(git.tryClean).toHaveBeenCalled()
-  })
-
-  const removesLockFiles = 'removes lock files'
-  it(removesLockFiles, async () => {
-    // Arrange
-    await setup(removesLockFiles)
-    clean = false
-    await fs.promises.writeFile(
-      path.join(repositoryPath, '.git', 'index.lock'),
-      ''
-    )
-    await fs.promises.writeFile(
-      path.join(repositoryPath, '.git', 'shallow.lock'),
-      ''
-    )
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    let files = await fs.promises.readdir(path.join(repositoryPath, '.git'))
-    expect(files).toHaveLength(0)
-    files = await fs.promises.readdir(repositoryPath)
-    expect(files.sort()).toEqual(['.git', 'my-file'])
-    expect(git.isDetached).toHaveBeenCalled()
-    expect(git.branchList).toHaveBeenCalled()
-    expect(core.warning).not.toHaveBeenCalled()
-    expect(git.tryClean).not.toHaveBeenCalled()
-    expect(git.tryReset).not.toHaveBeenCalled()
-  })
-
-  const removesAncestorRemoteBranch = 'removes ancestor remote branch'
-  it(removesAncestorRemoteBranch, async () => {
-    // Arrange
-    await setup(removesAncestorRemoteBranch)
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    const mockBranchList = git.branchList as jest.Mock<any, any>
-    mockBranchList.mockImplementation(async (remote: boolean) => {
-      return remote ? ['origin/remote-branch-1', 'origin/remote-branch-2'] : []
-    })
-    ref = 'remote-branch-1/conflict'
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files.sort()).toEqual(['.git', 'my-file'])
-    expect(git.branchDelete).toHaveBeenCalledTimes(1)
-    expect(git.branchDelete).toHaveBeenCalledWith(
-      true,
-      'origin/remote-branch-1'
-    )
-  })
-
-  const removesDescendantRemoteBranches = 'removes descendant remote branch'
-  it(removesDescendantRemoteBranches, async () => {
-    // Arrange
-    await setup(removesDescendantRemoteBranches)
-    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    const mockBranchList = git.branchList as jest.Mock<any, any>
-    mockBranchList.mockImplementation(async (remote: boolean) => {
-      return remote
-        ? ['origin/remote-branch-1/conflict', 'origin/remote-branch-2']
-        : []
-    })
-    ref = 'remote-branch-1'
-
-    // Act
-    await gitDirectoryHelper.prepareExistingDirectory(
-      git,
-      repositoryPath,
-      repositoryUrl,
-      clean,
-      ref
-    )
-
-    // Assert
-    const files = await fs.promises.readdir(repositoryPath)
-    expect(files.sort()).toEqual(['.git', 'my-file'])
-    expect(git.branchDelete).toHaveBeenCalledTimes(1)
-    expect(git.branchDelete).toHaveBeenCalledWith(
-      true,
-      'origin/remote-branch-1/conflict'
-    )
-  })
-})
-
-async function setup(testName: string): Promise<void> {
-  testName = testName.replace(/[^a-zA-Z0-9_]+/g, '-')
-
-  // Repository directory
-  repositoryPath = path.join(testWorkspace, testName)
-  await fs.promises.mkdir(path.join(repositoryPath, '.git'), {recursive: true})
-
-  // Repository URL
-  repositoryUrl = 'https://github.com/my-org/my-repo'
-
-  // Clean
-  clean = true
-
-  // Ref
-  ref = ''
-
-  // Git command manager
-  git = {
-    branchDelete: jest.fn(),
-    branchExists: jest.fn(),
-    branchList: jest.fn(async () => {
-      return []
-    }),
-    disableSparseCheckout: jest.fn(),
-    sparseCheckout: jest.fn(),
-    sparseCheckoutNonConeMode: jest.fn(),
-    checkout: jest.fn(),
-    checkoutDetach: jest.fn(),
-    config: jest.fn(),
-    configExists: jest.fn(),
-    fetch: jest.fn(),
-    getDefaultBranch: jest.fn(),
-    getWorkingDirectory: jest.fn(() => repositoryPath),
-    init: jest.fn(),
-    isDetached: jest.fn(),
-    lfsFetch: jest.fn(),
-    lfsInstall: jest.fn(),
-    log1: jest.fn(),
-    remoteAdd: jest.fn(),
-    removeEnvironmentVariable: jest.fn(),
-    revParse: jest.fn(),
-    setEnvironmentVariable: jest.fn(),
-    shaExists: jest.fn(),
-    submoduleForeach: jest.fn(),
-    submoduleSync: jest.fn(),
-    submoduleUpdate: jest.fn(),
-    submoduleStatus: jest.fn(async () => {
-      return true
-    }),
-    tagExists: jest.fn(),
-    tryClean: jest.fn(async () => {
-      return true
-    }),
-    tryConfigUnset: jest.fn(),
-    tryDisableAutomaticGarbageCollection: jest.fn(),
-    tryGetFetchUrl: jest.fn(async () => {
-      // Sanity check - this function shouldn't be called when the .git directory doesn't exist
-      await fs.promises.stat(path.join(repositoryPath, '.git'))
-      return repositoryUrl
-    }),
-    getSubmoduleConfigPaths: jest.fn(async () => {
-      return []
-    }),
-    tryConfigUnsetValue: jest.fn(async () => {
-      return true
-    }),
-    tryGetConfigValues: jest.fn(async () => {
-      return []
-    }),
-    tryGetConfigKeys: jest.fn(async () => {
-      return []
-    }),
-    tryReset: jest.fn(async () => {
-      return true
-    }),
-    version: jest.fn()
-  }
-}

__test__/git-version.test.ts

@@ -1,86 +0,0 @@
-import {GitVersion} from '../src/git-version'
-import {MinimumGitSparseCheckoutVersion} from '../src/git-command-manager'
-
-describe('git-version tests', () => {
-  it('basics', async () => {
-    let version = new GitVersion('')
-    expect(version.isValid()).toBeFalsy()
-
-    version = new GitVersion('asdf')
-    expect(version.isValid()).toBeFalsy()
-
-    version = new GitVersion('1.2')
-    expect(version.isValid()).toBeTruthy()
-    expect(version.toString()).toBe('1.2')
-
-    version = new GitVersion('1.2.3')
-    expect(version.isValid()).toBeTruthy()
-    expect(version.toString()).toBe('1.2.3')
-  })
-
-  it('check minimum', async () => {
-    let version = new GitVersion('4.5')
-    expect(version.checkMinimum(new GitVersion('3.6'))).toBeTruthy()
-    expect(version.checkMinimum(new GitVersion('3.6.7'))).toBeTruthy()
-    expect(version.checkMinimum(new GitVersion('4.4'))).toBeTruthy()
-    expect(version.checkMinimum(new GitVersion('4.5'))).toBeTruthy()
-    expect(version.checkMinimum(new GitVersion('4.5.0'))).toBeTruthy()
-    expect(version.checkMinimum(new GitVersion('4.6'))).toBeFalsy()
-    expect(version.checkMinimum(new GitVersion('4.6.0'))).toBeFalsy()
-    expect(version.checkMinimum(new GitVersion('5.1'))).toBeFalsy()
-    expect(version.checkMinimum(new GitVersion('5.1.2'))).toBeFalsy()
-
-    version = new GitVersion('4.5.6')
-    expect(version.checkMinimum(new GitVersion('3.6'))).toBeTruthy()
-    expect(version.checkMinimum(new GitVersion('3.6.7'))).toBeTruthy()
-    expect(version.checkMinimum(new GitVersion('4.4'))).toBeTruthy()
-    expect(version.checkMinimum(new GitVersion('4.5'))).toBeTruthy()
-    expect(version.checkMinimum(new GitVersion('4.5.5'))).toBeTruthy()
-    expect(version.checkMinimum(new GitVersion('4.5.6'))).toBeTruthy()
-    expect(version.checkMinimum(new GitVersion('4.5.7'))).toBeFalsy()
-    expect(version.checkMinimum(new GitVersion('4.6'))).toBeFalsy()
-    expect(version.checkMinimum(new GitVersion('4.6.0'))).toBeFalsy()
-    expect(version.checkMinimum(new GitVersion('5.1'))).toBeFalsy()
-    expect(version.checkMinimum(new GitVersion('5.1.2'))).toBeFalsy()
-  })
-
-  it('sparse checkout', async () => {
-    const minSparseVer = MinimumGitSparseCheckoutVersion
-    expect(new GitVersion('1.0').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('1.99').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.0').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.24').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.24.0').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.24.9').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.25').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.25.0').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.25.1').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.25.9').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.26').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.26.0').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.26.1').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.26.9').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.27').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.27.0').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.27.1').checkMinimum(minSparseVer)).toBeFalsy()
-    expect(new GitVersion('2.27.9').checkMinimum(minSparseVer)).toBeFalsy()
-    //                             /---------------------------------------
-    //         ^^^ before         /         after vvv
-    // --------------------------/
-    expect(new GitVersion('2.28').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('2.28.0').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('2.28.1').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('2.28.9').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('2.29').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('2.29.0').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('2.29.1').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('2.29.9').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('2.99').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('3.0').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('3.99').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('4.0').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('4.99').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('5.0').checkMinimum(minSparseVer)).toBeTruthy()
-    expect(new GitVersion('5.99').checkMinimum(minSparseVer)).toBeTruthy()
-  })
-})

__test__/input-helper.test.ts

@@ -1,148 +0,0 @@
-import * as core from '@actions/core'
-import * as fsHelper from '../lib/fs-helper'
-import * as github from '@actions/github'
-import * as inputHelper from '../lib/input-helper'
-import * as path from 'path'
-import * as workflowContextHelper from '../lib/workflow-context-helper'
-import {IGitSourceSettings} from '../lib/git-source-settings'
-
-const originalGitHubWorkspace = process.env['GITHUB_WORKSPACE']
-const gitHubWorkspace = path.resolve('/checkout-tests/workspace')
-
-// Inputs for mock @actions/core
-let inputs = {} as any
-
-// Shallow clone original @actions/github context
-let originalContext = {...github.context}
-
-describe('input-helper tests', () => {
-  beforeAll(() => {
-    // Mock getInput
-    jest.spyOn(core, 'getInput').mockImplementation((name: string) => {
-      return inputs[name]
-    })
-
-    // Mock error/warning/info/debug
-    jest.spyOn(core, 'error').mockImplementation(jest.fn())
-    jest.spyOn(core, 'warning').mockImplementation(jest.fn())
-    jest.spyOn(core, 'info').mockImplementation(jest.fn())
-    jest.spyOn(core, 'debug').mockImplementation(jest.fn())
-
-    // Mock github context
-    jest.spyOn(github.context, 'repo', 'get').mockImplementation(() => {
-      return {
-        owner: 'some-owner',
-        repo: 'some-repo'
-      }
-    })
-    github.context.ref = 'refs/heads/some-ref'
-    github.context.sha = '1234567890123456789012345678901234567890'
-
-    // Mock ./fs-helper directoryExistsSync()
-    jest
-      .spyOn(fsHelper, 'directoryExistsSync')
-      .mockImplementation((path: string) => path == gitHubWorkspace)
-
-    // Mock ./workflowContextHelper getOrganizationId()
-    jest
-      .spyOn(workflowContextHelper, 'getOrganizationId')
-      .mockImplementation(() => Promise.resolve(123456))
-
-    // GitHub workspace
-    process.env['GITHUB_WORKSPACE'] = gitHubWorkspace
-  })
-
-  beforeEach(() => {
-    // Reset inputs
-    inputs = {}
-  })
-
-  afterAll(() => {
-    // Restore GitHub workspace
-    delete process.env['GITHUB_WORKSPACE']
-    if (originalGitHubWorkspace) {
-      process.env['GITHUB_WORKSPACE'] = originalGitHubWorkspace
-    }
-
-    // Restore @actions/github context
-    github.context.ref = originalContext.ref
-    github.context.sha = originalContext.sha
-
-    // Restore
-    jest.restoreAllMocks()
-  })
-
-  it('sets defaults', async () => {
-    const settings: IGitSourceSettings = await inputHelper.getInputs()
-    expect(settings).toBeTruthy()
-    expect(settings.authToken).toBeFalsy()
-    expect(settings.clean).toBe(true)
-    expect(settings.commit).toBeTruthy()
-    expect(settings.commit).toBe('1234567890123456789012345678901234567890')
-    expect(settings.filter).toBe(undefined)
-    expect(settings.sparseCheckout).toBe(undefined)
-    expect(settings.sparseCheckoutConeMode).toBe(true)
-    expect(settings.fetchDepth).toBe(1)
-    expect(settings.fetchTags).toBe(false)
-    expect(settings.showProgress).toBe(true)
-    expect(settings.lfs).toBe(false)
-    expect(settings.ref).toBe('refs/heads/some-ref')
-    expect(settings.repositoryName).toBe('some-repo')
-    expect(settings.repositoryOwner).toBe('some-owner')
-    expect(settings.repositoryPath).toBe(gitHubWorkspace)
-    expect(settings.setSafeDirectory).toBe(true)
-    expect(settings.allowUnsafePrCheckout).toBe(false)
-  })
-
-  it('qualifies ref', async () => {
-    let originalRef = github.context.ref
-    try {
-      github.context.ref = 'some-unqualified-ref'
-      const settings: IGitSourceSettings = await inputHelper.getInputs()
-      expect(settings).toBeTruthy()
-      expect(settings.commit).toBe('1234567890123456789012345678901234567890')
-      expect(settings.ref).toBe('refs/heads/some-unqualified-ref')
-    } finally {
-      github.context.ref = originalRef
-    }
-  })
-
-  it('requires qualified repo', async () => {
-    inputs.repository = 'some-unqualified-repo'
-    try {
-      await inputHelper.getInputs()
-      throw 'should not reach here'
-    } catch (err) {
-      expect(`(${(err as any).message}`).toMatch(
-        "Invalid repository 'some-unqualified-repo'"
-      )
-    }
-  })
-
-  it('roots path', async () => {
-    inputs.path = 'some-directory/some-subdirectory'
-    const settings: IGitSourceSettings = await inputHelper.getInputs()
-    expect(settings.repositoryPath).toBe(
-      path.join(gitHubWorkspace, 'some-directory', 'some-subdirectory')
-    )
-  })
-
-  it('sets ref to empty when explicit sha', async () => {
-    inputs.ref = '1111111111222222222233333333334444444444'
-    const settings: IGitSourceSettings = await inputHelper.getInputs()
-    expect(settings.ref).toBeFalsy()
-    expect(settings.commit).toBe('1111111111222222222233333333334444444444')
-  })
-
-  it('sets sha to empty when explicit ref', async () => {
-    inputs.ref = 'refs/heads/some-other-ref'
-    const settings: IGitSourceSettings = await inputHelper.getInputs()
-    expect(settings.ref).toBe('refs/heads/some-other-ref')
-    expect(settings.commit).toBeFalsy()
-  })
-
-  it('sets workflow organization ID', async () => {
-    const settings: IGitSourceSettings = await inputHelper.getInputs()
-    expect(settings.workflowOrganizationId).toBe(123456)
-  })
-})

__test__/modify-work-tree.sh

@@ -1,10 +0,0 @@
-#!/bin/bash
-
-if [ ! -f "./basic/basic-file.txt" ]; then
-    echo "Expected basic file does not exist"
-    exit 1
-fi
-
-echo hello >> ./basic/basic-file.txt
-echo hello >> ./basic/new-file.txt
-git -C ./basic status

__test__/override-git-version.cmd

@@ -1,6 +0,0 @@
-
-mkdir override-git-version
-cd override-git-version
-echo @echo override git version 1.2.3 > git.cmd
-echo "%CD%" >> $GITHUB_PATH
-cd ..

__test__/override-git-version.sh

@@ -1,9 +0,0 @@
-#!/bin/sh
-
-mkdir override-git-version
-cd override-git-version
-echo "#!/bin/sh" > git
-echo "echo override git version 1.2.3" >> git
-chmod +x git
-echo "$(pwd)" >> $GITHUB_PATH
-cd ..

__test__/ref-helper.test.ts

@@ -1,190 +0,0 @@
-import * as assert from 'assert'
-import * as refHelper from '../lib/ref-helper'
-import {IGitCommandManager} from '../lib/git-command-manager'
-
-const commit = '1234567890123456789012345678901234567890'
-let git: IGitCommandManager
-
-describe('ref-helper tests', () => {
-  beforeEach(() => {
-    git = {} as unknown as IGitCommandManager
-  })
-
-  it('getCheckoutInfo requires git', async () => {
-    const git = null as unknown as IGitCommandManager
-    try {
-      await refHelper.getCheckoutInfo(git, 'refs/heads/my/branch', commit)
-      throw new Error('Should not reach here')
-    } catch (err) {
-      expect((err as any)?.message).toBe('Arg git cannot be empty')
-    }
-  })
-
-  it('getCheckoutInfo requires ref or commit', async () => {
-    try {
-      await refHelper.getCheckoutInfo(git, '', '')
-      throw new Error('Should not reach here')
-    } catch (err) {
-      expect((err as any)?.message).toBe(
-        'Args ref and commit cannot both be empty'
-      )
-    }
-  })
-
-  it('getCheckoutInfo sha only', async () => {
-    const checkoutInfo = await refHelper.getCheckoutInfo(git, '', commit)
-    expect(checkoutInfo.ref).toBe(commit)
-    expect(checkoutInfo.startPoint).toBeFalsy()
-  })
-
-  it('getCheckoutInfo refs/heads/', async () => {
-    const checkoutInfo = await refHelper.getCheckoutInfo(
-      git,
-      'refs/heads/my/branch',
-      commit
-    )
-    expect(checkoutInfo.ref).toBe('my/branch')
-    expect(checkoutInfo.startPoint).toBe('refs/remotes/origin/my/branch')
-  })
-
-  it('getCheckoutInfo refs/pull/', async () => {
-    const checkoutInfo = await refHelper.getCheckoutInfo(
-      git,
-      'refs/pull/123/merge',
-      commit
-    )
-    expect(checkoutInfo.ref).toBe('refs/remotes/pull/123/merge')
-    expect(checkoutInfo.startPoint).toBeFalsy()
-  })
-
-  it('getCheckoutInfo refs/tags/', async () => {
-    const checkoutInfo = await refHelper.getCheckoutInfo(
-      git,
-      'refs/tags/my-tag',
-      commit
-    )
-    expect(checkoutInfo.ref).toBe('refs/tags/my-tag')
-    expect(checkoutInfo.startPoint).toBeFalsy()
-  })
-
-  it('getCheckoutInfo refs/', async () => {
-    const checkoutInfo = await refHelper.getCheckoutInfo(
-      git,
-      'refs/gh/queue/main/pr-123',
-      commit
-    )
-    expect(checkoutInfo.ref).toBe(commit)
-    expect(checkoutInfo.startPoint).toBeFalsy()
-  })
-
-  it('getCheckoutInfo refs/ without commit', async () => {
-    const checkoutInfo = await refHelper.getCheckoutInfo(
-      git,
-      'refs/non-standard-ref',
-      ''
-    )
-    expect(checkoutInfo.ref).toBe('refs/non-standard-ref')
-    expect(checkoutInfo.startPoint).toBeFalsy()
-  })
-
-  it('getCheckoutInfo unqualified branch only', async () => {
-    git.branchExists = jest.fn(async (remote: boolean, pattern: string) => {
-      return true
-    })
-
-    const checkoutInfo = await refHelper.getCheckoutInfo(git, 'my/branch', '')
-
-    expect(checkoutInfo.ref).toBe('my/branch')
-    expect(checkoutInfo.startPoint).toBe('refs/remotes/origin/my/branch')
-  })
-
-  it('getCheckoutInfo unqualified tag only', async () => {
-    git.branchExists = jest.fn(async (remote: boolean, pattern: string) => {
-      return false
-    })
-    git.tagExists = jest.fn(async (pattern: string) => {
-      return true
-    })
-
-    const checkoutInfo = await refHelper.getCheckoutInfo(git, 'my-tag', '')
-
-    expect(checkoutInfo.ref).toBe('refs/tags/my-tag')
-    expect(checkoutInfo.startPoint).toBeFalsy()
-  })
-
-  it('getCheckoutInfo unqualified ref only, not a branch or tag', async () => {
-    git.branchExists = jest.fn(async (remote: boolean, pattern: string) => {
-      return false
-    })
-    git.tagExists = jest.fn(async (pattern: string) => {
-      return false
-    })
-
-    try {
-      await refHelper.getCheckoutInfo(git, 'my-ref', '')
-      throw new Error('Should not reach here')
-    } catch (err) {
-      expect((err as any)?.message).toBe(
-        "A branch or tag with the name 'my-ref' could not be found"
-      )
-    }
-  })
-
-  it('getRefSpec requires ref or commit', async () => {
-    assert.throws(
-      () => refHelper.getRefSpec('', ''),
-      /Args ref and commit cannot both be empty/
-    )
-  })
-
-  it('getRefSpec sha + refs/heads/', async () => {
-    const refSpec = refHelper.getRefSpec('refs/heads/my/branch', commit)
-    expect(refSpec.length).toBe(1)
-    expect(refSpec[0]).toBe(`+${commit}:refs/remotes/origin/my/branch`)
-  })
-
-  it('getRefSpec sha + refs/pull/', async () => {
-    const refSpec = refHelper.getRefSpec('refs/pull/123/merge', commit)
-    expect(refSpec.length).toBe(1)
-    expect(refSpec[0]).toBe(`+${commit}:refs/remotes/pull/123/merge`)
-  })
-
-  it('getRefSpec sha + refs/tags/', async () => {
-    const refSpec = refHelper.getRefSpec('refs/tags/my-tag', commit)
-    expect(refSpec.length).toBe(1)
-    expect(refSpec[0]).toBe(`+${commit}:refs/tags/my-tag`)
-  })
-
-  it('getRefSpec sha only', async () => {
-    const refSpec = refHelper.getRefSpec('', commit)
-    expect(refSpec.length).toBe(1)
-    expect(refSpec[0]).toBe(commit)
-  })
-
-  it('getRefSpec unqualified ref only', async () => {
-    const refSpec = refHelper.getRefSpec('my-ref', '')
-    expect(refSpec.length).toBe(2)
-    expect(refSpec[0]).toBe('+refs/heads/my-ref*:refs/remotes/origin/my-ref*')
-    expect(refSpec[1]).toBe('+refs/tags/my-ref*:refs/tags/my-ref*')
-  })
-
-  it('getRefSpec refs/heads/ only', async () => {
-    const refSpec = refHelper.getRefSpec('refs/heads/my/branch', '')
-    expect(refSpec.length).toBe(1)
-    expect(refSpec[0]).toBe(
-      '+refs/heads/my/branch:refs/remotes/origin/my/branch'
-    )
-  })
-
-  it('getRefSpec refs/pull/ only', async () => {
-    const refSpec = refHelper.getRefSpec('refs/pull/123/merge', '')
-    expect(refSpec.length).toBe(1)
-    expect(refSpec[0]).toBe('+refs/pull/123/merge:refs/remotes/pull/123/merge')
-  })
-
-  it('getRefSpec refs/tags/ only', async () => {
-    const refSpec = refHelper.getRefSpec('refs/tags/my-tag', '')
-    expect(refSpec.length).toBe(1)
-    expect(refSpec[0]).toBe('+refs/tags/my-tag:refs/tags/my-tag')
-  })
-})

__test__/retry-helper.test.ts

@@ -1,87 +0,0 @@
-import * as core from '@actions/core'
-import {RetryHelper} from '../lib/retry-helper'
-
-let info: string[]
-let retryHelper: any
-
-describe('retry-helper tests', () => {
-  beforeAll(() => {
-    // Mock @actions/core info()
-    jest.spyOn(core, 'info').mockImplementation((message: string) => {
-      info.push(message)
-    })
-
-    retryHelper = new RetryHelper(3, 0, 0)
-  })
-
-  beforeEach(() => {
-    // Reset info
-    info = []
-  })
-
-  afterAll(() => {
-    // Restore
-    jest.restoreAllMocks()
-  })
-
-  it('first attempt succeeds', async () => {
-    const actual = await retryHelper.execute(async () => {
-      return 'some result'
-    })
-    expect(actual).toBe('some result')
-    expect(info).toHaveLength(0)
-  })
-
-  it('second attempt succeeds', async () => {
-    let attempts = 0
-    const actual = await retryHelper.execute(() => {
-      if (++attempts == 1) {
-        throw new Error('some error')
-      }
-
-      return Promise.resolve('some result')
-    })
-    expect(attempts).toBe(2)
-    expect(actual).toBe('some result')
-    expect(info).toHaveLength(2)
-    expect(info[0]).toBe('some error')
-    expect(info[1]).toMatch(/Waiting .+ seconds before trying again/)
-  })
-
-  it('third attempt succeeds', async () => {
-    let attempts = 0
-    const actual = await retryHelper.execute(() => {
-      if (++attempts < 3) {
-        throw new Error(`some error ${attempts}`)
-      }
-
-      return Promise.resolve('some result')
-    })
-    expect(attempts).toBe(3)
-    expect(actual).toBe('some result')
-    expect(info).toHaveLength(4)
-    expect(info[0]).toBe('some error 1')
-    expect(info[1]).toMatch(/Waiting .+ seconds before trying again/)
-    expect(info[2]).toBe('some error 2')
-    expect(info[3]).toMatch(/Waiting .+ seconds before trying again/)
-  })
-
-  it('all attempts fail succeeds', async () => {
-    let attempts = 0
-    let error: Error = null as unknown as Error
-    try {
-      await retryHelper.execute(() => {
-        throw new Error(`some error ${++attempts}`)
-      })
-    } catch (err) {
-      error = err as Error
-    }
-    expect(error.message).toBe('some error 3')
-    expect(attempts).toBe(3)
-    expect(info).toHaveLength(4)
-    expect(info[0]).toBe('some error 1')
-    expect(info[1]).toMatch(/Waiting .+ seconds before trying again/)
-    expect(info[2]).toBe('some error 2')
-    expect(info[3]).toMatch(/Waiting .+ seconds before trying again/)
-  })
-})

__test__/unsafe-pr-checkout-helper.test.ts

@@ -1,267 +0,0 @@
-import * as github from '@actions/github'
-import {assertSafePrCheckout} from '../lib/unsafe-pr-checkout-helper'
-
-// Shallow clone original @actions/github context
-const originalContext = {...github.context}
-const originalEventName = github.context.eventName
-const originalPayload = github.context.payload
-
-const BASE_REPO_ID = 100
-const FORK_REPO_ID = 200
-const PR_HEAD_SHA = '1111111111111111111111111111111111111111'
-const PR_MERGE_SHA = '2222222222222222222222222222222222222222'
-const SAFE_BASE_SHA = '3333333333333333333333333333333333333333'
-const WORKFLOW_RUN_HEAD_COMMIT_SHA = '4444444444444444444444444444444444444444'
-const BASE_QUALIFIED_REPO = 'some-owner/some-repo'
-const FORK_QUALIFIED_REPO = 'another-repo/fork'
-
-function setContext(eventName: string, payload: object): void {
-  ;(github.context as {eventName: string}).eventName = eventName
-  ;(github.context as {payload: object}).payload = payload
-}
-
-function forkPullRequestTargetPayload(): object {
-  return {
-    repository: {id: BASE_REPO_ID},
-    pull_request: {
-      head: {
-        sha: PR_HEAD_SHA,
-        repo: {id: FORK_REPO_ID, full_name: FORK_QUALIFIED_REPO}
-      },
-      merge_commit_sha: PR_MERGE_SHA
-    }
-  }
-}
-
-function sameRepoPullRequestTargetPayload(): object {
-  return {
-    repository: {id: BASE_REPO_ID},
-    pull_request: {
-      head: {
-        sha: PR_HEAD_SHA,
-        repo: {id: BASE_REPO_ID, full_name: BASE_QUALIFIED_REPO}
-      },
-      merge_commit_sha: PR_MERGE_SHA
-    }
-  }
-}
-
-function forkWorkflowRunPayload(): object {
-  return {
-    repository: {id: BASE_REPO_ID},
-    workflow_run: {
-      event: 'pull_request',
-      head_commit: {id: WORKFLOW_RUN_HEAD_COMMIT_SHA},
-      head_repository: {id: FORK_REPO_ID, full_name: FORK_QUALIFIED_REPO}
-    }
-  }
-}
-
-describe('unsafe-pr-checkout-helper', () => {
-  beforeAll(() => {
-    jest.spyOn(github.context, 'repo', 'get').mockReturnValue({
-      owner: 'some-owner',
-      repo: 'some-repo'
-    })
-  })
-
-  afterEach(() => {
-    ;(github.context as {eventName: string}).eventName = originalEventName
-    ;(github.context as {payload: object}).payload = originalPayload
-  })
-
-  afterAll(() => {
-    ;(github.context as {eventName: string}).eventName =
-      originalContext.eventName
-    ;(github.context as {payload: object}).payload = originalContext.payload
-    jest.restoreAllMocks()
-  })
-
-  it('allows pull_request events untouched', () => {
-    setContext('pull_request', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: 'attacker/fork',
-        ref: 'refs/pull/1/merge',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).not.toThrow()
-  })
-
-  it('allows pull_request_target default checkout (base branch)', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: 'refs/heads/main',
-        commit: SAFE_BASE_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).not.toThrow()
-  })
-
-  it('allows same-repo pull_request_target checkout of PR head', () => {
-    setContext('pull_request_target', sameRepoPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: PR_HEAD_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).not.toThrow()
-  })
-
-  it('refuses pull_request_target fork PR head SHA checkout', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: PR_HEAD_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow(/Refusing to check out fork pull request code/)
-  })
-
-  it('refuses pull_request_target fork PR merge_commit_sha checkout', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: PR_MERGE_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow(/allow-unsafe-pr-checkout/)
-  })
-
-  it('refuses pull_request_target fork PR ref pattern (head)', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: 'refs/pull/42/head',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('refuses pull_request_target fork PR ref pattern (merge)', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: 'refs/pull/42/merge',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('refuses pull_request_target when repository points at the fork', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: FORK_QUALIFIED_REPO,
-        ref: 'refs/heads/main',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('allows pull_request_target checkout of an unrelated third-party repo', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: 'some-other/unrelated',
-        ref: 'refs/heads/main',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).not.toThrow()
-  })
-
-  it('refuses pull_request_target ignoring repository case differences', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: FORK_QUALIFIED_REPO.toUpperCase(),
-        ref: '',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('refuses pull_request_target ignoring commit SHA case differences', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: PR_HEAD_SHA.toUpperCase(),
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('allows pull_request_target fork PR checkout when opted in', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: 'refs/pull/42/merge',
-        commit: '',
-        allowUnsafePrCheckout: true
-      })
-    ).not.toThrow()
-  })
-
-  it('refuses workflow_run fork PR head_commit.id checkout', () => {
-    setContext('workflow_run', forkWorkflowRunPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: WORKFLOW_RUN_HEAD_COMMIT_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('refuses workflow_run with pull_request_target underlying event', () => {
-    const payload = forkWorkflowRunPayload() as {
-      workflow_run: {event: string}
-    }
-    payload.workflow_run.event = 'pull_request_target'
-    setContext('workflow_run', payload)
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: WORKFLOW_RUN_HEAD_COMMIT_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('allows workflow_run same-repo PR (head_repository.id matches base)', () => {
-    const payload = forkWorkflowRunPayload() as {
-      workflow_run: {head_repository: {id: number}}
-    }
-    payload.workflow_run.head_repository.id = BASE_REPO_ID
-    setContext('workflow_run', payload)
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: WORKFLOW_RUN_HEAD_COMMIT_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).not.toThrow()
-  })
-})

__test__/url-helper.test.ts

@@ -1,92 +0,0 @@
-import * as urlHelper from '../src/url-helper'
-
-describe('getServerUrl tests', () => {
-  it('basics', async () => {
-    // Note that URL::toString will append a trailing / when passed just a domain name ...
-    expect(urlHelper.getServerUrl().toString()).toBe('https://github.com/')
-    expect(urlHelper.getServerUrl(' ').toString()).toBe('https://github.com/')
-    expect(urlHelper.getServerUrl('   ').toString()).toBe('https://github.com/')
-    expect(urlHelper.getServerUrl('http://contoso.com').toString()).toBe(
-      'http://contoso.com/'
-    )
-    expect(urlHelper.getServerUrl('https://contoso.com').toString()).toBe(
-      'https://contoso.com/'
-    )
-    expect(urlHelper.getServerUrl('https://contoso.com/').toString()).toBe(
-      'https://contoso.com/'
-    )
-
-    // ... but can't make that same assumption when passed an URL that includes some deeper path.
-    expect(urlHelper.getServerUrl('https://contoso.com/a/b').toString()).toBe(
-      'https://contoso.com/a/b'
-    )
-  })
-})
-
-describe('isGhes tests', () => {
-  const pristineEnv = process.env
-
-  beforeEach(() => {
-    jest.resetModules()
-    process.env = {...pristineEnv}
-  })
-
-  afterAll(() => {
-    process.env = pristineEnv
-  })
-
-  it('basics', async () => {
-    delete process.env['GITHUB_SERVER_URL']
-    expect(urlHelper.isGhes()).toBeFalsy()
-    expect(urlHelper.isGhes('https://github.com')).toBeFalsy()
-    expect(urlHelper.isGhes('https://contoso.ghe.com')).toBeFalsy()
-    expect(urlHelper.isGhes('https://test.github.localhost')).toBeFalsy()
-    expect(urlHelper.isGhes('https://src.onpremise.fabrikam.com')).toBeTruthy()
-  })
-
-  it('returns false when the GITHUB_SERVER_URL environment variable is not defined', async () => {
-    delete process.env['GITHUB_SERVER_URL']
-    expect(urlHelper.isGhes()).toBeFalsy()
-  })
-
-  it('returns false when the GITHUB_SERVER_URL environment variable is set to github.com', async () => {
-    process.env['GITHUB_SERVER_URL'] = 'https://github.com'
-    expect(urlHelper.isGhes()).toBeFalsy()
-  })
-
-  it('returns false when the GITHUB_SERVER_URL environment variable is set to a GitHub Enterprise Cloud-style URL', async () => {
-    process.env['GITHUB_SERVER_URL'] = 'https://contoso.ghe.com'
-    expect(urlHelper.isGhes()).toBeFalsy()
-  })
-
-  it('returns false when the GITHUB_SERVER_URL environment variable has a .localhost suffix', async () => {
-    process.env['GITHUB_SERVER_URL'] = 'https://mock-github.localhost'
-    expect(urlHelper.isGhes()).toBeFalsy()
-  })
-
-  it('returns true when the GITHUB_SERVER_URL environment variable is set to some other URL', async () => {
-    process.env['GITHUB_SERVER_URL'] = 'https://src.onpremise.fabrikam.com'
-    expect(urlHelper.isGhes()).toBeTruthy()
-  })
-})
-
-describe('getServerApiUrl tests', () => {
-  it('basics', async () => {
-    expect(urlHelper.getServerApiUrl()).toBe('https://api.github.com')
-    expect(urlHelper.getServerApiUrl('https://github.com')).toBe(
-      'https://api.github.com'
-    )
-    expect(urlHelper.getServerApiUrl('https://GitHub.com')).toBe(
-      'https://api.github.com'
-    )
-    expect(urlHelper.getServerApiUrl('https://contoso.ghe.com')).toBe(
-      'https://api.contoso.ghe.com'
-    )
-    expect(urlHelper.getServerApiUrl('https://fabrikam.GHE.COM')).toBe(
-      'https://api.fabrikam.ghe.com'
-    )
-    expect(
-      urlHelper.getServerApiUrl('https://src.onpremise.fabrikam.com')
-    ).toBe('https://src.onpremise.fabrikam.com/api/v3')
-  })
-})

__test__/verify-basic.sh

@@ -1,38 +0,0 @@
-#!/bin/sh
-
-if [ ! -f "./basic/basic-file.txt" ]; then
-    echo "Expected basic file does not exist"
-    exit 1
-fi
-
-if [ "$1" = "--archive" ]; then
-  # Verify no .git folder
-  if [ -d "./basic/.git" ]; then
-    echo "Did not expect ./basic/.git folder to exist"
-    exit 1
-  fi
-else
-  # Verify .git folder
-  if [ ! -d "./basic/.git" ]; then
-    echo "Expected ./basic/.git folder to exist"
-    exit 1
-  fi
-
-  # Verify that sparse-checkout is disabled.
-  SPARSE_CHECKOUT_ENABLED=$(git -C ./basic config --local --get-all core.sparseCheckout)
-  if [ "$SPARSE_CHECKOUT_ENABLED" != "" ]; then
-    echo "Expected sparse-checkout to be disabled (discovered: $SPARSE_CHECKOUT_ENABLED)"
-    exit 1
-  fi
-
-  # Verify git configuration shows worktreeConfig is effectively disabled
-  WORKTREE_CONFIG_ENABLED=$(git -C ./basic config --local --get-all extensions.worktreeConfig)
-  if [[ "$WORKTREE_CONFIG_ENABLED" != "" ]]; then
-    echo "Expected extensions.worktreeConfig (boolean) to be disabled in git config.  This could be an artifact of sparse checkout functionality."
-    exit 1
-  fi
-
-  # Verify auth token
-  cd basic
-  git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
-fi

__test__/verify-clean.sh

@@ -1,13 +0,0 @@
-#!/bin/bash
-
-if [[ "$(git -C ./basic status --porcelain)" != "" ]]; then
-    echo ----------------------------------------
-    echo git status
-    echo ----------------------------------------
-    git status
-    echo ----------------------------------------
-    echo git diff
-    echo ----------------------------------------
-    git diff
-    exit 1
-fi

__test__/verify-fetch-filter.sh

@@ -1,16 +0,0 @@
-#!/bin/bash
-
-# Verify .git folder
-if [ ! -d "./fetch-filter/.git" ]; then
-  echo "Expected ./fetch-filter/.git folder to exist"
-  exit 1
-fi
-
-# Verify .git/config contains partialclonefilter
-
-CLONE_FILTER=$(git -C fetch-filter config --local --get remote.origin.partialclonefilter)
-
-if [ "$CLONE_FILTER" != "blob:none" ]; then
-  echo "Expected ./fetch-filter/.git/config to have 'remote.origin.partialclonefilter' set to 'blob:none'"
-  exit 1
-fi

__test__/verify-lfs.sh

@@ -1,11 +0,0 @@
-#!/bin/bash
-
-if [ ! -f "./lfs/regular-file.txt" ]; then
-    echo "Expected regular file does not exist"
-    exit 1
-fi
-
-if [ ! -f "./lfs/lfs-file.bin" ]; then
-    echo "Expected lfs file does not exist"
-    exit 1
-fi

__test__/verify-no-unstaged-changes.sh

@@ -1,17 +0,0 @@
-#!/bin/bash
-
-if [[ "$(git status --porcelain)" != "" ]]; then
-    echo ----------------------------------------
-    echo git status
-    echo ----------------------------------------
-    git status
-    echo ----------------------------------------
-    echo git diff
-    echo ----------------------------------------
-    git diff
-    echo ----------------------------------------
-    echo Troubleshooting
-    echo ----------------------------------------
-    echo "::error::Unstaged changes detected. Locally try running: git clean -ffdx && npm ci && npm run format && npm run build"
-    exit 1
-fi

__test__/verify-side-by-side.sh

@@ -1,11 +0,0 @@
-#!/bin/bash
-
-if [ ! -f "./side-by-side-1/side-by-side-test-file-1.txt" ]; then
-    echo "Expected file 1 does not exist"
-    exit 1
-fi
-
-if [ ! -f "./side-by-side-2/side-by-side-test-file-2.txt" ]; then
-    echo "Expected file 2 does not exist"
-    exit 1
-fi

__test__/verify-sparse-checkout-non-cone-mode.sh

@@ -1,51 +0,0 @@
-#!/bin/bash
-
-# Verify .git folder
-if [ ! -d "./sparse-checkout-non-cone-mode/.git" ]; then
-  echo "Expected ./sparse-checkout-non-cone-mode/.git folder to exist"
-  exit 1
-fi
-
-# Verify sparse-checkout (non-cone-mode)
-cd sparse-checkout-non-cone-mode
-
-ENABLED=$(git config --local --get-all core.sparseCheckout)
-
-if [ "$?" != "0" ]; then
-    echo "Failed to verify that sparse-checkout is enabled"
-    exit 1
-fi
-
-# Check that sparse-checkout is enabled
-if [ "$ENABLED" != "true" ]; then
-  echo "Expected sparse-checkout to be enabled (is: $ENABLED)"
-  exit 1
-fi
-
-SPARSE_CHECKOUT_FILE=$(git rev-parse --git-path info/sparse-checkout)
-
-if [ "$?" != "0" ]; then
-    echo "Failed to validate sparse-checkout"
-    exit 1
-fi
-
-# Check that sparse-checkout list is not empty
-if [ ! -f "$SPARSE_CHECKOUT_FILE" ]; then
-  echo "Expected sparse-checkout file to exist"
-  exit 1
-fi
-
-# Check that all folders from sparse-checkout exists
-for pattern in $(cat "$SPARSE_CHECKOUT_FILE")
-do
-  if [ ! -d "${pattern#/}" ]; then
-    echo "Expected directory '${pattern#/}' to exist"
-    exit 1
-  fi
-done
-
-# Verify that the root directory is not checked out
-if [ -f README.md ]; then
-  echo "Expected top-level files not to exist"
-  exit 1
-fi

__test__/verify-sparse-checkout.sh

@@ -1,63 +0,0 @@
-#!/bin/bash
-
-# Verify .git folder
-if [ ! -d "./sparse-checkout/.git" ]; then
-  echo "Expected ./sparse-checkout/.git folder to exist"
-  exit 1
-fi
-
-# Verify sparse-checkout
-cd sparse-checkout
-
-SPARSE=$(git sparse-checkout list)
-
-if [ "$?" != "0" ]; then
-    echo "Failed to validate sparse-checkout"
-    exit 1
-fi
-
-# Check that sparse-checkout list is not empty
-if [ -z "$SPARSE" ]; then
-  echo "Expected sparse-checkout list to not be empty"
-  exit 1
-fi
-
-# Check that all folders of the sparse checkout exist
-for pattern in $SPARSE
-do
-  if [ ! -d "$pattern" ]; then
-    echo "Expected directory '$pattern' to exist"
-    exit 1
-  fi
-done
-
-checkSparse () {
-  if [ ! -d "./$1" ]; then
-    echo "Expected directory '$1' to exist"
-    exit 1
-  fi
-
-  for file in $(git ls-tree -r --name-only HEAD $1)
-  do
-    if [ ! -f "$file" ]; then
-      echo "Expected file '$file' to exist"
-      exit 1
-    fi
-  done
-}
-
-# Check that all folders and their children have been checked out
-checkSparse __test__
-checkSparse .github
-checkSparse dist
-
-# Check that only sparse-checkout folders have been checked out
-for pattern in $(git ls-tree --name-only HEAD)
-do
-  if [ -d "$pattern" ]; then
-    if [[ "$pattern" != "__test__" && "$pattern" != ".github" && "$pattern" != "dist" ]]; then
-      echo "Expected directory '$pattern' to not exist"
-      exit 1
-    fi
-  fi
-done

__test__/verify-submodules-false.sh

@@ -1,11 +0,0 @@
-#!/bin/bash
-
-if [ ! -f "./submodules-false/regular-file.txt" ]; then
-    echo "Expected regular file does not exist"
-    exit 1
-fi
-
-if [ -f "./submodules-false/submodule-level-1/submodule-file.txt" ]; then
-    echo "Unexpected submodule file exists"
-    exit 1
-fi

__test__/verify-submodules-recursive.sh

@@ -1,26 +0,0 @@
-#!/bin/bash
-
-if [ ! -f "./submodules-recursive/regular-file.txt" ]; then
-    echo "Expected regular file does not exist"
-    exit 1
-fi
-
-if [ ! -f "./submodules-recursive/submodule-level-1/submodule-file.txt" ]; then
-    echo "Expected submodule file does not exist"
-    exit 1
-fi
-
-if [ ! -f "./submodules-recursive/submodule-level-1/submodule-level-2/nested-submodule-file.txt" ]; then
-    echo "Expected nested submodule file does not exists"
-    exit 1
-fi
-
-echo "Testing persisted credential"
-pushd ./submodules-recursive/submodule-level-1/submodule-level-2
-git config --local --name-only --get-regexp http.+extraheader && git fetch
-if [ "$?" != "0" ]; then
-    echo "Failed to validate persisted credential"
-    popd
-    exit 1
-fi
-popd

__test__/verify-submodules-true.sh

@@ -1,26 +0,0 @@
-#!/bin/bash
-
-if [ ! -f "./submodules-true/regular-file.txt" ]; then
-    echo "Expected regular file does not exist"
-    exit 1
-fi
-
-if [ ! -f "./submodules-true/submodule-level-1/submodule-file.txt" ]; then
-    echo "Expected submodule file does not exist"
-    exit 1
-fi
-
-if [ -f "./submodules-true/submodule-level-1/submodule-level-2/nested-submodule-file.txt" ]; then
-    echo "Unexpected nested submodule file exists"
-    exit 1
-fi
-
-echo "Testing persisted credential"
-pushd ./submodules-true/submodule-level-1
-git config --local --name-only --get-regexp http.+extraheader && git fetch
-if [ "$?" != "0" ]; then
-    echo "Failed to validate persisted credential"
-    popd
-    exit 1
-fi
-popd

action.yml

@@ -98,15 +98,6 @@ inputs:
   github-server-url:
     description: The base URL for the GitHub instance that you are trying to clone from, will use environment defaults to fetch from the same instance that the workflow is running from unless specified. Example URLs are https://github.com or https://my-ghes-server.example.com
     required: false
-  allow-unsafe-pr-checkout:
-    description: >
-      Required to check out fork pull request code from a workflow triggered by
-      `pull_request_target` or `workflow_run`. These workflows run with the
-      base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and
-      runner access; fetching and executing a fork's code in that trusted
-      context commonly leads to "pwn request" vulnerabilities. Set to `true`
-      only after reviewing the risks at https://gh.io/securely-using-pull_request_target.
-    default: false
 outputs:
   ref:
     description: 'The branch, tag or SHA that was checked out'

dist/index.js

@@ -411,50 +411,8 @@ class GitAuthHelper {
     }
     removeToken() {
         return __awaiter(this, void 0, void 0, function* () {
-            // Remove HTTP extra header from local git config and submodule configs
+            // HTTP extra header
             yield this.removeGitConfig(this.tokenConfigKey);
-            //
-            // Cleanup actions/checkout@v6 style credentials
-            //
-            const skipV6Cleanup = process.env['ACTIONS_CHECKOUT_SKIP_V6_CLEANUP'];
-            if (skipV6Cleanup === '1' || (skipV6Cleanup === null || skipV6Cleanup === void 0 ? void 0 : skipV6Cleanup.toLowerCase()) === 'true') {
-                core.debug('Skipping v6 style cleanup due to ACTIONS_CHECKOUT_SKIP_V6_CLEANUP');
-                return;
-            }
-            try {
-                // Collect credentials config paths that need to be removed
-                const credentialsPaths = new Set();
-                // Remove includeIf entries that point to git-credentials-*.config files
-                const mainCredentialsPaths = yield this.removeIncludeIfCredentials();
-                mainCredentialsPaths.forEach(path => credentialsPaths.add(path));
-                // Remove submodule includeIf entries that point to git-credentials-*.config files
-                try {
-                    const submoduleConfigPaths = yield this.git.getSubmoduleConfigPaths(true);
-                    for (const configPath of submoduleConfigPaths) {
-                        const submoduleCredentialsPaths = yield this.removeIncludeIfCredentials(configPath);
-                        submoduleCredentialsPaths.forEach(path => credentialsPaths.add(path));
-                    }
-                }
-                catch (err) {
-                    core.debug(`Unable to get submodule config paths: ${err}`);
-                }
-                // Remove credentials config files
-                for (const credentialsPath of credentialsPaths) {
-                    // Only remove credentials config files if they are under RUNNER_TEMP
-                    const runnerTemp = process.env['RUNNER_TEMP'];
-                    if (runnerTemp && credentialsPath.startsWith(runnerTemp)) {
-                        try {
-                            yield io.rmRF(credentialsPath);
-                        }
-                        catch (err) {
-                            core.debug(`Failed to remove credentials config '${credentialsPath}': ${err}`);
-                        }
-                    }
-                }
-            }
-            catch (err) {
-                core.debug(`Failed to cleanup v6 style credentials: ${err}`);
-            }
         });
     }
     removeGitConfig(configKey_1) {
@@ -472,49 +430,6 @@ class GitAuthHelper {
             `sh -c "git config --local --name-only --get-regexp '${pattern}' && git config --local --unset-all '${configKey}' || :"`, true);
         });
     }
-    /**
-     * Removes includeIf entries that point to git-credentials-*.config files.
-     * This handles cleanup of credentials configured by newer versions of the action.
-     * @param configPath Optional path to a specific git config file to operate on
-     * @returns Array of unique credentials config file paths that were found and removed
-     */
-    removeIncludeIfCredentials(configPath) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const credentialsPaths = new Set();
-            try {
-                // Get all includeIf.gitdir keys
-                const keys = yield this.git.tryGetConfigKeys('^includeIf\\.gitdir:', false, // globalConfig?
-                configPath);
-                for (const key of keys) {
-                    // Get all values for this key
-                    const values = yield this.git.tryGetConfigValues(key, false, // globalConfig?
-                    configPath);
-                    if (values.length > 0) {
-                        // Remove only values that match git-credentials-<uuid>.config pattern
-                        for (const value of values) {
-                            if (this.testCredentialsConfigPath(value)) {
-                                credentialsPaths.add(value);
-                                yield this.git.tryConfigUnsetValue(key, value, false, configPath);
-                            }
-                        }
-                    }
-                }
-            }
-            catch (err) {
-                // Ignore errors - this is cleanup code
-                core.debug(`Error during includeIf cleanup${configPath ? ` for ${configPath}` : ''}: ${err}`);
-            }
-            return Array.from(credentialsPaths);
-        });
-    }
-    /**
-     * Tests if a path matches the git-credentials-*.config pattern used by newer versions.
-     * @param path The path to test
-     * @returns True if the path matches the credentials config pattern
-     */
-    testCredentialsConfigPath(path) {
-        return /git-credentials-[0-9a-f-]+\.config$/i.test(path);
-    }
 }
 
 
@@ -791,16 +706,6 @@ class GitCommandManager {
             throw new Error('Unexpected output when retrieving default branch');
         });
     }
-    getSubmoduleConfigPaths(recursive) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // Get submodule config file paths.
-            // Use `--show-origin` to get the config file path for each submodule.
-            const output = yield this.submoduleForeach(`git config --local --show-origin --name-only --get-regexp remote.origin.url`, recursive);
-            // Extract config file paths from the output (lines starting with "file:").
-            const configPaths = output.match(/(?<=(^|\n)file:)[^\t]+(?=\tremote\.origin\.url)/g) || [];
-            return configPaths;
-        });
-    }
     getWorkingDirectory() {
         return this.workingDirectory;
     }
@@ -931,20 +836,6 @@ class GitCommandManager {
             return output.exitCode === 0;
         });
     }
-    tryConfigUnsetValue(configKey, configValue, globalConfig, configFile) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const args = ['config'];
-            if (configFile) {
-                args.push('--file', configFile);
-            }
-            else {
-                args.push(globalConfig ? '--global' : '--local');
-            }
-            args.push('--unset', configKey, configValue);
-            const output = yield this.execGit(args, true);
-            return output.exitCode === 0;
-        });
-    }
     tryDisableAutomaticGarbageCollection() {
         return __awaiter(this, void 0, void 0, function* () {
             const output = yield this.execGit(['config', '--local', 'gc.auto', '0'], true);
@@ -964,46 +855,6 @@ class GitCommandManager {
             return stdout;
         });
     }
-    tryGetConfigValues(configKey, globalConfig, configFile) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const args = ['config'];
-            if (configFile) {
-                args.push('--file', configFile);
-            }
-            else {
-                args.push(globalConfig ? '--global' : '--local');
-            }
-            args.push('--get-all', configKey);
-            const output = yield this.execGit(args, true);
-            if (output.exitCode !== 0) {
-                return [];
-            }
-            return output.stdout
-                .trim()
-                .split('\n')
-                .filter(value => value.trim());
-        });
-    }
-    tryGetConfigKeys(pattern, globalConfig, configFile) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const args = ['config'];
-            if (configFile) {
-                args.push('--file', configFile);
-            }
-            else {
-                args.push(globalConfig ? '--global' : '--local');
-            }
-            args.push('--name-only', '--get-regexp', pattern);
-            const output = yield this.execGit(args, true);
-            if (output.exitCode !== 0) {
-                return [];
-            }
-            return output.stdout
-                .trim()
-                .split('\n')
-                .filter(key => key.trim());
-        });
-    }
     tryReset() {
         return __awaiter(this, void 0, void 0, function* () {
             const output = yield this.execGit(['reset', '--hard', 'HEAD'], true);
@@ -1859,7 +1710,6 @@ const core = __importStar(__nccwpck_require__(2186));
 const fsHelper = __importStar(__nccwpck_require__(7219));
 const github = __importStar(__nccwpck_require__(5438));
 const path = __importStar(__nccwpck_require__(1017));
-const unsafePrCheckoutHelper = __importStar(__nccwpck_require__(843));
 const workflowContextHelper = __importStar(__nccwpck_require__(9568));
 function getInputs() {
     return __awaiter(this, void 0, void 0, function* () {
@@ -1981,17 +1831,6 @@ function getInputs() {
         // Determine the GitHub URL that the repository is being hosted from
         result.githubServerUrl = core.getInput('github-server-url');
         core.debug(`GitHub Host URL = ${result.githubServerUrl}`);
-        // Allow unsafe PR checkout (opt-in for pull_request_target / workflow_run fork PRs)
-        result.allowUnsafePrCheckout =
-            (core.getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() ===
-                'TRUE';
-        core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`);
-        unsafePrCheckoutHelper.assertSafePrCheckout({
-            qualifiedRepository,
-            ref: result.ref,
-            commit: result.commit,
-            allowUnsafePrCheckout: result.allowUnsafePrCheckout
-        });
         return result;
     });
 }
@@ -2132,7 +1971,6 @@ exports.getRefSpecForAllHistory = getRefSpecForAllHistory;
 exports.getRefSpec = getRefSpec;
 exports.testRef = testRef;
 exports.checkCommitInfo = checkCommitInfo;
-exports.fromPayload = fromPayload;
 const core = __importStar(__nccwpck_require__(2186));
 const github = __importStar(__nccwpck_require__(5438));
 const url_helper_1 = __nccwpck_require__(9437);
@@ -2565,105 +2403,6 @@ if (!exports.IsPost) {
 }
 
 
-/***/ }),
-
-/***/ 843:
-/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
-
-"use strict";
-
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.assertSafePrCheckout = assertSafePrCheckout;
-const github = __importStar(__nccwpck_require__(5438));
-const ref_helper_1 = __nccwpck_require__(8601);
-const PR_REF_PATTERN = /^refs\/pull\/[0-9]+\/(?:head|merge)$/;
-function assertSafePrCheckout(input) {
-    if (input.allowUnsafePrCheckout) {
-        return;
-    }
-    const eventName = github.context.eventName;
-    if (eventName !== 'pull_request_target' && eventName !== 'workflow_run') {
-        return;
-    }
-    const baseRepoId = (0, ref_helper_1.fromPayload)('repository.id');
-    if (typeof baseRepoId !== 'number') {
-        return;
-    }
-    let prHeadRepoId;
-    let prHeadRepoFullName;
-    const prShas = [];
-    if (eventName === 'pull_request_target') {
-        prHeadRepoId = (0, ref_helper_1.fromPayload)('pull_request.head.repo.id');
-        prHeadRepoFullName = (0, ref_helper_1.fromPayload)('pull_request.head.repo.full_name');
-        pushIfSha(prShas, (0, ref_helper_1.fromPayload)('pull_request.head.sha'));
-        pushIfSha(prShas, (0, ref_helper_1.fromPayload)('pull_request.merge_commit_sha'));
-    }
-    else {
-        const wrEvent = (0, ref_helper_1.fromPayload)('workflow_run.event');
-        if (typeof wrEvent !== 'string' || !wrEvent.startsWith('pull_request')) {
-            return;
-        }
-        prHeadRepoId = (0, ref_helper_1.fromPayload)('workflow_run.head_repository.id');
-        prHeadRepoFullName = (0, ref_helper_1.fromPayload)('workflow_run.head_repository.full_name');
-        pushIfSha(prShas, (0, ref_helper_1.fromPayload)('workflow_run.head_commit.id'));
-        // For `pull_request_target`-triggered workflow_run, `head_sha` is the base
-        // default branch SHA (not the PR head)
-        if (wrEvent !== 'pull_request_target') {
-            pushIfSha(prShas, (0, ref_helper_1.fromPayload)('workflow_run.head_sha'));
-        }
-    }
-    // (A) Fork PR?
-    if (typeof prHeadRepoId !== 'number' || prHeadRepoId === baseRepoId) {
-        return;
-    }
-    // (B) We cannot check for all fork PR refs so check to see
-    // if the resolved input points to the fork PR sha we have in the payload
-    const repositoryMatchesPrHead = typeof prHeadRepoFullName === 'string' &&
-        input.qualifiedRepository.toLowerCase() === prHeadRepoFullName.toLowerCase();
-    const refMatchesPullPattern = PR_REF_PATTERN.test(input.ref);
-    const commitMatchesPrHeadSha = !!input.commit && prShas.includes(input.commit.toLowerCase());
-    if (!repositoryMatchesPrHead &&
-        !refMatchesPullPattern &&
-        !commitMatchesPrHeadSha) {
-        return;
-    }
-    throw new Error(`Refusing to check out fork pull request code from a '${eventName}' workflow. ` +
-        `This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch ` +
-        `cache scope, and runner access. Fetching and executing a fork's code in that trusted ` +
-        `context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks ` +
-        `at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' ` +
-        `on the actions/checkout step.`);
-}
-function pushIfSha(target, value) {
-    if (typeof value === 'string' && value.length > 0) {
-        target.push(value.toLowerCase());
-    }
-}
-
-
 /***/ }),
 
 /***/ 9437:

images/test-ubuntu-git.Dockerfile

@@ -1,12 +0,0 @@
-# Defines the test-ubuntu-git Container Image.
-# Consumed by actions/checkout CI/CD validation workflows.
-
-FROM ubuntu:latest
-
-RUN apt update
-RUN apt install -y git
-
-LABEL org.opencontainers.image.title="Ubuntu + git (validation image)"
-LABEL org.opencontainers.image.description="Ubuntu image with git pre-installed. Intended primarily for testing `actions/checkout` during CI/CD workflows."
-LABEL org.opencontainers.image.documentation="https://github.com/actions/checkout/tree/main/images/test-ubuntu-git.md"
-LABEL org.opencontainers.image.licenses=MIT

images/test-ubuntu-git.md

@@ -1,15 +0,0 @@
-# `test-ubuntu-git` Container Image
-
-[![Publish test-ubuntu-git Container](https://github.com/actions/checkout/actions/workflows/update-test-ubuntu-git.yml/badge.svg)](https://github.com/actions/checkout/actions/workflows/update-test-ubuntu-git.yml)
-
-## Purpose
-
-`test-ubuntu-git` is a container image hosted on the GitHub Container Registry, `ghcr.io`.  
-
-It is intended primarily for testing the [`actions/checkout` repository](https://github.com/actions/checkout) as part of `actions/checkout`'s CI/CD workflows.
-
-The composition of `test-ubuntu-git` is intentionally minimal.  It is comprised of [git](https://git-scm.com/) installed on top of a [base-level ubuntu image](https://hub.docker.com/_/ubuntu/tags).
-
-# License
-
-`test-ubuntu-git` is released under the [MIT License](/LICENSE).

src/git-auth-helper.ts

@@ -346,58 +346,8 @@ class GitAuthHelper {
   }
 
   private async removeToken(): Promise<void> {
-    // Remove HTTP extra header from local git config and submodule configs
+    // HTTP extra header
     await this.removeGitConfig(this.tokenConfigKey)
-
-    //
-    // Cleanup actions/checkout@v6 style credentials
-    //
-    const skipV6Cleanup = process.env['ACTIONS_CHECKOUT_SKIP_V6_CLEANUP']
-    if (skipV6Cleanup === '1' || skipV6Cleanup?.toLowerCase() === 'true') {
-      core.debug(
-        'Skipping v6 style cleanup due to ACTIONS_CHECKOUT_SKIP_V6_CLEANUP'
-      )
-      return
-    }
-
-    try {
-      // Collect credentials config paths that need to be removed
-      const credentialsPaths = new Set<string>()
-
-      // Remove includeIf entries that point to git-credentials-*.config files
-      const mainCredentialsPaths = await this.removeIncludeIfCredentials()
-      mainCredentialsPaths.forEach(path => credentialsPaths.add(path))
-
-      // Remove submodule includeIf entries that point to git-credentials-*.config files
-      try {
-        const submoduleConfigPaths =
-          await this.git.getSubmoduleConfigPaths(true)
-        for (const configPath of submoduleConfigPaths) {
-          const submoduleCredentialsPaths =
-            await this.removeIncludeIfCredentials(configPath)
-          submoduleCredentialsPaths.forEach(path => credentialsPaths.add(path))
-        }
-      } catch (err) {
-        core.debug(`Unable to get submodule config paths: ${err}`)
-      }
-
-      // Remove credentials config files
-      for (const credentialsPath of credentialsPaths) {
-        // Only remove credentials config files if they are under RUNNER_TEMP
-        const runnerTemp = process.env['RUNNER_TEMP']
-        if (runnerTemp && credentialsPath.startsWith(runnerTemp)) {
-          try {
-            await io.rmRF(credentialsPath)
-          } catch (err) {
-            core.debug(
-              `Failed to remove credentials config '${credentialsPath}': ${err}`
-            )
-          }
-        }
-      }
-    } catch (err) {
-      core.debug(`Failed to cleanup v6 style credentials: ${err}`)
-    }
   }
 
   private async removeGitConfig(
@@ -421,59 +371,4 @@ class GitAuthHelper {
       true
     )
   }
-
-  /**
-   * Removes includeIf entries that point to git-credentials-*.config files.
-   * This handles cleanup of credentials configured by newer versions of the action.
-   * @param configPath Optional path to a specific git config file to operate on
-   * @returns Array of unique credentials config file paths that were found and removed
-   */
-  private async removeIncludeIfCredentials(
-    configPath?: string
-  ): Promise<string[]> {
-    const credentialsPaths = new Set<string>()
-
-    try {
-      // Get all includeIf.gitdir keys
-      const keys = await this.git.tryGetConfigKeys(
-        '^includeIf\\.gitdir:',
-        false, // globalConfig?
-        configPath
-      )
-
-      for (const key of keys) {
-        // Get all values for this key
-        const values = await this.git.tryGetConfigValues(
-          key,
-          false, // globalConfig?
-          configPath
-        )
-        if (values.length > 0) {
-          // Remove only values that match git-credentials-<uuid>.config pattern
-          for (const value of values) {
-            if (this.testCredentialsConfigPath(value)) {
-              credentialsPaths.add(value)
-              await this.git.tryConfigUnsetValue(key, value, false, configPath)
-            }
-          }
-        }
-      }
-    } catch (err) {
-      // Ignore errors - this is cleanup code
-      core.debug(
-        `Error during includeIf cleanup${configPath ? ` for ${configPath}` : ''}: ${err}`
-      )
-    }
-
-    return Array.from(credentialsPaths)
-  }
-
-  /**
-   * Tests if a path matches the git-credentials-*.config pattern used by newer versions.
-   * @param path The path to test
-   * @returns True if the path matches the credentials config pattern
-   */
-  private testCredentialsConfigPath(path: string): boolean {
-    return /git-credentials-[0-9a-f-]+\.config$/i.test(path)
-  }
 }

src/git-command-manager.ts

@@ -41,7 +41,6 @@ export interface IGitCommandManager {
     }
   ): Promise<void>
   getDefaultBranch(repositoryUrl: string): Promise<string>
-  getSubmoduleConfigPaths(recursive: boolean): Promise<string[]>
   getWorkingDirectory(): string
   init(): Promise<void>
   isDetached(): Promise<boolean>
@@ -60,24 +59,8 @@ export interface IGitCommandManager {
   tagExists(pattern: string): Promise<boolean>
   tryClean(): Promise<boolean>
   tryConfigUnset(configKey: string, globalConfig?: boolean): Promise<boolean>
-  tryConfigUnsetValue(
-    configKey: string,
-    configValue: string,
-    globalConfig?: boolean,
-    configFile?: string
-  ): Promise<boolean>
   tryDisableAutomaticGarbageCollection(): Promise<boolean>
   tryGetFetchUrl(): Promise<string>
-  tryGetConfigValues(
-    configKey: string,
-    globalConfig?: boolean,
-    configFile?: string
-  ): Promise<string[]>
-  tryGetConfigKeys(
-    pattern: string,
-    globalConfig?: boolean,
-    configFile?: string
-  ): Promise<string[]>
   tryReset(): Promise<boolean>
   version(): Promise<GitVersion>
 }
@@ -340,21 +323,6 @@ class GitCommandManager {
     throw new Error('Unexpected output when retrieving default branch')
   }
 
-  async getSubmoduleConfigPaths(recursive: boolean): Promise<string[]> {
-    // Get submodule config file paths.
-    // Use `--show-origin` to get the config file path for each submodule.
-    const output = await this.submoduleForeach(
-      `git config --local --show-origin --name-only --get-regexp remote.origin.url`,
-      recursive
-    )
-
-    // Extract config file paths from the output (lines starting with "file:").
-    const configPaths =
-      output.match(/(?<=(^|\n)file:)[^\t]+(?=\tremote\.origin\.url)/g) || []
-
-    return configPaths
-  }
-
   getWorkingDirectory(): string {
     return this.workingDirectory
   }
@@ -487,24 +455,6 @@ class GitCommandManager {
     return output.exitCode === 0
   }
 
-  async tryConfigUnsetValue(
-    configKey: string,
-    configValue: string,
-    globalConfig?: boolean,
-    configFile?: string
-  ): Promise<boolean> {
-    const args = ['config']
-    if (configFile) {
-      args.push('--file', configFile)
-    } else {
-      args.push(globalConfig ? '--global' : '--local')
-    }
-    args.push('--unset', configKey, configValue)
-
-    const output = await this.execGit(args, true)
-    return output.exitCode === 0
-  }
-
   async tryDisableAutomaticGarbageCollection(): Promise<boolean> {
     const output = await this.execGit(
       ['config', '--local', 'gc.auto', '0'],
@@ -531,56 +481,6 @@ class GitCommandManager {
     return stdout
   }
 
-  async tryGetConfigValues(
-    configKey: string,
-    globalConfig?: boolean,
-    configFile?: string
-  ): Promise<string[]> {
-    const args = ['config']
-    if (configFile) {
-      args.push('--file', configFile)
-    } else {
-      args.push(globalConfig ? '--global' : '--local')
-    }
-    args.push('--get-all', configKey)
-
-    const output = await this.execGit(args, true)
-
-    if (output.exitCode !== 0) {
-      return []
-    }
-
-    return output.stdout
-      .trim()
-      .split('\n')
-      .filter(value => value.trim())
-  }
-
-  async tryGetConfigKeys(
-    pattern: string,
-    globalConfig?: boolean,
-    configFile?: string
-  ): Promise<string[]> {
-    const args = ['config']
-    if (configFile) {
-      args.push('--file', configFile)
-    } else {
-      args.push(globalConfig ? '--global' : '--local')
-    }
-    args.push('--name-only', '--get-regexp', pattern)
-
-    const output = await this.execGit(args, true)
-
-    if (output.exitCode !== 0) {
-      return []
-    }
-
-    return output.stdout
-      .trim()
-      .split('\n')
-      .filter(key => key.trim())
-  }
-
   async tryReset(): Promise<boolean> {
     const output = await this.execGit(['reset', '--hard', 'HEAD'], true)
     return output.exitCode === 0

src/git-source-settings.ts

@@ -118,10 +118,4 @@ export interface IGitSourceSettings {
    * User override on the GitHub Server/Host URL that hosts the repository to be cloned
    */
   githubServerUrl: string | undefined
-
-  /**
-   * Opt-in to allow checking out fork pull request code from a workflow
-   * triggered by pull_request_target or workflow_run.
-   */
-  allowUnsafePrCheckout: boolean
 }

src/input-helper.ts

@@ -2,7 +2,6 @@ import * as core from '@actions/core'
 import * as fsHelper from './fs-helper'
 import * as github from '@actions/github'
 import * as path from 'path'
-import * as unsafePrCheckoutHelper from './unsafe-pr-checkout-helper'
 import * as workflowContextHelper from './workflow-context-helper'
 import {IGitSourceSettings} from './git-source-settings'
 
@@ -162,18 +161,5 @@ export async function getInputs(): Promise<IGitSourceSettings> {
   result.githubServerUrl = core.getInput('github-server-url')
   core.debug(`GitHub Host URL = ${result.githubServerUrl}`)
 
-  // Allow unsafe PR checkout (opt-in for pull_request_target / workflow_run fork PRs)
-  result.allowUnsafePrCheckout =
-    (core.getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() ===
-    'TRUE'
-  core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`)
-
-  unsafePrCheckoutHelper.assertSafePrCheckout({
-    qualifiedRepository,
-    ref: result.ref,
-    commit: result.commit,
-    allowUnsafePrCheckout: result.allowUnsafePrCheckout
-  })
-
   return result
 }

src/ref-helper.ts

@@ -268,7 +268,7 @@ export async function checkCommitInfo(
   }
 }
 
-export function fromPayload(path: string): any {
+function fromPayload(path: string): any {
   return select(github.context.payload, path)
 }
 

src/unsafe-pr-checkout-helper.ts

@@ -1,88 +0,0 @@
-import * as github from '@actions/github'
-import {fromPayload} from './ref-helper'
-
-const PR_REF_PATTERN = /^refs\/pull\/[0-9]+\/(?:head|merge)$/
-
-export interface IUnsafePrCheckoutInput {
-  qualifiedRepository: string
-  ref: string
-  commit: string | undefined
-  allowUnsafePrCheckout: boolean
-}
-
-export function assertSafePrCheckout(input: IUnsafePrCheckoutInput): void {
-  if (input.allowUnsafePrCheckout) {
-    return
-  }
-
-  const eventName = github.context.eventName
-  if (eventName !== 'pull_request_target' && eventName !== 'workflow_run') {
-    return
-  }
-
-  const baseRepoId = fromPayload('repository.id')
-  if (typeof baseRepoId !== 'number') {
-    return
-  }
-
-  let prHeadRepoId: unknown
-  let prHeadRepoFullName: unknown
-  const prShas: string[] = []
-
-  if (eventName === 'pull_request_target') {
-    prHeadRepoId = fromPayload('pull_request.head.repo.id')
-    prHeadRepoFullName = fromPayload('pull_request.head.repo.full_name')
-    pushIfSha(prShas, fromPayload('pull_request.head.sha'))
-    pushIfSha(prShas, fromPayload('pull_request.merge_commit_sha'))
-  } else {
-    const wrEvent = fromPayload('workflow_run.event')
-    if (typeof wrEvent !== 'string' || !wrEvent.startsWith('pull_request')) {
-      return
-    }
-    prHeadRepoId = fromPayload('workflow_run.head_repository.id')
-    prHeadRepoFullName = fromPayload('workflow_run.head_repository.full_name')
-    pushIfSha(prShas, fromPayload('workflow_run.head_commit.id'))
-    // For `pull_request_target`-triggered workflow_run, `head_sha` is the base
-    // default branch SHA (not the PR head)
-    if (wrEvent !== 'pull_request_target') {
-      pushIfSha(prShas, fromPayload('workflow_run.head_sha'))
-    }
-  }
-
-  // (A) Fork PR?
-  if (typeof prHeadRepoId !== 'number' || prHeadRepoId === baseRepoId) {
-    return
-  }
-
-  // (B) We cannot check for all fork PR refs so check to see
-  // if the resolved input points to the fork PR sha we have in the payload
-  const repositoryMatchesPrHead =
-    typeof prHeadRepoFullName === 'string' &&
-    input.qualifiedRepository.toLowerCase() === prHeadRepoFullName.toLowerCase()
-  const refMatchesPullPattern = PR_REF_PATTERN.test(input.ref)
-  const commitMatchesPrHeadSha =
-    !!input.commit && prShas.includes(input.commit.toLowerCase())
-
-  if (
-    !repositoryMatchesPrHead &&
-    !refMatchesPullPattern &&
-    !commitMatchesPrHeadSha
-  ) {
-    return
-  }
-
-  throw new Error(
-    `Refusing to check out fork pull request code from a '${eventName}' workflow. ` +
-      `This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch ` +
-      `cache scope, and runner access. Fetching and executing a fork's code in that trusted ` +
-      `context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks ` +
-      `at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' ` +
-      `on the actions/checkout step.`
-  )
-}
-
-function pushIfSha(target: string[], value: unknown): void {
-  if (typeof value === 'string' && value.length > 0) {
-    target.push(value.toLowerCase())
-  }
-}