backport fixes to releases-v5 (#2523 )

backport allow-unsafe-pr-checkout to v5 (#2501 )
* block checking out fork pr for pull_request_target and workflow_run (#2454) * block checking out fork pr for some events * address copilot and reviewer feedback * run prettier formatting * build * update urls * update readme * update description and url again * edit url one more time * update error wording (#2467)
2026-08-09 19:08:29 +07:00 · 2026-07-16 15:43:40 -04:00 · 2026-07-07 16:34:55 -04:00 · 2025-11-13 15:22:10 -06:00 · 2025-08-11 13:35:28 +01:00 · 2025-08-11 11:52:51 +01:00
105 changed files with 54884 additions and 0 deletions
@@ -0,0 +1,3 @@
 dist/
 lib/
 node_modules/
@@ -0,0 +1,53 @@
 {
  "plugins": ["jest", "@typescript-eslint"],
  "extends": ["plugin:github/recommended"],
  "parser": "@typescript-eslint/parser",
  "parserOptions": {
    "ecmaVersion": 9,
    "sourceType": "module",
    "project": "./tsconfig.json"
  },
  "rules": {
    "eslint-comments/no-use": "off",
    "import/no-namespace": "off",
    "no-unused-vars": "off",
    "@typescript-eslint/no-unused-vars": "error",
    "@typescript-eslint/explicit-member-accessibility": ["error", {"accessibility": "no-public"}],
    "@typescript-eslint/no-require-imports": "error",
    "@typescript-eslint/array-type": "error",
    "@typescript-eslint/await-thenable": "error",
    "camelcase": "off",
    "@typescript-eslint/explicit-function-return-type": ["error", {"allowExpressions": true}],
    "@typescript-eslint/func-call-spacing": ["error", "never"],
    "@typescript-eslint/no-array-constructor": "error",
    "@typescript-eslint/no-empty-interface": "error",
    "@typescript-eslint/no-explicit-any": "error",
    "@typescript-eslint/no-extraneous-class": "error",
    "@typescript-eslint/no-floating-promises": "error",
    "@typescript-eslint/no-for-in-array": "error",
    "@typescript-eslint/no-inferrable-types": "error",
    "@typescript-eslint/no-misused-new": "error",
    "@typescript-eslint/no-namespace": "error",
    "@typescript-eslint/no-non-null-assertion": "warn",
    "@typescript-eslint/no-unnecessary-qualifier": "error",
    "@typescript-eslint/no-unnecessary-type-assertion": "error",
    "@typescript-eslint/no-useless-constructor": "error",
    "@typescript-eslint/no-var-requires": "error",
    "@typescript-eslint/prefer-for-of": "warn",
    "@typescript-eslint/prefer-function-type": "warn",
    "@typescript-eslint/prefer-includes": "error",
    "@typescript-eslint/prefer-string-starts-ends-with": "error",
    "@typescript-eslint/promise-function-async": "error",
    "@typescript-eslint/require-array-sort-compare": "error",
    "@typescript-eslint/restrict-plus-operands": "error",
    "semi": "off",
    "@typescript-eslint/semi": ["error", "never"],
    "@typescript-eslint/type-annotation-spacing": "error",
    "@typescript-eslint/unbound-method": "error"
  },
  "env": {
    "node": true,
    "es6": true,
    "jest/globals": true
  }
 }
@@ -0,0 +1 @@
 .licenses/** -diff linguist-generated=true
@@ -0,0 +1,20 @@
 ---
 version: 2
 updates:
 - package-ecosystem: "npm"
  directory: "/"
  schedule:
    interval: "weekly"
  groups:
    minor-npm-dependencies:
      # NPM: Only group minor and patch updates (we want to carefully review major updates)
      update-types: [minor, patch]
 - package-ecosystem: "github-actions"
  directory: "/"
  schedule:
    interval: "weekly"
  groups:
    minor-actions-dependencies:
      # GitHub Actions: Only group minor and patch updates (we want to carefully review major updates)
      update-types: [minor, patch]
@@ -0,0 +1,51 @@
 # `dist/index.js` is a special file in Actions.
 # When you reference an action with `uses:` in a workflow,
 # `index.js` is the code that will run.
 # For our project, we generate this file through a build process
 # from other source files.
 # We need to make sure the checked-in `index.js` actually matches what we expect it to be.
 name: Check dist
 on:
  push:
    branches:
      - main
    paths-ignore:
      - '**.md'
  pull_request:
    paths-ignore:
      - '**.md'
  workflow_dispatch:
 jobs:
  check-dist:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4.1.6
      - name: Set Node.js 24.x
        uses: actions/setup-node@v4
        with:
          node-version: 24.x
      - name: Install dependencies
        run: npm ci
      - name: Rebuild the index.js file
        run: npm run build
      - name: Compare the expected and actual dist/ directories
        run: |
          if [ "$(git diff --ignore-space-at-eol dist/ | wc -l)" -gt "0" ]; then
            echo "Detected uncommitted changes after build.  See status below:"
            git diff
            exit 1
          fi
      # If dist/ was different than expected, upload the expected version as an artifact
      - uses: actions/upload-artifact@v4
        if: ${{ failure() && steps.diff.conclusion == 'failure' }}
        with:
          name: dist
          path: dist/
@@ -0,0 +1,58 @@
 # For most projects, this workflow file will not need changing; you simply need
 # to commit it to your repository.
 #
 # You may wish to alter this file to override the set of languages analyzed,
 # or to provide custom queries or build logic.
 #
 # ******** NOTE ********
 # We have attempted to detect the languages in your repository. Please check
 # the `language` matrix defined below to confirm you have the correct set of
 # supported CodeQL languages.
 #
 name: "CodeQL"
 on:
  push:
    branches: [ main ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ main ]
  schedule:
    - cron: '28 9 * * 0'
 jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language: [ 'javascript' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
        # Learn more:
        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4.1.6
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main
    - run: npm ci
    - run: npm run build
    - run: rm -rf dist # We want code scanning to analyze lib instead (individual .js files)
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
@@ -0,0 +1,14 @@
 name: Licensed
 on:
  push: {branches: main}
  pull_request: {branches: main}
 jobs:
  test:
    runs-on: ubuntu-latest
    name: Check licenses
    steps:
      - uses: actions/checkout@v4.1.6
      - run: npm ci
      - run: npm run licensed-check
@@ -0,0 +1,20 @@
 name: 'Publish Immutable Action Version'
 on:
  release:
    types: [published]
 jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      packages: write
    steps:
      - name: Checking out
        uses: actions/checkout@v4
      - name: Publish
        id: publish
        uses: actions/publish-immutable-action@0.0.3
@@ -0,0 +1,331 @@
 name: Build and Test
 on:
  pull_request:
  push:
    branches:
      - main
      - releases/*
 # Note that when you see patterns like "ref: test-data/v2/basic" within this workflow,
 # these refer to "test-data" branches on this actions/checkout repo.
 # (For example, test-data/v2/basic -> https://github.com/actions/checkout/tree/test-data/v2/basic)
 jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 24.x
      - uses: actions/checkout@v4.1.6
      - run: npm ci
      - run: npm run build
      - run: npm run format-check
      - run: npm run lint
      - run: npm test
      - name: Verify no unstaged changes
        run: __test__/verify-no-unstaged-changes.sh
  test:
    strategy:
      matrix:
        runs-on: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.runs-on }}
    steps:
      # Clone this repo
      - name: Checkout
        uses: actions/checkout@v4.1.6
      # Basic checkout
      - name: Checkout basic
        uses: ./
        with:
          ref: test-data/v2/basic
          path: basic
      - name: Verify basic
        shell: bash
        run: __test__/verify-basic.sh
      # Clean
      - name: Modify work tree
        shell: bash
        run: __test__/modify-work-tree.sh
      - name: Checkout clean
        uses: ./
        with:
          ref: test-data/v2/basic
          path: basic
      - name: Verify clean
        shell: bash
        run: __test__/verify-clean.sh
      # Side by side
      - name: Checkout side by side 1
        uses: ./
        with:
          ref: test-data/v2/side-by-side-1
          path: side-by-side-1
      - name: Checkout side by side 2
        uses: ./
        with:
          ref: test-data/v2/side-by-side-2
          path: side-by-side-2
      - name: Verify side by side
        shell: bash
        run: __test__/verify-side-by-side.sh
      # Filter
      - name: Fetch filter
        uses: ./
        with:
          filter: 'blob:none'
          path: fetch-filter
      - name: Verify fetch filter
        run: __test__/verify-fetch-filter.sh
      # Sparse checkout
      - name: Sparse checkout
        uses: ./
        with:
          sparse-checkout: |
            __test__
            .github
            dist
          path: sparse-checkout
      - name: Verify sparse checkout
        run: __test__/verify-sparse-checkout.sh
      # Disabled sparse checkout in existing checkout
      - name: Disabled sparse checkout
        uses: ./
        with:
          path: sparse-checkout
      - name: Verify disabled sparse checkout
        shell: bash
        run: set -x && ls -l sparse-checkout/src/git-command-manager.ts
      # Sparse checkout (non-cone mode)
      - name: Sparse checkout (non-cone mode)
        uses: ./
        with:
          sparse-checkout: |
            /__test__/
            /.github/
            /dist/
          sparse-checkout-cone-mode: false
          path: sparse-checkout-non-cone-mode
      - name: Verify sparse checkout (non-cone mode)
        run: __test__/verify-sparse-checkout-non-cone-mode.sh
      # LFS
      - name: Checkout LFS
        uses: ./
        with:
          repository: actions/checkout # hardcoded, otherwise doesn't work from a fork
          ref: test-data/v2/lfs
          path: lfs
          lfs: true
      - name: Verify LFS
        shell: bash
        run: __test__/verify-lfs.sh
      # Submodules false
      - name: Checkout submodules false
        uses: ./
        with:
          ref: test-data/v2/submodule-ssh-url
          path: submodules-false
      - name: Verify submodules false
        run: __test__/verify-submodules-false.sh
      # Submodules one level
      - name: Checkout submodules true
        uses: ./
        with:
          ref: test-data/v2/submodule-ssh-url
          path: submodules-true
          submodules: true
      - name: Verify submodules true
        run: __test__/verify-submodules-true.sh
      # Submodules recursive
      - name: Checkout submodules recursive
        uses: ./
        with:
          ref: test-data/v2/submodule-ssh-url
          path: submodules-recursive
          submodules: recursive
      - name: Verify submodules recursive
        run: __test__/verify-submodules-recursive.sh
      # Basic checkout using REST API
      - name: Remove basic
        if: runner.os != 'windows'
        run: rm -rf basic
      - name: Remove basic (Windows)
        if: runner.os == 'windows'
        shell: cmd
        run: rmdir /s /q basic
      - name: Override git version
        if: runner.os != 'windows'
        run: __test__/override-git-version.sh
      - name: Override git version (Windows)
        if: runner.os == 'windows'
        run: __test__\\override-git-version.cmd
      - name: Checkout basic using REST API
        uses: ./
        with:
          ref: test-data/v2/basic
          path: basic
      - name: Verify basic
        run: __test__/verify-basic.sh --archive
  test-proxy:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/actions/test-ubuntu-git:main.20240221.114913.703z
      options: --dns 127.0.0.1
    services:
      squid-proxy:
        image: ubuntu/squid:latest
        ports:
          - 3128:3128
    env:
      https_proxy: http://squid-proxy:3128
    steps:
      # Clone this repo
      - name: Checkout
        uses: actions/checkout@v4.1.6
      # Basic checkout using git
      - name: Checkout basic
        uses: ./
        with:
          ref: test-data/v2/basic
          path: basic
      - name: Verify basic
        run: __test__/verify-basic.sh
      # Basic checkout using REST API
      - name: Remove basic
        run: rm -rf basic
      - name: Override git version
        run: __test__/override-git-version.sh
      - name: Basic checkout using REST API
        uses: ./
        with:
          ref: test-data/v2/basic
          path: basic
      - name: Verify basic
        run: __test__/verify-basic.sh --archive
  test-bypass-proxy:
    runs-on: ubuntu-latest
    env:
      https_proxy: http://no-such-proxy:3128
      no_proxy: api.github.com,github.com
    steps:
      # Clone this repo
      - name: Checkout
        uses: actions/checkout@v4.1.6
      # Basic checkout using git
      - name: Checkout basic
        uses: ./
        with:
          ref: test-data/v2/basic
          path: basic
      - name: Verify basic
        run: __test__/verify-basic.sh
      - name: Remove basic
        run: rm -rf basic
      # Basic checkout using REST API
      - name: Override git version
        run: __test__/override-git-version.sh
      - name: Checkout basic using REST API
        uses: ./
        with:
          ref: test-data/v2/basic
          path: basic
      - name: Verify basic
        run: __test__/verify-basic.sh --archive
  test-git-container:
    runs-on: ubuntu-latest
    container: bitnami/git:latest
    steps:
      # Clone this repo
      - name: Checkout
        uses: actions/checkout@v4.1.6
        with:
          path: localClone
      # Basic checkout using git
      - name: Checkout basic
        uses: ./localClone
        with:
          ref: test-data/v2/basic
      - name: Verify basic
        run: |
          if [ ! -f "./basic-file.txt" ]; then
              echo "Expected basic file does not exist"
              exit 1
          fi
          # Verify .git folder
          if [ ! -d "./.git" ]; then
            echo "Expected ./.git folder to exist"
            exit 1
          fi
          # Verify auth token
          git config --global --add safe.directory "*"
          git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
      # needed to make checkout post cleanup succeed
      - name: Fix Checkout v4
        uses: actions/checkout@v4.1.6
        with:
          path: localClone
  test-output:
    runs-on: ubuntu-latest
    steps:
      # Clone this repo
      - name: Checkout
        uses: actions/checkout@v4.1.6
      # Basic checkout using git
      - name: Checkout basic
        id: checkout
        uses: ./
        with:
          ref: test-data/v2/basic
      # Verify output
      - name: Verify output
        run: |
          echo "Commit: ${{ steps.checkout.outputs.commit }}"
          echo "Ref: ${{ steps.checkout.outputs.ref }}"
          if [ "${{ steps.checkout.outputs.ref }}" != "test-data/v2/basic" ]; then
            echo "Expected ref to be test-data/v2/basic"
            exit 1
          fi
          if [ "${{ steps.checkout.outputs.commit }}" != "82f71901cf8c021332310dcc8cdba84c4193ff5d" ]; then
            echo "Expected commit to be 82f71901cf8c021332310dcc8cdba84c4193ff5d"
            exit 1
          fi
      # needed to make checkout post cleanup succeed
      - name: Fix Checkout
        uses: actions/checkout@v4.1.6
@@ -0,0 +1,36 @@
 name: Update Main Version
 run-name: Move ${{ github.event.inputs.major_version }} to ${{ github.event.inputs.target }}
 on:
  workflow_dispatch:
    inputs:
      target:
        description: The tag or reference to use
        required: true
      major_version:
        type: choice
        description: The major version to update
        options:
          - v5
          - v4
          - v3
          - v2
 jobs:
  tag:
    runs-on: ubuntu-latest
    steps:
    # Note this update workflow can also be used as a rollback tool.
    # For that reason, it's best to pin `actions/checkout` to a known, stable version
    # (typically, about two releases back).
    - uses: actions/checkout@v4.1.6
      with:
        fetch-depth: 0
    - name: Git config
      run: |
        git config user.name "github-actions[bot]"
        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
    - name: Tag new target
      run: git tag -f ${{ github.event.inputs.major_version }} ${{ github.event.inputs.target }}
    - name: Push new tag
      run: git push origin ${{ github.event.inputs.major_version }} --force
@@ -0,0 +1,59 @@
 name: Publish test-ubuntu-git Container
 on:
  # Use an on demand workflow trigger.  
  # (Forked copies of actions/checkout won't have permission to update GHCR.io/actions, 
  #  so avoid trigger events that run automatically.)
  workflow_dispatch:
    inputs:
      publish:
        description:  'Publish to ghcr.io? (main branch only)'
        type: boolean
        required: true
        default: false
 env:
  REGISTRY: ghcr.io
  IMAGE_NAME: actions/test-ubuntu-git
 jobs:
  build-and-push-image:
    runs-on: ubuntu-latest
    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      # Use `docker/login-action` to log in to GHCR.io. 
      # Once published, the packages are scoped to the account defined here.
      - name: Log in to the ghcr.io container registry
        uses: docker/login-action@v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Format Timestamp
        id: timestamp
        # Use `date` with a custom format to achieve the key=value format GITHUB_OUTPUT expects.
        run: date -u "+now=%Y%m%d.%H%M%S.%3NZ" >> "$GITHUB_OUTPUT"
      - name: Issue Image Publish Warning
        if:  ${{ inputs.publish && github.ref_name != 'main' }}
        run: echo "::warning::test-ubuntu-git images can only be published from the actions/checkout 'main' branch.  Workflow will continue with push/publish disabled."
      # Use `docker/build-push-action` to build (and optionally publish) the image. 
      - name: Build Docker Image (with optional Push)
        uses: docker/build-push-action@v6.5.0
        with:
          context: .
          file: images/test-ubuntu-git.Dockerfile
          # For now, attempts to push to ghcr.io must target the `main` branch.
          # In the future, consider also allowing attempts from `releases/*` branches.
          push: ${{ inputs.publish && github.ref_name == 'main' }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}.${{ steps.timestamp.outputs.now }}
@@ -0,0 +1,5 @@
 __test__/_temp
 _temp/
 lib/
 node_modules/
 .vscode/
@@ -0,0 +1,14 @@
 sources:
  npm: true
 allowed:
  - apache-2.0
  - bsd-2-clause
  - bsd-3-clause
  - isc
  - mit
  - cc0-1.0
  - unlicense
 reviewed:
  npm:
@@ -0,0 +1,20 @@
 ---
 name: "@actions/core"
 version: 1.10.1
 type: npm
 summary: Actions core lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/core
 license: mit
 licenses:
 - sources: LICENSE.md
  text: |-
    The MIT License (MIT)
    Copyright 2019 GitHub
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 notices: []
@@ -0,0 +1,20 @@
 ---
 name: "@actions/exec"
 version: 1.1.1
 type: npm
 summary: Actions exec lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/exec
 license: mit
 licenses:
 - sources: LICENSE.md
  text: |-
    The MIT License (MIT)
    Copyright 2019 GitHub
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 notices: []
@@ -0,0 +1,20 @@
 ---
 name: "@actions/github"
 version: 6.0.0
 type: npm
 summary: Actions github lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/github
 license: mit
 licenses:
 - sources: LICENSE.md
  text: |-
    The MIT License (MIT)
    Copyright 2019 GitHub
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 notices: []
@@ -0,0 +1,32 @@
 ---
 name: "@actions/http-client"
 version: 2.2.1
 type: npm
 summary: Actions Http Client
 homepage: https://github.com/actions/toolkit/tree/main/packages/http-client
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    Actions Http Client for Node.js
    Copyright (c) GitHub, Inc.
    All rights reserved.
    MIT License
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
    associated documentation files (the "Software"), to deal in the Software without restriction,
    including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
    and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,
    subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
    LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
    NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
    WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
    SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 notices: []
@@ -0,0 +1,20 @@
 ---
 name: "@actions/io"
 version: 1.1.3
 type: npm
 summary: Actions io lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/io
 license: mit
 licenses:
 - sources: LICENSE.md
  text: |-
    The MIT License (MIT)
    Copyright 2019 GitHub
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 notices: []
@@ -0,0 +1,20 @@
 ---
 name: "@actions/tool-cache"
 version: 2.0.1
 type: npm
 summary: Actions tool-cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/tool-cache
 license: mit
 licenses:
 - sources: LICENSE.md
  text: |-
    The MIT License (MIT)
    Copyright 2019 GitHub
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 notices: []
@@ -0,0 +1,30 @@
 ---
 name: "@fastify/busboy"
 version: 2.1.1
 type: npm
 summary: A streaming parser for HTML form data for node.js
 homepage: 
 license: mit
 licenses:
 - sources: LICENSE
  text: |-
    Copyright Brian White. All rights reserved.
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to
    deal in the Software without restriction, including without limitation the
    rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
    sell copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in
    all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
    IN THE SOFTWARE.
 notices: []
@@ -0,0 +1,34 @@
 ---
 name: "@octokit/auth-token"
 version: 4.0.0
 type: npm
 summary: GitHub API token authentication for browsers and Node.js
 homepage: 
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    The MIT License
    Copyright (c) 2019 Octokit contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in
    all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
    THE SOFTWARE.
 - sources: README.md
  text: "[MIT](LICENSE)"
 notices: []
@@ -0,0 +1,34 @@
 ---
 name: "@octokit/core"
 version: 5.2.0
 type: npm
 summary: Extendable client for GitHub's REST & GraphQL APIs
 homepage: 
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    The MIT License
    Copyright (c) 2019 Octokit contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in
    all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
    THE SOFTWARE.
 - sources: README.md
  text: "[MIT](LICENSE)"
 notices: []
@@ -0,0 +1,34 @@
 ---
 name: "@octokit/endpoint"
 version: 9.0.6
 type: npm
 summary: Turns REST API endpoints into generic request options
 homepage:
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    The MIT License
    Copyright (c) 2018 Octokit contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in
    all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
    THE SOFTWARE.
 - sources: README.md
  text: "[MIT](LICENSE)"
 notices: []
@@ -0,0 +1,34 @@
 ---
 name: "@octokit/graphql"
 version: 7.1.0
 type: npm
 summary: GitHub GraphQL API client for browsers and Node
 homepage: 
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    The MIT License
    Copyright (c) 2018 Octokit contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in
    all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
    THE SOFTWARE.
 - sources: README.md
  text: "[MIT](LICENSE)"
 notices: []
@@ -0,0 +1,20 @@
 ---
 name: "@octokit/openapi-types"
 version: 20.0.0
 type: npm
 summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
 homepage: 
 license: mit
 licenses:
 - sources: LICENSE
  text: |-
    Copyright 2020 Gregor Martynus
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 - sources: README.md
  text: "[MIT](LICENSE)"
 notices: []
@@ -0,0 +1,20 @@
 ---
 name: "@octokit/openapi-types"
 version: 22.1.0
 type: npm
 summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
 homepage: 
 license: mit
 licenses:
 - sources: LICENSE
  text: |-
    Copyright 2020 Gregor Martynus
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 - sources: README.md
  text: "[MIT](LICENSE)"
 notices: []
@@ -0,0 +1,20 @@
 ---
 name: "@octokit/plugin-paginate-rest"
 version: 9.2.2
 type: npm
 summary: Octokit plugin to paginate REST API endpoint responses
 homepage:
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    MIT License Copyright (c) 2019 Octokit contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 - sources: README.md
  text: "[MIT](LICENSE)"
 notices: []
@@ -0,0 +1,20 @@
 ---
 name: "@octokit/plugin-rest-endpoint-methods"
 version: 10.4.1
 type: npm
 summary: Octokit plugin adding one method for all of api.github.com REST API endpoints
 homepage: 
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    MIT License Copyright (c) 2019 Octokit contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 - sources: README.md
  text: "[MIT](LICENSE)"
 notices: []
@@ -0,0 +1,34 @@
 ---
 name: "@octokit/request-error"
 version: 5.1.1
 type: npm
 summary: Error class for Octokit request errors
 homepage:
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    The MIT License
    Copyright (c) 2019 Octokit contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in
    all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
    THE SOFTWARE.
 - sources: README.md
  text: "[MIT](LICENSE)"
 notices: []
@@ -0,0 +1,35 @@
 ---
 name: "@octokit/request"
 version: 8.4.1
 type: npm
 summary: Send parameterized requests to GitHub's APIs with sensible defaults in browsers
  and Node
 homepage:
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    The MIT License
    Copyright (c) 2018 Octokit contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in
    all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
    THE SOFTWARE.
 - sources: README.md
  text: "[MIT](LICENSE)"
 notices: []
@@ -0,0 +1,20 @@
 ---
 name: "@octokit/types"
 version: 12.6.0
 type: npm
 summary: Shared TypeScript definitions for Octokit projects
 homepage: 
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    MIT License Copyright (c) 2019 Octokit contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 - sources: README.md
  text: "[MIT](LICENSE)"
 notices: []
@@ -0,0 +1,20 @@
 ---
 name: "@octokit/types"
 version: 13.4.1
 type: npm
 summary: Shared TypeScript definitions for Octokit projects
 homepage: 
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    MIT License Copyright (c) 2019 Octokit contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 - sources: README.md
  text: "[MIT](LICENSE)"
 notices: []
@@ -0,0 +1,214 @@
 ---
 name: before-after-hook
 version: 2.2.3
 type: npm
 summary: asynchronous before/error/after hooks for internal functionality
 homepage: 
 license: apache-2.0
 licenses:
 - sources: LICENSE
  text: |2
                                     Apache License
                               Version 2.0, January 2004
                            http://www.apache.org/licenses/
       TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
       1. Definitions.
          "License" shall mean the terms and conditions for use, reproduction,
          and distribution as defined by Sections 1 through 9 of this document.
          "Licensor" shall mean the copyright owner or entity authorized by
          the copyright owner that is granting the License.
          "Legal Entity" shall mean the union of the acting entity and all
          other entities that control, are controlled by, or are under common
          control with that entity. For the purposes of this definition,
          "control" means (i) the power, direct or indirect, to cause the
          direction or management of such entity, whether by contract or
          otherwise, or (ii) ownership of fifty percent (50%) or more of the
          outstanding shares, or (iii) beneficial ownership of such entity.
          "You" (or "Your") shall mean an individual or Legal Entity
          exercising permissions granted by this License.
          "Source" form shall mean the preferred form for making modifications,
          including but not limited to software source code, documentation
          source, and configuration files.
          "Object" form shall mean any form resulting from mechanical
          transformation or translation of a Source form, including but
          not limited to compiled object code, generated documentation,
          and conversions to other media types.
          "Work" shall mean the work of authorship, whether in Source or
          Object form, made available under the License, as indicated by a
          copyright notice that is included in or attached to the work
          (an example is provided in the Appendix below).
          "Derivative Works" shall mean any work, whether in Source or Object
          form, that is based on (or derived from) the Work and for which the
          editorial revisions, annotations, elaborations, or other modifications
          represent, as a whole, an original work of authorship. For the purposes
          of this License, Derivative Works shall not include works that remain
          separable from, or merely link (or bind by name) to the interfaces of,
          the Work and Derivative Works thereof.
          "Contribution" shall mean any work of authorship, including
          the original version of the Work and any modifications or additions
          to that Work or Derivative Works thereof, that is intentionally
          submitted to Licensor for inclusion in the Work by the copyright owner
          or by an individual or Legal Entity authorized to submit on behalf of
          the copyright owner. For the purposes of this definition, "submitted"
          means any form of electronic, verbal, or written communication sent
          to the Licensor or its representatives, including but not limited to
          communication on electronic mailing lists, source code control systems,
          and issue tracking systems that are managed by, or on behalf of, the
          Licensor for the purpose of discussing and improving the Work, but
          excluding communication that is conspicuously marked or otherwise
          designated in writing by the copyright owner as "Not a Contribution."
          "Contributor" shall mean Licensor and any individual or Legal Entity
          on behalf of whom a Contribution has been received by Licensor and
          subsequently incorporated within the Work.
       2. Grant of Copyright License. Subject to the terms and conditions of
          this License, each Contributor hereby grants to You a perpetual,
          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
          copyright license to reproduce, prepare Derivative Works of,
          publicly display, publicly perform, sublicense, and distribute the
          Work and such Derivative Works in Source or Object form.
       3. Grant of Patent License. Subject to the terms and conditions of
          this License, each Contributor hereby grants to You a perpetual,
          worldwide, non-exclusive, no-charge, royalty-free, irrevocable
          (except as stated in this section) patent license to make, have made,
          use, offer to sell, sell, import, and otherwise transfer the Work,
          where such license applies only to those patent claims licensable
          by such Contributor that are necessarily infringed by their
          Contribution(s) alone or by combination of their Contribution(s)
          with the Work to which such Contribution(s) was submitted. If You
          institute patent litigation against any entity (including a
          cross-claim or counterclaim in a lawsuit) alleging that the Work
          or a Contribution incorporated within the Work constitutes direct
          or contributory patent infringement, then any patent licenses
          granted to You under this License for that Work shall terminate
          as of the date such litigation is filed.
       4. Redistribution. You may reproduce and distribute copies of the
          Work or Derivative Works thereof in any medium, with or without
          modifications, and in Source or Object form, provided that You
          meet the following conditions:
          (a) You must give any other recipients of the Work or
              Derivative Works a copy of this License; and
          (b) You must cause any modified files to carry prominent notices
              stating that You changed the files; and
          (c) You must retain, in the Source form of any Derivative Works
              that You distribute, all copyright, patent, trademark, and
              attribution notices from the Source form of the Work,
              excluding those notices that do not pertain to any part of
              the Derivative Works; and
          (d) If the Work includes a "NOTICE" text file as part of its
              distribution, then any Derivative Works that You distribute must
              include a readable copy of the attribution notices contained
              within such NOTICE file, excluding those notices that do not
              pertain to any part of the Derivative Works, in at least one
              of the following places: within a NOTICE text file distributed
              as part of the Derivative Works; within the Source form or
              documentation, if provided along with the Derivative Works; or,
              within a display generated by the Derivative Works, if and
              wherever such third-party notices normally appear. The contents
              of the NOTICE file are for informational purposes only and
              do not modify the License. You may add Your own attribution
              notices within Derivative Works that You distribute, alongside
              or as an addendum to the NOTICE text from the Work, provided
              that such additional attribution notices cannot be construed
              as modifying the License.
          You may add Your own copyright statement to Your modifications and
          may provide additional or different license terms and conditions
          for use, reproduction, or distribution of Your modifications, or
          for any such Derivative Works as a whole, provided Your use,
          reproduction, and distribution of the Work otherwise complies with
          the conditions stated in this License.
       5. Submission of Contributions. Unless You explicitly state otherwise,
          any Contribution intentionally submitted for inclusion in the Work
          by You to the Licensor shall be under the terms and conditions of
          this License, without any additional terms or conditions.
          Notwithstanding the above, nothing herein shall supersede or modify
          the terms of any separate license agreement you may have executed
          with Licensor regarding such Contributions.
       6. Trademarks. This License does not grant permission to use the trade
          names, trademarks, service marks, or product names of the Licensor,
          except as required for reasonable and customary use in describing the
          origin of the Work and reproducing the content of the NOTICE file.
       7. Disclaimer of Warranty. Unless required by applicable law or
          agreed to in writing, Licensor provides the Work (and each
          Contributor provides its Contributions) on an "AS IS" BASIS,
          WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
          implied, including, without limitation, any warranties or conditions
          of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
          PARTICULAR PURPOSE. You are solely responsible for determining the
          appropriateness of using or redistributing the Work and assume any
          risks associated with Your exercise of permissions under this License.
       8. Limitation of Liability. In no event and under no legal theory,
          whether in tort (including negligence), contract, or otherwise,
          unless required by applicable law (such as deliberate and grossly
          negligent acts) or agreed to in writing, shall any Contributor be
          liable to You for damages, including any direct, indirect, special,
          incidental, or consequential damages of any character arising as a
          result of this License or out of the use or inability to use the
          Work (including but not limited to damages for loss of goodwill,
          work stoppage, computer failure or malfunction, or any and all
          other commercial damages or losses), even if such Contributor
          has been advised of the possibility of such damages.
       9. Accepting Warranty or Additional Liability. While redistributing
          the Work or Derivative Works thereof, You may choose to offer,
          and charge a fee for, acceptance of support, warranty, indemnity,
          or other liability obligations and/or rights consistent with this
          License. However, in accepting such obligations, You may act only
          on Your own behalf and on Your sole responsibility, not on behalf
          of any other Contributor, and only if You agree to indemnify,
          defend, and hold each Contributor harmless for any liability
          incurred by, or claims asserted against, such Contributor by reason
          of your accepting any such warranty or additional liability.
       END OF TERMS AND CONDITIONS
       APPENDIX: How to apply the Apache License to your work.
          To apply the Apache License to your work, attach the following
          boilerplate notice, with the fields enclosed by brackets "{}"
          replaced with your own identifying information. (Don't include
          the brackets!)  The text should be enclosed in the appropriate
          comment syntax for the file format. We also recommend that a
          file or class name and description of purpose be included on the
          same "printed page" as the copyright notice for easier
          identification within third-party archives.
       Copyright 2018 Gregor Martynus and other contributors.
       Licensed under the Apache License, Version 2.0 (the "License");
       you may not use this file except in compliance with the License.
       You may obtain a copy of the License at
           http://www.apache.org/licenses/LICENSE-2.0
       Unless required by applicable law or agreed to in writing, software
       distributed under the License is distributed on an "AS IS" BASIS,
       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
       See the License for the specific language governing permissions and
       limitations under the License.
 - sources: README.md
  text: "[Apache 2.0](LICENSE)"
 notices: []
@@ -0,0 +1,28 @@
 ---
 name: deprecation
 version: 2.3.1
 type: npm
 summary: Log a deprecation message with stack
 homepage: https://github.com/gr2m/deprecation#readme
 license: isc
 licenses:
 - sources: LICENSE
  text: |
    The ISC License
    Copyright (c) Gregor Martynus and contributors
    Permission to use, copy, modify, and/or distribute this software for any
    purpose with or without fee is hereby granted, provided that the above
    copyright notice and this permission notice appear in all copies.
    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 - sources: README.md
  text: "[ISC](LICENSE)"
 notices: []
@@ -0,0 +1,26 @@
 ---
 name: once
 version: 1.4.0
 type: npm
 summary: Run a function exactly one time
 homepage: https://github.com/isaacs/once#readme
 license: isc
 licenses:
 - sources: LICENSE
  text: |
    The ISC License
    Copyright (c) Isaac Z. Schlueter and Contributors
    Permission to use, copy, modify, and/or distribute this software for any
    purpose with or without fee is hereby granted, provided that the above
    copyright notice and this permission notice appear in all copies.
    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 notices: []
@@ -0,0 +1,26 @@
 ---
 name: semver
 version: 6.3.1
 type: npm
 summary: The semantic version parser used by npm.
 homepage: 
 license: isc
 licenses:
 - sources: LICENSE
  text: |
    The ISC License
    Copyright (c) Isaac Z. Schlueter and Contributors
    Permission to use, copy, modify, and/or distribute this software for any
    purpose with or without fee is hereby granted, provided that the above
    copyright notice and this permission notice appear in all copies.
    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 notices: []
@@ -0,0 +1,35 @@
 ---
 name: tunnel
 version: 0.0.6
 type: npm
 summary: Node HTTP/HTTPS Agents for tunneling proxies
 homepage: https://github.com/koichik/node-tunnel/
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    The MIT License (MIT)
    Copyright (c) 2012 Koichi Kobayashi
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in
    all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
    THE SOFTWARE.
 - sources: README.md
  text: Licensed under the [MIT](https://github.com/koichik/node-tunnel/blob/master/LICENSE)
    license.
 notices: []
@@ -0,0 +1,34 @@
 ---
 name: undici
 version: 5.29.0
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org
 license: mit
 licenses:
 - sources: LICENSE
  text: |
    MIT License
    Copyright (c) Matteo Collina and Undici contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE.
 - sources: README.md
  text: MIT
 notices: []
@@ -0,0 +1,20 @@
 ---
 name: universal-user-agent
 version: 6.0.1
 type: npm
 summary: Get a user agent string in both browser and node
 homepage: 
 license: isc
 licenses:
 - sources: LICENSE.md
  text: |
    # [ISC License](https://spdx.org/licenses/ISC)
    Copyright (c) 2018, Gregor Martynus (https://github.com/gr2m)
    Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 - sources: README.md
  text: "[ISC](LICENSE.md)"
 notices: []
@@ -0,0 +1,39 @@
 ---
 name: uuid
 version: 3.4.0
 type: npm
 summary: RFC4122 (v1, v4, and v5) UUIDs
 homepage: 
 license: mit
 licenses:
 - sources: LICENSE.md
  text: |
    The MIT License (MIT)
    Copyright (c) 2010-2016 Robert Kieffer and other contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE.
 notices:
 - sources: AUTHORS
  text: |-
    Robert Kieffer <robert@broofa.com>
    Christoph Tavan <dev@tavan.de>
    AJ ONeal <coolaj86@gmail.com>
    Vincent Voyer <vincent@zeroload.net>
    Roman Shtylman <shtylman@gmail.com>
@@ -0,0 +1,20 @@
 ---
 name: uuid
 version: 8.3.2
 type: npm
 summary: RFC4122 (v1, v4, and v5) UUIDs
 homepage: https://github.com/uuidjs/uuid#readme
 license: mit
 licenses:
 - sources: LICENSE.md
  text: |
    The MIT License (MIT)
    Copyright (c) 2010-2020 Robert Kieffer and other contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 notices: []
@@ -0,0 +1,20 @@
 ---
 name: uuid
 version: 9.0.1
 type: npm
 summary: RFC4122 (v1, v4, and v5) UUIDs
 homepage: 
 license: mit
 licenses:
 - sources: LICENSE.md
  text: |
    The MIT License (MIT)
    Copyright (c) 2010-2020 Robert Kieffer and other contributors
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 notices: []
@@ -0,0 +1,26 @@
 ---
 name: wrappy
 version: 1.0.2
 type: npm
 summary: Callback wrapping utility
 homepage: https://github.com/npm/wrappy
 license: isc
 licenses:
 - sources: LICENSE
  text: |
    The ISC License
    Copyright (c) Isaac Z. Schlueter and Contributors
    Permission to use, copy, modify, and/or distribute this software for any
    purpose with or without fee is hereby granted, provided that the above
    copyright notice and this permission notice appear in all copies.
    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 notices: []
@@ -0,0 +1,3 @@
 dist/
 lib/
 node_modules/
@@ -0,0 +1,11 @@
 {
  "printWidth": 80,
  "tabWidth": 2,
  "useTabs": false,
  "semi": false,
  "singleQuote": true,
  "trailingComma": "none",
  "bracketSpacing": false,
  "arrowParens": "avoid",
  "parser": "typescript"
 }
@@ -0,0 +1,174 @@
 # Changelog
 ## V5.0.0
 * Update actions checkout to use node 24 by @salmanmkc in https://github.com/actions/checkout/pull/2226
 ## V4.3.0
 * docs: update README.md by @motss in https://github.com/actions/checkout/pull/1971
 * Add internal repos for checking out multiple repositories by @mouismail in https://github.com/actions/checkout/pull/1977
 * Documentation update - add recommended permissions to Readme by @benwells in https://github.com/actions/checkout/pull/2043
 * Adjust positioning of user email note and permissions heading by @joshmgross in https://github.com/actions/checkout/pull/2044
 * Update README.md by @nebuk89 in https://github.com/actions/checkout/pull/2194
 * Update CODEOWNERS for actions by @TingluoHuang in https://github.com/actions/checkout/pull/2224
 * Update package dependencies by @salmanmkc in https://github.com/actions/checkout/pull/2236
 ## v4.2.2
 * `url-helper.ts` now leverages well-known environment variables by @jww3 in https://github.com/actions/checkout/pull/1941
 * Expand unit test coverage for `isGhes` by @jww3 in https://github.com/actions/checkout/pull/1946
 ## v4.2.1
 * Check out other refs/* by commit if provided, fall back to ref by @orhantoy in https://github.com/actions/checkout/pull/1924
 ## v4.2.0
 * Add Ref and Commit outputs by @lucacome in https://github.com/actions/checkout/pull/1180
 * Dependency updates by @dependabot- https://github.com/actions/checkout/pull/1777, https://github.com/actions/checkout/pull/1872
 ## v4.1.7
 * Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in https://github.com/actions/checkout/pull/1739
 * Bump actions/checkout from 3 to 4 by @dependabot in https://github.com/actions/checkout/pull/1697
 * Check out other refs/* by commit by @orhantoy in https://github.com/actions/checkout/pull/1774
 * Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in https://github.com/actions/checkout/pull/1776
 ## v4.1.6
 * Check platform to set archive extension appropriately by @cory-miller in https://github.com/actions/checkout/pull/1732
 ## v4.1.5
 * Update NPM dependencies by @cory-miller in https://github.com/actions/checkout/pull/1703
 * Bump github/codeql-action from 2 to 3 by @dependabot in https://github.com/actions/checkout/pull/1694
 * Bump actions/setup-node from 1 to 4 by @dependabot in https://github.com/actions/checkout/pull/1696
 * Bump actions/upload-artifact from 2 to 4 by @dependabot in https://github.com/actions/checkout/pull/1695
 * README: Suggest `user.email` to be `41898282+github-actions[bot]@users.noreply.github.com` by @cory-miller in https://github.com/actions/checkout/pull/1707
 ## v4.1.4
 - Disable `extensions.worktreeConfig` when disabling `sparse-checkout` by @jww3 in https://github.com/actions/checkout/pull/1692
 - Add dependabot config by @cory-miller in https://github.com/actions/checkout/pull/1688
 - Bump the minor-actions-dependencies group with 2 updates by @dependabot in https://github.com/actions/checkout/pull/1693
 - Bump word-wrap from 1.2.3 to 1.2.5 by @dependabot in https://github.com/actions/checkout/pull/1643
 ## v4.1.3
 - Check git version before attempting to disable `sparse-checkout` by @jww3 in https://github.com/actions/checkout/pull/1656
 - Add SSH user parameter by @cory-miller in https://github.com/actions/checkout/pull/1685
 - Update `actions/checkout` version in `update-main-version.yml` by @jww3 in https://github.com/actions/checkout/pull/1650
 ## v4.1.2
 - Fix: Disable sparse checkout whenever `sparse-checkout` option is not present @dscho in https://github.com/actions/checkout/pull/1598
 ## v4.1.1
 - Correct link to GitHub Docs by @peterbe in https://github.com/actions/checkout/pull/1511
 - Link to release page from what's new section by @cory-miller in https://github.com/actions/checkout/pull/1514
 ## v4.1.0
 - [Add support for partial checkout filters](https://github.com/actions/checkout/pull/1396)
 ## v4.0.0
 - [Support fetching without the --progress option](https://github.com/actions/checkout/pull/1067)
 - [Update to node20](https://github.com/actions/checkout/pull/1436)
 ## v3.6.0
 - [Fix: Mark test scripts with Bash'isms to be run via Bash](https://github.com/actions/checkout/pull/1377)
 - [Add option to fetch tags even if fetch-depth > 0](https://github.com/actions/checkout/pull/579)
 ## v3.5.3
 - [Fix: Checkout fail in self-hosted runners when faulty submodule are checked-in](https://github.com/actions/checkout/pull/1196)
 - [Fix typos found by codespell](https://github.com/actions/checkout/pull/1287)
 - [Add support for sparse checkouts](https://github.com/actions/checkout/pull/1369)
 ## v3.5.2
 - [Fix api endpoint for GHES](https://github.com/actions/checkout/pull/1289)
 ## v3.5.1
 - [Fix slow checkout on Windows](https://github.com/actions/checkout/pull/1246)
 ## v3.5.0
 * [Add new public key for known_hosts](https://github.com/actions/checkout/pull/1237)
 ## v3.4.0
 - [Upgrade codeql actions to v2](https://github.com/actions/checkout/pull/1209)
 - [Upgrade dependencies](https://github.com/actions/checkout/pull/1210)
 - [Upgrade @actions/io](https://github.com/actions/checkout/pull/1225)
 ## v3.3.0
 - [Implement branch list using callbacks from exec function](https://github.com/actions/checkout/pull/1045)
 - [Add in explicit reference to private checkout options](https://github.com/actions/checkout/pull/1050)
 - [Fix comment typos (that got added in #770)](https://github.com/actions/checkout/pull/1057)
 ## v3.2.0
 - [Add GitHub Action to perform release](https://github.com/actions/checkout/pull/942)
 - [Fix status badge](https://github.com/actions/checkout/pull/967)
 - [Replace datadog/squid with ubuntu/squid Docker image](https://github.com/actions/checkout/pull/1002)
 - [Wrap pipeline commands for submoduleForeach in quotes](https://github.com/actions/checkout/pull/964)
 - [Update @actions/io to 1.1.2](https://github.com/actions/checkout/pull/1029)
 - [Upgrading version to 3.2.0](https://github.com/actions/checkout/pull/1039)
 ## v3.1.0
 - [Use @actions/core `saveState` and `getState`](https://github.com/actions/checkout/pull/939)
 - [Add `github-server-url` input](https://github.com/actions/checkout/pull/922)
 ## v3.0.2
 - [Add input `set-safe-directory`](https://github.com/actions/checkout/pull/770)
 ## v3.0.1
 - [Fixed an issue where checkout failed to run in container jobs due to the new git setting `safe.directory`](https://github.com/actions/checkout/pull/762)
 - [Bumped various npm package versions](https://github.com/actions/checkout/pull/744)
 ## v3.0.0
 - [Update to node 16](https://github.com/actions/checkout/pull/689)
 ## v2.3.1
 - [Fix default branch resolution for .wiki and when using SSH](https://github.com/actions/checkout/pull/284)
 ## v2.3.0
 - [Fallback to the default branch](https://github.com/actions/checkout/pull/278)
 ## v2.2.0
 - [Fetch all history for all tags and branches when fetch-depth=0](https://github.com/actions/checkout/pull/258)
 ## v2.1.1
 - Changes to support GHES ([here](https://github.com/actions/checkout/pull/236) and [here](https://github.com/actions/checkout/pull/248))
 ## v2.1.0
 - [Group output](https://github.com/actions/checkout/pull/191)
 - [Changes to support GHES alpha release](https://github.com/actions/checkout/pull/199)
 - [Persist core.sshCommand for submodules](https://github.com/actions/checkout/pull/184)
 - [Add support ssh](https://github.com/actions/checkout/pull/163)
 - [Convert submodule SSH URL to HTTPS, when not using SSH](https://github.com/actions/checkout/pull/179)
 - [Add submodule support](https://github.com/actions/checkout/pull/157)
 - [Follow proxy settings](https://github.com/actions/checkout/pull/144)
 - [Fix ref for pr closed event when a pr is merged](https://github.com/actions/checkout/pull/141)
 - [Fix issue checking detached when git less than 2.22](https://github.com/actions/checkout/pull/128)
 ## v2.0.0
 - [Do not pass cred on command line](https://github.com/actions/checkout/pull/108)
 - [Add input persist-credentials](https://github.com/actions/checkout/pull/107)
 - [Fallback to REST API to download repo](https://github.com/actions/checkout/pull/104)
 ## v2 (beta)
 - Improved fetch performance
  - The default behavior now fetches only the SHA being checked-out
 - Script authenticated git commands
  - Persists `with.token` in the local git config
  - Enables your scripts to run authenticated git commands
  - Post-job cleanup removes the token
  - Coming soon: Opt out by setting `with.persist-credentials` to `false`
 - Creates a local branch
  - No longer detached HEAD when checking out a branch
  - A local branch is created with the corresponding upstream branch set
 - Improved layout
  - `with.path` is always relative to `github.workspace`
  - Aligns better with container actions, where `github.workspace` gets mapped in
 - Removed input `submodules`
 ## v1
 Refer [here](https://github.com/actions/checkout/blob/v1/CHANGELOG.md) for the V1 changelog
@@ -0,0 +1 @@
 * @actions/actions-runtime
@@ -0,0 +1,28 @@
 # Contributing
 ## Submitting a pull request
 1. Fork and clone the repository
 1. Configure and install the dependencies: `npm install`
 1. Create a new branch: `git checkout -b my-branch-name`
 1. Make your change, add tests, and make sure the tests still pass: `npm run test`
 1. Make sure your code is correctly formatted: `npm run format`
 1. Update `dist/index.js` using `npm run build`. This creates a single javascript file that is used as an entrypoint for the action
 1. Push to your fork and submit a pull request
 1. Pat yourself on the back and wait for your pull request to be reviewed and merged
 Here are a few things you can do that will increase the likelihood of your pull request being accepted:
 - Write tests.
 - Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate pull requests.
 ## Resources
 - [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)
 - [Using Pull Requests](https://help.github.com/articles/about-pull-requests/)
 - [GitHub Help](https://help.github.com)
 - [Writing good commit messages](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html)
 Thanks! :heart: :heart: :heart:
 GitHub Actions Team :octocat:
@@ -0,0 +1,22 @@
 The MIT License (MIT)
 Copyright (c) 2018 GitHub, Inc. and contributors
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
@@ -0,0 +1,367 @@
 [![Build and Test](https://github.com/actions/checkout/actions/workflows/test.yml/badge.svg)](https://github.com/actions/checkout/actions/workflows/test.yml)
 # Checkout V5
 Checkout v5 now supports Node.js 24
 # Checkout V4
 This action checks-out your repository under `$GITHUB_WORKSPACE`, so your workflow can access it.
 Only a single commit is fetched by default, for the ref/SHA that triggered the workflow. Set `fetch-depth: 0` to fetch all history for all branches and tags. Refer [here](https://docs.github.com/actions/using-workflows/events-that-trigger-workflows) to learn which commit `$GITHUB_SHA` points to for different events.
 The auth token is persisted in the local git config. This enables your scripts to run authenticated git commands. The token is removed during post-job cleanup. Set `persist-credentials: false` to opt-out.
 When Git 2.18 or higher is not in your PATH, falls back to the REST API to download the files.
 ### Note
 Thank you for your interest in this GitHub action, however, right now we are not taking contributions. 
 We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time. The GitHub public roadmap is the best place to follow along for any updates on features we’re working on and what stage they’re in.
 We are taking the following steps to better direct requests related to GitHub Actions, including:
 1. We will be directing questions and support requests to our [Community Discussions area](https://github.com/orgs/community/discussions/categories/actions)
 2. High Priority bugs can be reported through Community Discussions or you can report these to our support team https://support.github.com/contact/bug-report.
 3. Security Issues should be handled as per our [security.md](security.md)
 We will still provide security updates for this project and fix major breaking changes during this time.
 You are welcome to still raise bugs in this repo.
 # What's new
 Please refer to the [release page](https://github.com/actions/checkout/releases/latest) for the latest release notes.
 # Usage
 <!-- start usage -->
 ```yaml
 - uses: actions/checkout@v5
  with:
    # Repository name with owner. For example, actions/checkout
    # Default: ${{ github.repository }}
    repository: ''
    # The branch, tag or SHA to checkout. When checking out the repository that
    # triggered a workflow, this defaults to the reference or SHA for that event.
    # Otherwise, uses the default branch.
    ref: ''
    # Personal access token (PAT) used to fetch the repository. The PAT is configured
    # with the local git config, which enables your scripts to run authenticated git
    # commands. The post-job step removes the PAT.
    #
    # We recommend using a service account with the least permissions necessary. Also
    # when generating a new PAT, select the least scopes necessary.
    #
    # [Learn more about creating and using encrypted secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)
    #
    # Default: ${{ github.token }}
    token: ''
    # SSH key used to fetch the repository. The SSH key is configured with the local
    # git config, which enables your scripts to run authenticated git commands. The
    # post-job step removes the SSH key.
    #
    # We recommend using a service account with the least permissions necessary.
    #
    # [Learn more about creating and using encrypted secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)
    ssh-key: ''
    # Known hosts in addition to the user and global host key database. The public SSH
    # keys for a host may be obtained using the utility `ssh-keyscan`. For example,
    # `ssh-keyscan github.com`. The public key for github.com is always implicitly
    # added.
    ssh-known-hosts: ''
    # Whether to perform strict host key checking. When true, adds the options
    # `StrictHostKeyChecking=yes` and `CheckHostIP=no` to the SSH command line. Use
    # the input `ssh-known-hosts` to configure additional hosts.
    # Default: true
    ssh-strict: ''
    # The user to use when connecting to the remote SSH host. By default 'git' is
    # used.
    # Default: git
    ssh-user: ''
    # Whether to configure the token or SSH key with the local git config
    # Default: true
    persist-credentials: ''
    # Relative path under $GITHUB_WORKSPACE to place the repository
    path: ''
    # Whether to execute `git clean -ffdx && git reset --hard HEAD` before fetching
    # Default: true
    clean: ''
    # Partially clone against a given filter. Overrides sparse-checkout if set.
    # Default: null
    filter: ''
    # Do a sparse checkout on given patterns. Each pattern should be separated with
    # new lines.
    # Default: null
    sparse-checkout: ''
    # Specifies whether to use cone-mode when doing a sparse checkout.
    # Default: true
    sparse-checkout-cone-mode: ''
    # Number of commits to fetch. 0 indicates all history for all branches and tags.
    # Default: 1
    fetch-depth: ''
    # Whether to fetch tags, even if fetch-depth > 0.
    # Default: false
    fetch-tags: ''
    # Whether to show progress status output when fetching.
    # Default: true
    show-progress: ''
    # Whether to download Git-LFS files
    # Default: false
    lfs: ''
    # Whether to checkout submodules: `true` to checkout submodules or `recursive` to
    # recursively checkout submodules.
    #
    # When the `ssh-key` input is not provided, SSH URLs beginning with
    # `git@github.com:` are converted to HTTPS.
    #
    # Default: false
    submodules: ''
    # Add repository path as safe.directory for Git global config by running `git
    # config --global --add safe.directory <path>`
    # Default: true
    set-safe-directory: ''
    # The base URL for the GitHub instance that you are trying to clone from, will use
    # environment defaults to fetch from the same instance that the workflow is
    # running from unless specified. Example URLs are https://github.com or
    # https://my-ghes-server.example.com
    github-server-url: ''
    # Required to check out fork pull request code from a workflow triggered by
    # `pull_request_target` or `workflow_run`. These workflows run with the base
    # repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner
    # access; fetching and executing a fork's code in that trusted context commonly
    # leads to "pwn request" vulnerabilities. Set to `true` only after reviewing the
    # risks at https://gh.io/securely-using-pull_request_target.
    # Default: false
    allow-unsafe-pr-checkout: ''
 ```
 <!-- end usage -->
 # Scenarios
 - [Checkout V5](#checkout-v5)
 - [Checkout V4](#checkout-v4)
    - [Note](#note)
 - [What's new](#whats-new)
 - [Usage](#usage)
 - [Scenarios](#scenarios)
  - [Fetch only the root files](#fetch-only-the-root-files)
  - [Fetch only the root files and `.github` and `src` folder](#fetch-only-the-root-files-and-github-and-src-folder)
  - [Fetch only a single file](#fetch-only-a-single-file)
  - [Fetch all history for all tags and branches](#fetch-all-history-for-all-tags-and-branches)
  - [Checkout a different branch](#checkout-a-different-branch)
  - [Checkout HEAD^](#checkout-head)
  - [Checkout multiple repos (side by side)](#checkout-multiple-repos-side-by-side)
  - [Checkout multiple repos (nested)](#checkout-multiple-repos-nested)
  - [Checkout multiple repos (private)](#checkout-multiple-repos-private)
  - [Checkout pull request HEAD commit instead of merge commit](#checkout-pull-request-head-commit-instead-of-merge-commit)
  - [Checkout pull request on closed event](#checkout-pull-request-on-closed-event)
  - [Push a commit using the built-in token](#push-a-commit-using-the-built-in-token)
  - [Push a commit to a PR using the built-in token](#push-a-commit-to-a-pr-using-the-built-in-token)
 - [Recommended permissions](#recommended-permissions)
 - [License](#license)
 ## Fetch only the root files
 ```yaml
 - uses: actions/checkout@v5
  with:
    sparse-checkout: .
 ```
 ## Fetch only the root files and `.github` and `src` folder
 ```yaml
 - uses: actions/checkout@v5
  with:
    sparse-checkout: |
      .github
      src
 ```
 ## Fetch only a single file
 ```yaml
 - uses: actions/checkout@v5
  with:
    sparse-checkout: |
      README.md
    sparse-checkout-cone-mode: false
 ```
 ## Fetch all history for all tags and branches
 ```yaml
 - uses: actions/checkout@v5
  with:
    fetch-depth: 0
 ```
 ## Checkout a different branch
 ```yaml
 - uses: actions/checkout@v5
  with:
    ref: my-branch
 ```
 ## Checkout HEAD^
 ```yaml
 - uses: actions/checkout@v5
  with:
    fetch-depth: 2
 - run: git checkout HEAD^
 ```
 ## Checkout multiple repos (side by side)
 ```yaml
 - name: Checkout
  uses: actions/checkout@v5
  with:
    path: main
 - name: Checkout tools repo
  uses: actions/checkout@v5
  with:
    repository: my-org/my-tools
    path: my-tools
 ```
 > - If your secondary repository is private or internal you will need to add the option noted in [Checkout multiple repos (private)](#Checkout-multiple-repos-private)
 ## Checkout multiple repos (nested)
 ```yaml
 - name: Checkout
  uses: actions/checkout@v5
 - name: Checkout tools repo
  uses: actions/checkout@v5
  with:
    repository: my-org/my-tools
    path: my-tools
 ```
 > - If your secondary repository is private or internal you will need to add the option noted in [Checkout multiple repos (private)](#Checkout-multiple-repos-private)
 ## Checkout multiple repos (private)
 ```yaml
 - name: Checkout
  uses: actions/checkout@v5
  with:
    path: main
 - name: Checkout private tools
  uses: actions/checkout@v5
  with:
    repository: my-org/my-private-tools
    token: ${{ secrets.GH_PAT }} # `GH_PAT` is a secret that contains your PAT
    path: my-tools
 ```
 > - `${{ github.token }}` is scoped to the current repository, so if you want to checkout a different repository that is private you will need to provide your own [PAT](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line).
 ## Checkout pull request HEAD commit instead of merge commit
 ```yaml
 - uses: actions/checkout@v5
  with:
    ref: ${{ github.event.pull_request.head.sha }}
 ```
 ## Checkout pull request on closed event
 ```yaml
 on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, closed]
 jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
 ```
 ## Push a commit using the built-in token
 ```yaml
 on: push
 jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - run: |
          date > generated.txt
          # Note: the following account information will not work on GHES
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add .
          git commit -m "generated"
          git push
 ```
 *NOTE:* The user email is `{user.id}+{user.login}@users.noreply.github.com`. See users API: https://api.github.com/users/github-actions%5Bbot%5D
 ## Push a commit to a PR using the built-in token
 In a pull request trigger, `ref` is required as GitHub Actions checks out in detached HEAD mode, meaning it doesn’t check out your branch by default.
 ```yaml
 on: pull_request
 jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.head_ref }}
      - run: |
          date > generated.txt
          # Note: the following account information will not work on GHES
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add .
          git commit -m "generated"
          git push
 ```
 *NOTE:* The user email is `{user.id}+{user.login}@users.noreply.github.com`. See users API: https://api.github.com/users/github-actions%5Bbot%5D
 # Recommended permissions
 When using the `checkout` action in your GitHub Actions workflow, it is recommended to set the following `GITHUB_TOKEN` permissions to ensure proper functionality, unless alternative auth is provided via the `token` or `ssh-key` inputs:
 ```yaml
 permissions:
  contents: read
 ```
 # License
 The scripts and documentation in this project are released under the [MIT License](LICENSE)
@@ -0,0 +1,378 @@
 import * as exec from '@actions/exec'
 import * as fshelper from '../lib/fs-helper'
 import * as commandManager from '../lib/git-command-manager'
 let git: commandManager.IGitCommandManager
 let mockExec = jest.fn()
 describe('git-auth-helper tests', () => {
  beforeAll(async () => {})
  beforeEach(async () => {
    jest.spyOn(fshelper, 'fileExistsSync').mockImplementation(jest.fn())
    jest.spyOn(fshelper, 'directoryExistsSync').mockImplementation(jest.fn())
  })
  afterEach(() => {
    jest.restoreAllMocks()
  })
  afterAll(() => {})
  it('branch list matches', async () => {
    mockExec.mockImplementation((path, args, options) => {
      console.log(args, options.listeners.stdout)
      if (args.includes('version')) {
        options.listeners.stdout(Buffer.from('2.18'))
        return 0
      }
      if (args.includes('rev-parse')) {
        options.listeners.stdline(Buffer.from('refs/heads/foo'))
        options.listeners.stdline(Buffer.from('refs/heads/bar'))
        return 0
      }
      return 1
    })
    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
    const workingDirectory = 'test'
    const lfs = false
    const doSparseCheckout = false
    git = await commandManager.createCommandManager(
      workingDirectory,
      lfs,
      doSparseCheckout
    )
    let branches = await git.branchList(false)
    expect(branches).toHaveLength(2)
    expect(branches.sort()).toEqual(['foo', 'bar'].sort())
  })
  it('ambiguous ref name output is captured', async () => {
    mockExec.mockImplementation((path, args, options) => {
      console.log(args, options.listeners.stdout)
      if (args.includes('version')) {
        options.listeners.stdout(Buffer.from('2.18'))
        return 0
      }
      if (args.includes('rev-parse')) {
        options.listeners.stdline(Buffer.from('refs/heads/foo'))
        // If refs/tags/v1 and refs/heads/tags/v1 existed on this repository
        options.listeners.errline(
          Buffer.from("error: refname 'tags/v1' is ambiguous")
        )
        return 0
      }
      return 1
    })
    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
    const workingDirectory = 'test'
    const lfs = false
    const doSparseCheckout = false
    git = await commandManager.createCommandManager(
      workingDirectory,
      lfs,
      doSparseCheckout
    )
    let branches = await git.branchList(false)
    expect(branches).toHaveLength(1)
    expect(branches.sort()).toEqual(['foo'].sort())
  })
 })
 describe('Test fetchDepth and fetchTags options', () => {
  beforeEach(async () => {
    jest.spyOn(fshelper, 'fileExistsSync').mockImplementation(jest.fn())
    jest.spyOn(fshelper, 'directoryExistsSync').mockImplementation(jest.fn())
    mockExec.mockImplementation((path, args, options) => {
      console.log(args, options.listeners.stdout)
      if (args.includes('version')) {
        options.listeners.stdout(Buffer.from('2.18'))
      }
      return 0
    })
  })
  afterEach(() => {
    jest.restoreAllMocks()
  })
  it('should call execGit with the correct arguments when fetchDepth is 0 and fetchTags is true', async () => {
    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
    const workingDirectory = 'test'
    const lfs = false
    const doSparseCheckout = false
    git = await commandManager.createCommandManager(
      workingDirectory,
      lfs,
      doSparseCheckout
    )
    const refSpec = ['refspec1', 'refspec2']
    const options = {
      filter: 'filterValue',
      fetchDepth: 0,
      fetchTags: true
    }
    await git.fetch(refSpec, options)
    expect(mockExec).toHaveBeenCalledWith(
      expect.any(String),
      [
        '-c',
        'protocol.version=2',
        'fetch',
        '--prune',
        '--no-recurse-submodules',
        '--filter=filterValue',
        'origin',
        'refspec1',
        'refspec2'
      ],
      expect.any(Object)
    )
  })
  it('should call execGit with the correct arguments when fetchDepth is 0 and fetchTags is false', async () => {
    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
    const workingDirectory = 'test'
    const lfs = false
    const doSparseCheckout = false
    git = await commandManager.createCommandManager(
      workingDirectory,
      lfs,
      doSparseCheckout
    )
    const refSpec = ['refspec1', 'refspec2']
    const options = {
      filter: 'filterValue',
      fetchDepth: 0,
      fetchTags: false
    }
    await git.fetch(refSpec, options)
    expect(mockExec).toHaveBeenCalledWith(
      expect.any(String),
      [
        '-c',
        'protocol.version=2',
        'fetch',
        '--no-tags',
        '--prune',
        '--no-recurse-submodules',
        '--filter=filterValue',
        'origin',
        'refspec1',
        'refspec2'
      ],
      expect.any(Object)
    )
  })
  it('should call execGit with the correct arguments when fetchDepth is 1 and fetchTags is false', async () => {
    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
    const workingDirectory = 'test'
    const lfs = false
    const doSparseCheckout = false
    git = await commandManager.createCommandManager(
      workingDirectory,
      lfs,
      doSparseCheckout
    )
    const refSpec = ['refspec1', 'refspec2']
    const options = {
      filter: 'filterValue',
      fetchDepth: 1,
      fetchTags: false
    }
    await git.fetch(refSpec, options)
    expect(mockExec).toHaveBeenCalledWith(
      expect.any(String),
      [
        '-c',
        'protocol.version=2',
        'fetch',
        '--no-tags',
        '--prune',
        '--no-recurse-submodules',
        '--filter=filterValue',
        '--depth=1',
        'origin',
        'refspec1',
        'refspec2'
      ],
      expect.any(Object)
    )
  })
  it('should call execGit with the correct arguments when fetchDepth is 1 and fetchTags is true', async () => {
    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
    const workingDirectory = 'test'
    const lfs = false
    const doSparseCheckout = false
    git = await commandManager.createCommandManager(
      workingDirectory,
      lfs,
      doSparseCheckout
    )
    const refSpec = ['refspec1', 'refspec2']
    const options = {
      filter: 'filterValue',
      fetchDepth: 1,
      fetchTags: true
    }
    await git.fetch(refSpec, options)
    expect(mockExec).toHaveBeenCalledWith(
      expect.any(String),
      [
        '-c',
        'protocol.version=2',
        'fetch',
        '--prune',
        '--no-recurse-submodules',
        '--filter=filterValue',
        '--depth=1',
        'origin',
        'refspec1',
        'refspec2'
      ],
      expect.any(Object)
    )
  })
  it('should call execGit with the correct arguments when showProgress is true', async () => {
    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
    const workingDirectory = 'test'
    const lfs = false
    const doSparseCheckout = false
    git = await commandManager.createCommandManager(
      workingDirectory,
      lfs,
      doSparseCheckout
    )
    const refSpec = ['refspec1', 'refspec2']
    const options = {
      filter: 'filterValue',
      showProgress: true
    }
    await git.fetch(refSpec, options)
    expect(mockExec).toHaveBeenCalledWith(
      expect.any(String),
      [
        '-c',
        'protocol.version=2',
        'fetch',
        '--no-tags',
        '--prune',
        '--no-recurse-submodules',
        '--progress',
        '--filter=filterValue',
        'origin',
        'refspec1',
        'refspec2'
      ],
      expect.any(Object)
    )
  })
  it('should call execGit with the correct arguments when fetchDepth is 42 and showProgress is true', async () => {
    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
    const workingDirectory = 'test'
    const lfs = false
    const doSparseCheckout = false
    git = await commandManager.createCommandManager(
      workingDirectory,
      lfs,
      doSparseCheckout
    )
    const refSpec = ['refspec1', 'refspec2']
    const options = {
      filter: 'filterValue',
      fetchDepth: 42,
      showProgress: true
    }
    await git.fetch(refSpec, options)
    expect(mockExec).toHaveBeenCalledWith(
      expect.any(String),
      [
        '-c',
        'protocol.version=2',
        'fetch',
        '--no-tags',
        '--prune',
        '--no-recurse-submodules',
        '--progress',
        '--filter=filterValue',
        '--depth=42',
        'origin',
        'refspec1',
        'refspec2'
      ],
      expect.any(Object)
    )
  })
  it('should call execGit with the correct arguments when fetchTags is true and showProgress is true', async () => {
    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
    const workingDirectory = 'test'
    const lfs = false
    const doSparseCheckout = false
    git = await commandManager.createCommandManager(
      workingDirectory,
      lfs,
      doSparseCheckout
    )
    const refSpec = ['refspec1', 'refspec2']
    const options = {
      filter: 'filterValue',
      fetchTags: true,
      showProgress: true
    }
    await git.fetch(refSpec, options)
    expect(mockExec).toHaveBeenCalledWith(
      expect.any(String),
      [
        '-c',
        'protocol.version=2',
        'fetch',
        '--prune',
        '--no-recurse-submodules',
        '--progress',
        '--filter=filterValue',
        'origin',
        'refspec1',
        'refspec2'
      ],
      expect.any(Object)
    )
  })
 })
@@ -0,0 +1,519 @@
 import * as core from '@actions/core'
 import * as fs from 'fs'
 import * as gitDirectoryHelper from '../lib/git-directory-helper'
 import * as io from '@actions/io'
 import * as path from 'path'
 import {IGitCommandManager} from '../lib/git-command-manager'
 const testWorkspace = path.join(__dirname, '_temp', 'git-directory-helper')
 let repositoryPath: string
 let repositoryUrl: string
 let clean: boolean
 let ref: string
 let git: IGitCommandManager
 describe('git-directory-helper tests', () => {
  beforeAll(async () => {
    // Clear test workspace
    await io.rmRF(testWorkspace)
  })
  beforeEach(() => {
    // Mock error/warning/info/debug
    jest.spyOn(core, 'error').mockImplementation(jest.fn())
    jest.spyOn(core, 'warning').mockImplementation(jest.fn())
    jest.spyOn(core, 'info').mockImplementation(jest.fn())
    jest.spyOn(core, 'debug').mockImplementation(jest.fn())
  })
  afterEach(() => {
    // Unregister mocks
    jest.restoreAllMocks()
  })
  const cleansWhenCleanTrue = 'cleans when clean true'
  it(cleansWhenCleanTrue, async () => {
    // Arrange
    await setup(cleansWhenCleanTrue)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files.sort()).toEqual(['.git', 'my-file'])
    expect(git.tryClean).toHaveBeenCalled()
    expect(git.tryReset).toHaveBeenCalled()
    expect(core.warning).not.toHaveBeenCalled()
  })
  const checkoutDetachWhenNotDetached = 'checkout detach when not detached'
  it(checkoutDetachWhenNotDetached, async () => {
    // Arrange
    await setup(checkoutDetachWhenNotDetached)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files.sort()).toEqual(['.git', 'my-file'])
    expect(git.checkoutDetach).toHaveBeenCalled()
  })
  const doesNotCheckoutDetachWhenNotAlreadyDetached =
    'does not checkout detach when already detached'
  it(doesNotCheckoutDetachWhenNotAlreadyDetached, async () => {
    // Arrange
    await setup(doesNotCheckoutDetachWhenNotAlreadyDetached)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    const mockIsDetached = git.isDetached as jest.Mock<any, any>
    mockIsDetached.mockImplementation(async () => {
      return true
    })
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files.sort()).toEqual(['.git', 'my-file'])
    expect(git.checkoutDetach).not.toHaveBeenCalled()
  })
  const doesNotCleanWhenCleanFalse = 'does not clean when clean false'
  it(doesNotCleanWhenCleanFalse, async () => {
    // Arrange
    await setup(doesNotCleanWhenCleanFalse)
    clean = false
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files.sort()).toEqual(['.git', 'my-file'])
    expect(git.isDetached).toHaveBeenCalled()
    expect(git.branchList).toHaveBeenCalled()
    expect(core.warning).not.toHaveBeenCalled()
    expect(git.tryClean).not.toHaveBeenCalled()
    expect(git.tryReset).not.toHaveBeenCalled()
  })
  const removesContentsWhenCleanFails = 'removes contents when clean fails'
  it(removesContentsWhenCleanFails, async () => {
    // Arrange
    await setup(removesContentsWhenCleanFails)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    let mockTryClean = git.tryClean as jest.Mock<any, any>
    mockTryClean.mockImplementation(async () => {
      return false
    })
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files).toHaveLength(0)
    expect(git.tryClean).toHaveBeenCalled()
    expect(core.warning).toHaveBeenCalled()
    expect(git.tryReset).not.toHaveBeenCalled()
  })
  const removesContentsWhenDifferentRepositoryUrl =
    'removes contents when different repository url'
  it(removesContentsWhenDifferentRepositoryUrl, async () => {
    // Arrange
    await setup(removesContentsWhenDifferentRepositoryUrl)
    clean = false
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    const differentRepositoryUrl =
      'https://github.com/my-different-org/my-different-repo'
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      differentRepositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files).toHaveLength(0)
    expect(core.warning).not.toHaveBeenCalled()
    expect(git.isDetached).not.toHaveBeenCalled()
  })
  const removesContentsWhenNoGitDirectory =
    'removes contents when no git directory'
  it(removesContentsWhenNoGitDirectory, async () => {
    // Arrange
    await setup(removesContentsWhenNoGitDirectory)
    clean = false
    await io.rmRF(path.join(repositoryPath, '.git'))
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files).toHaveLength(0)
    expect(core.warning).not.toHaveBeenCalled()
    expect(git.isDetached).not.toHaveBeenCalled()
  })
  const removesContentsWhenResetFails = 'removes contents when reset fails'
  it(removesContentsWhenResetFails, async () => {
    // Arrange
    await setup(removesContentsWhenResetFails)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    let mockTryReset = git.tryReset as jest.Mock<any, any>
    mockTryReset.mockImplementation(async () => {
      return false
    })
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files).toHaveLength(0)
    expect(git.tryClean).toHaveBeenCalled()
    expect(git.tryReset).toHaveBeenCalled()
    expect(core.warning).toHaveBeenCalled()
  })
  const removesContentsWhenUndefinedGitCommandManager =
    'removes contents when undefined git command manager'
  it(removesContentsWhenUndefinedGitCommandManager, async () => {
    // Arrange
    await setup(removesContentsWhenUndefinedGitCommandManager)
    clean = false
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      undefined,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files).toHaveLength(0)
    expect(core.warning).not.toHaveBeenCalled()
  })
  const removesLocalBranches = 'removes local branches'
  it(removesLocalBranches, async () => {
    // Arrange
    await setup(removesLocalBranches)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    const mockBranchList = git.branchList as jest.Mock<any, any>
    mockBranchList.mockImplementation(async (remote: boolean) => {
      return remote ? [] : ['local-branch-1', 'local-branch-2']
    })
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files.sort()).toEqual(['.git', 'my-file'])
    expect(git.branchDelete).toHaveBeenCalledWith(false, 'local-branch-1')
    expect(git.branchDelete).toHaveBeenCalledWith(false, 'local-branch-2')
  })
  const cleanWhenSubmoduleStatusIsFalse =
    'cleans when submodule status is false'
  it(cleanWhenSubmoduleStatusIsFalse, async () => {
    // Arrange
    await setup(cleanWhenSubmoduleStatusIsFalse)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    //mock bad submodule
    const submoduleStatus = git.submoduleStatus as jest.Mock<any, any>
    submoduleStatus.mockImplementation(async (remote: boolean) => {
      return false
    })
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files).toHaveLength(0)
    expect(git.tryClean).toHaveBeenCalled()
  })
  const doesNotCleanWhenSubmoduleStatusIsTrue =
    'does not clean when submodule status is true'
  it(doesNotCleanWhenSubmoduleStatusIsTrue, async () => {
    // Arrange
    await setup(doesNotCleanWhenSubmoduleStatusIsTrue)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    const submoduleStatus = git.submoduleStatus as jest.Mock<any, any>
    submoduleStatus.mockImplementation(async (remote: boolean) => {
      return true
    })
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files.sort()).toEqual(['.git', 'my-file'])
    expect(git.tryClean).toHaveBeenCalled()
  })
  const removesLockFiles = 'removes lock files'
  it(removesLockFiles, async () => {
    // Arrange
    await setup(removesLockFiles)
    clean = false
    await fs.promises.writeFile(
      path.join(repositoryPath, '.git', 'index.lock'),
      ''
    )
    await fs.promises.writeFile(
      path.join(repositoryPath, '.git', 'shallow.lock'),
      ''
    )
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    let files = await fs.promises.readdir(path.join(repositoryPath, '.git'))
    expect(files).toHaveLength(0)
    files = await fs.promises.readdir(repositoryPath)
    expect(files.sort()).toEqual(['.git', 'my-file'])
    expect(git.isDetached).toHaveBeenCalled()
    expect(git.branchList).toHaveBeenCalled()
    expect(core.warning).not.toHaveBeenCalled()
    expect(git.tryClean).not.toHaveBeenCalled()
    expect(git.tryReset).not.toHaveBeenCalled()
  })
  const removesAncestorRemoteBranch = 'removes ancestor remote branch'
  it(removesAncestorRemoteBranch, async () => {
    // Arrange
    await setup(removesAncestorRemoteBranch)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    const mockBranchList = git.branchList as jest.Mock<any, any>
    mockBranchList.mockImplementation(async (remote: boolean) => {
      return remote ? ['origin/remote-branch-1', 'origin/remote-branch-2'] : []
    })
    ref = 'remote-branch-1/conflict'
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files.sort()).toEqual(['.git', 'my-file'])
    expect(git.branchDelete).toHaveBeenCalledTimes(1)
    expect(git.branchDelete).toHaveBeenCalledWith(
      true,
      'origin/remote-branch-1'
    )
  })
  const removesDescendantRemoteBranches = 'removes descendant remote branch'
  it(removesDescendantRemoteBranches, async () => {
    // Arrange
    await setup(removesDescendantRemoteBranches)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
    const mockBranchList = git.branchList as jest.Mock<any, any>
    mockBranchList.mockImplementation(async (remote: boolean) => {
      return remote
        ? ['origin/remote-branch-1/conflict', 'origin/remote-branch-2']
        : []
    })
    ref = 'remote-branch-1'
    // Act
    await gitDirectoryHelper.prepareExistingDirectory(
      git,
      repositoryPath,
      repositoryUrl,
      clean,
      ref
    )
    // Assert
    const files = await fs.promises.readdir(repositoryPath)
    expect(files.sort()).toEqual(['.git', 'my-file'])
    expect(git.branchDelete).toHaveBeenCalledTimes(1)
    expect(git.branchDelete).toHaveBeenCalledWith(
      true,
      'origin/remote-branch-1/conflict'
    )
  })
 })
 async function setup(testName: string): Promise<void> {
  testName = testName.replace(/[^a-zA-Z0-9_]+/g, '-')
  // Repository directory
  repositoryPath = path.join(testWorkspace, testName)
  await fs.promises.mkdir(path.join(repositoryPath, '.git'), {recursive: true})
  // Repository URL
  repositoryUrl = 'https://github.com/my-org/my-repo'
  // Clean
  clean = true
  // Ref
  ref = ''
  // Git command manager
  git = {
    branchDelete: jest.fn(),
    branchExists: jest.fn(),
    branchList: jest.fn(async () => {
      return []
    }),
    disableSparseCheckout: jest.fn(),
    sparseCheckout: jest.fn(),
    sparseCheckoutNonConeMode: jest.fn(),
    checkout: jest.fn(),
    checkoutDetach: jest.fn(),
    config: jest.fn(),
    configExists: jest.fn(),
    fetch: jest.fn(),
    getDefaultBranch: jest.fn(),
    getWorkingDirectory: jest.fn(() => repositoryPath),
    init: jest.fn(),
    isDetached: jest.fn(),
    lfsFetch: jest.fn(),
    lfsInstall: jest.fn(),
    log1: jest.fn(),
    remoteAdd: jest.fn(),
    removeEnvironmentVariable: jest.fn(),
    revParse: jest.fn(),
    setEnvironmentVariable: jest.fn(),
    shaExists: jest.fn(),
    submoduleForeach: jest.fn(),
    submoduleSync: jest.fn(),
    submoduleUpdate: jest.fn(),
    submoduleStatus: jest.fn(async () => {
      return true
    }),
    tagExists: jest.fn(),
    tryClean: jest.fn(async () => {
      return true
    }),
    tryConfigUnset: jest.fn(),
    tryDisableAutomaticGarbageCollection: jest.fn(),
    tryGetFetchUrl: jest.fn(async () => {
      // Sanity check - this function shouldn't be called when the .git directory doesn't exist
      await fs.promises.stat(path.join(repositoryPath, '.git'))
      return repositoryUrl
    }),
    getSubmoduleConfigPaths: jest.fn(async () => {
      return []
    }),
    tryConfigUnsetValue: jest.fn(async () => {
      return true
    }),
    tryGetConfigValues: jest.fn(async () => {
      return []
    }),
    tryGetConfigKeys: jest.fn(async () => {
      return []
    }),
    tryReset: jest.fn(async () => {
      return true
    }),
    version: jest.fn()
  }
 }
@@ -0,0 +1,86 @@
 import {GitVersion} from '../src/git-version'
 import {MinimumGitSparseCheckoutVersion} from '../src/git-command-manager'
 describe('git-version tests', () => {
  it('basics', async () => {
    let version = new GitVersion('')
    expect(version.isValid()).toBeFalsy()
    version = new GitVersion('asdf')
    expect(version.isValid()).toBeFalsy()
    version = new GitVersion('1.2')
    expect(version.isValid()).toBeTruthy()
    expect(version.toString()).toBe('1.2')
    version = new GitVersion('1.2.3')
    expect(version.isValid()).toBeTruthy()
    expect(version.toString()).toBe('1.2.3')
  })
  it('check minimum', async () => {
    let version = new GitVersion('4.5')
    expect(version.checkMinimum(new GitVersion('3.6'))).toBeTruthy()
    expect(version.checkMinimum(new GitVersion('3.6.7'))).toBeTruthy()
    expect(version.checkMinimum(new GitVersion('4.4'))).toBeTruthy()
    expect(version.checkMinimum(new GitVersion('4.5'))).toBeTruthy()
    expect(version.checkMinimum(new GitVersion('4.5.0'))).toBeTruthy()
    expect(version.checkMinimum(new GitVersion('4.6'))).toBeFalsy()
    expect(version.checkMinimum(new GitVersion('4.6.0'))).toBeFalsy()
    expect(version.checkMinimum(new GitVersion('5.1'))).toBeFalsy()
    expect(version.checkMinimum(new GitVersion('5.1.2'))).toBeFalsy()
    version = new GitVersion('4.5.6')
    expect(version.checkMinimum(new GitVersion('3.6'))).toBeTruthy()
    expect(version.checkMinimum(new GitVersion('3.6.7'))).toBeTruthy()
    expect(version.checkMinimum(new GitVersion('4.4'))).toBeTruthy()
    expect(version.checkMinimum(new GitVersion('4.5'))).toBeTruthy()
    expect(version.checkMinimum(new GitVersion('4.5.5'))).toBeTruthy()
    expect(version.checkMinimum(new GitVersion('4.5.6'))).toBeTruthy()
    expect(version.checkMinimum(new GitVersion('4.5.7'))).toBeFalsy()
    expect(version.checkMinimum(new GitVersion('4.6'))).toBeFalsy()
    expect(version.checkMinimum(new GitVersion('4.6.0'))).toBeFalsy()
    expect(version.checkMinimum(new GitVersion('5.1'))).toBeFalsy()
    expect(version.checkMinimum(new GitVersion('5.1.2'))).toBeFalsy()
  })
  it('sparse checkout', async () => {
    const minSparseVer = MinimumGitSparseCheckoutVersion
    expect(new GitVersion('1.0').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('1.99').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.0').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.24').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.24.0').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.24.9').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.25').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.25.0').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.25.1').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.25.9').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.26').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.26.0').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.26.1').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.26.9').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.27').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.27.0').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.27.1').checkMinimum(minSparseVer)).toBeFalsy()
    expect(new GitVersion('2.27.9').checkMinimum(minSparseVer)).toBeFalsy()
    //                             /---------------------------------------
    //         ^^^ before         /         after vvv
    // --------------------------/
    expect(new GitVersion('2.28').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('2.28.0').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('2.28.1').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('2.28.9').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('2.29').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('2.29.0').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('2.29.1').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('2.29.9').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('2.99').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('3.0').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('3.99').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('4.0').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('4.99').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('5.0').checkMinimum(minSparseVer)).toBeTruthy()
    expect(new GitVersion('5.99').checkMinimum(minSparseVer)).toBeTruthy()
  })
 })
@@ -0,0 +1,225 @@
 import * as core from '@actions/core'
 import * as fsHelper from '../lib/fs-helper'
 import * as github from '@actions/github'
 import * as inputHelper from '../lib/input-helper'
 import * as path from 'path'
 import * as workflowContextHelper from '../lib/workflow-context-helper'
 import {IGitSourceSettings} from '../lib/git-source-settings'
 const originalGitHubWorkspace = process.env['GITHUB_WORKSPACE']
 const gitHubWorkspace = path.resolve('/checkout-tests/workspace')
 // Inputs for mock @actions/core
 let inputs = {} as any
 // Replicate @actions/core getInput behavior: it trims whitespace by default
 // (String.prototype.trim(), which strips characters such as a leading U+FEFF BOM)
 // unless trimWhitespace is explicitly set to false.
 const getInputImpl = (name: string, options?: {trimWhitespace?: boolean}) => {
  const val = inputs[name] ?? ''
  if (options && options.trimWhitespace === false) {
    return val
  }
  return typeof val === 'string' ? val.trim() : val
 }
 // Shallow clone original @actions/github context
 let originalContext = {...github.context}
 describe('input-helper tests', () => {
  beforeAll(() => {
    // Mock getInput
    jest.spyOn(core, 'getInput').mockImplementation(getInputImpl as any)
    // Mock error/warning/info/debug
    jest.spyOn(core, 'error').mockImplementation(jest.fn())
    jest.spyOn(core, 'warning').mockImplementation(jest.fn())
    jest.spyOn(core, 'info').mockImplementation(jest.fn())
    jest.spyOn(core, 'debug').mockImplementation(jest.fn())
    // Mock github context
    jest.spyOn(github.context, 'repo', 'get').mockImplementation(() => {
      return {
        owner: 'some-owner',
        repo: 'some-repo'
      }
    })
    github.context.ref = 'refs/heads/some-ref'
    github.context.sha = '1234567890123456789012345678901234567890'
    // Mock ./fs-helper directoryExistsSync()
    jest
      .spyOn(fsHelper, 'directoryExistsSync')
      .mockImplementation((path: string) => path == gitHubWorkspace)
    // Mock ./workflowContextHelper getOrganizationId()
    jest
      .spyOn(workflowContextHelper, 'getOrganizationId')
      .mockImplementation(() => Promise.resolve(123456))
    // GitHub workspace
    process.env['GITHUB_WORKSPACE'] = gitHubWorkspace
  })
  beforeEach(() => {
    // Reset inputs
    inputs = {}
  })
  afterAll(() => {
    // Restore GitHub workspace
    delete process.env['GITHUB_WORKSPACE']
    if (originalGitHubWorkspace) {
      process.env['GITHUB_WORKSPACE'] = originalGitHubWorkspace
    }
    // Restore @actions/github context
    github.context.ref = originalContext.ref
    github.context.sha = originalContext.sha
    // Restore
    jest.restoreAllMocks()
  })
  it('sets defaults', async () => {
    const settings: IGitSourceSettings = await inputHelper.getInputs()
    expect(settings).toBeTruthy()
    expect(settings.authToken).toBeFalsy()
    expect(settings.clean).toBe(true)
    expect(settings.commit).toBeTruthy()
    expect(settings.commit).toBe('1234567890123456789012345678901234567890')
    expect(settings.filter).toBe(undefined)
    expect(settings.sparseCheckout).toBe(undefined)
    expect(settings.sparseCheckoutConeMode).toBe(true)
    expect(settings.fetchDepth).toBe(1)
    expect(settings.fetchTags).toBe(false)
    expect(settings.showProgress).toBe(true)
    expect(settings.lfs).toBe(false)
    expect(settings.ref).toBe('refs/heads/some-ref')
    expect(settings.repositoryName).toBe('some-repo')
    expect(settings.repositoryOwner).toBe('some-owner')
    expect(settings.repositoryPath).toBe(gitHubWorkspace)
    expect(settings.setSafeDirectory).toBe(true)
    expect(settings.allowUnsafePrCheckout).toBe(false)
  })
  it('qualifies ref', async () => {
    let originalRef = github.context.ref
    try {
      github.context.ref = 'some-unqualified-ref'
      const settings: IGitSourceSettings = await inputHelper.getInputs()
      expect(settings).toBeTruthy()
      expect(settings.commit).toBe('1234567890123456789012345678901234567890')
      expect(settings.ref).toBe('refs/heads/some-unqualified-ref')
    } finally {
      github.context.ref = originalRef
    }
  })
  it('requires qualified repo', async () => {
    inputs.repository = 'some-unqualified-repo'
    try {
      await inputHelper.getInputs()
      throw 'should not reach here'
    } catch (err) {
      expect(`(${(err as any).message}`).toMatch(
        "Invalid repository 'some-unqualified-repo'"
      )
    }
  })
  it('roots path', async () => {
    inputs.path = 'some-directory/some-subdirectory'
    const settings: IGitSourceSettings = await inputHelper.getInputs()
    expect(settings.repositoryPath).toBe(
      path.join(gitHubWorkspace, 'some-directory', 'some-subdirectory')
    )
  })
  it('sets ref to empty when explicit sha', async () => {
    inputs.ref = '1111111111222222222233333333334444444444'
    const settings: IGitSourceSettings = await inputHelper.getInputs()
    expect(settings.ref).toBeFalsy()
    expect(settings.commit).toBe('1111111111222222222233333333334444444444')
  })
  it('sets sha to empty when explicit ref', async () => {
    inputs.ref = 'refs/heads/some-other-ref'
    const settings: IGitSourceSettings = await inputHelper.getInputs()
    expect(settings.ref).toBe('refs/heads/some-other-ref')
    expect(settings.commit).toBeFalsy()
  })
  it('does not reclassify a ref as sha when a BOM is prefixed', async () => {
    // A fork branch named "<U+FEFF>" + 40 hex chars. core.getInput trims the
    // BOM by default, which previously collapsed this into a bare SHA and
    // bypassed the unsafe fork PR checkout guard.
    inputs.ref = '\uFEFF522d932fae5296da51fdf431934425ecf891c6a2'
    const settings: IGitSourceSettings = await inputHelper.getInputs()
    expect(settings.commit).toBeFalsy()
    expect(settings.ref).toBe('522d932fae5296da51fdf431934425ecf891c6a2')
  })
  it('treats a sha surrounded by ascii whitespace as a commit', async () => {
    // ASCII whitespace can only come from the workflow author's YAML (git ref
    // names cannot contain it), so trimming it and treating the value as a
    // commit is safe.
    inputs.ref = '  1111111111222222222233333333334444444444  '
    const settings: IGitSourceSettings = await inputHelper.getInputs()
    expect(settings.ref).toBeFalsy()
    expect(settings.commit).toBe('1111111111222222222233333333334444444444')
  })
  it('sets workflow organization ID', async () => {
    const settings: IGitSourceSettings = await inputHelper.getInputs()
    expect(settings.workflowOrganizationId).toBe(123456)
  })
  describe('unsafe PR checkout guard', () => {
    const forkPayload = {
      repository: {id: 100},
      pull_request: {
        head: {
          sha: '1234567890123456789012345678901234567890',
          repo: {id: 200, full_name: 'attacker/fork'}
        },
        merge_commit_sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
      }
    }
    it('allows the default self-checkout on a fork pull_request_target', async () => {
      const originalEvent = github.context.eventName
      const originalPayload = github.context.payload
      const originalSha = github.context.sha
      try {
        github.context.eventName = 'pull_request_target'
        github.context.payload = forkPayload as any
        // Simulate a rebase/fast-forward merge where the base tip (event SHA)
        // equals the PR head SHA. The default self-checkout must still succeed.
        github.context.sha = '1234567890123456789012345678901234567890'
        const settings: IGitSourceSettings = await inputHelper.getInputs()
        expect(settings.commit).toBe('1234567890123456789012345678901234567890')
      } finally {
        github.context.eventName = originalEvent
        github.context.payload = originalPayload
        github.context.sha = originalSha
      }
    })
    it('refuses an explicit fork repository on pull_request_target', async () => {
      const originalEvent = github.context.eventName
      const originalPayload = github.context.payload
      try {
        github.context.eventName = 'pull_request_target'
        github.context.payload = forkPayload as any
        inputs.repository = 'attacker/fork'
        await expect(inputHelper.getInputs()).rejects.toThrow(
          /Refusing to check out fork pull request code/
        )
      } finally {
        github.context.eventName = originalEvent
        github.context.payload = originalPayload
      }
    })
  })
 })
@@ -0,0 +1,10 @@
 #!/bin/bash
 if [ ! -f "./basic/basic-file.txt" ]; then
    echo "Expected basic file does not exist"
    exit 1
 fi
 echo hello >> ./basic/basic-file.txt
 echo hello >> ./basic/new-file.txt
 git -C ./basic status
@@ -0,0 +1,6 @@
 mkdir override-git-version
 cd override-git-version
 echo @echo override git version 1.2.3 > git.cmd
 echo "%CD%" >> $GITHUB_PATH
 cd ..
@@ -0,0 +1,9 @@
 #!/bin/sh
 mkdir override-git-version
 cd override-git-version
 echo "#!/bin/sh" > git
 echo "echo override git version 1.2.3" >> git
 chmod +x git
 echo "$(pwd)" >> $GITHUB_PATH
 cd ..
@@ -0,0 +1,190 @@
 import * as assert from 'assert'
 import * as refHelper from '../lib/ref-helper'
 import {IGitCommandManager} from '../lib/git-command-manager'
 const commit = '1234567890123456789012345678901234567890'
 let git: IGitCommandManager
 describe('ref-helper tests', () => {
  beforeEach(() => {
    git = {} as unknown as IGitCommandManager
  })
  it('getCheckoutInfo requires git', async () => {
    const git = null as unknown as IGitCommandManager
    try {
      await refHelper.getCheckoutInfo(git, 'refs/heads/my/branch', commit)
      throw new Error('Should not reach here')
    } catch (err) {
      expect((err as any)?.message).toBe('Arg git cannot be empty')
    }
  })
  it('getCheckoutInfo requires ref or commit', async () => {
    try {
      await refHelper.getCheckoutInfo(git, '', '')
      throw new Error('Should not reach here')
    } catch (err) {
      expect((err as any)?.message).toBe(
        'Args ref and commit cannot both be empty'
      )
    }
  })
  it('getCheckoutInfo sha only', async () => {
    const checkoutInfo = await refHelper.getCheckoutInfo(git, '', commit)
    expect(checkoutInfo.ref).toBe(commit)
    expect(checkoutInfo.startPoint).toBeFalsy()
  })
  it('getCheckoutInfo refs/heads/', async () => {
    const checkoutInfo = await refHelper.getCheckoutInfo(
      git,
      'refs/heads/my/branch',
      commit
    )
    expect(checkoutInfo.ref).toBe('my/branch')
    expect(checkoutInfo.startPoint).toBe('refs/remotes/origin/my/branch')
  })
  it('getCheckoutInfo refs/pull/', async () => {
    const checkoutInfo = await refHelper.getCheckoutInfo(
      git,
      'refs/pull/123/merge',
      commit
    )
    expect(checkoutInfo.ref).toBe('refs/remotes/pull/123/merge')
    expect(checkoutInfo.startPoint).toBeFalsy()
  })
  it('getCheckoutInfo refs/tags/', async () => {
    const checkoutInfo = await refHelper.getCheckoutInfo(
      git,
      'refs/tags/my-tag',
      commit
    )
    expect(checkoutInfo.ref).toBe('refs/tags/my-tag')
    expect(checkoutInfo.startPoint).toBeFalsy()
  })
  it('getCheckoutInfo refs/', async () => {
    const checkoutInfo = await refHelper.getCheckoutInfo(
      git,
      'refs/gh/queue/main/pr-123',
      commit
    )
    expect(checkoutInfo.ref).toBe(commit)
    expect(checkoutInfo.startPoint).toBeFalsy()
  })
  it('getCheckoutInfo refs/ without commit', async () => {
    const checkoutInfo = await refHelper.getCheckoutInfo(
      git,
      'refs/non-standard-ref',
      ''
    )
    expect(checkoutInfo.ref).toBe('refs/non-standard-ref')
    expect(checkoutInfo.startPoint).toBeFalsy()
  })
  it('getCheckoutInfo unqualified branch only', async () => {
    git.branchExists = jest.fn(async (remote: boolean, pattern: string) => {
      return true
    })
    const checkoutInfo = await refHelper.getCheckoutInfo(git, 'my/branch', '')
    expect(checkoutInfo.ref).toBe('my/branch')
    expect(checkoutInfo.startPoint).toBe('refs/remotes/origin/my/branch')
  })
  it('getCheckoutInfo unqualified tag only', async () => {
    git.branchExists = jest.fn(async (remote: boolean, pattern: string) => {
      return false
    })
    git.tagExists = jest.fn(async (pattern: string) => {
      return true
    })
    const checkoutInfo = await refHelper.getCheckoutInfo(git, 'my-tag', '')
    expect(checkoutInfo.ref).toBe('refs/tags/my-tag')
    expect(checkoutInfo.startPoint).toBeFalsy()
  })
  it('getCheckoutInfo unqualified ref only, not a branch or tag', async () => {
    git.branchExists = jest.fn(async (remote: boolean, pattern: string) => {
      return false
    })
    git.tagExists = jest.fn(async (pattern: string) => {
      return false
    })
    try {
      await refHelper.getCheckoutInfo(git, 'my-ref', '')
      throw new Error('Should not reach here')
    } catch (err) {
      expect((err as any)?.message).toBe(
        "A branch or tag with the name 'my-ref' could not be found"
      )
    }
  })
  it('getRefSpec requires ref or commit', async () => {
    assert.throws(
      () => refHelper.getRefSpec('', ''),
      /Args ref and commit cannot both be empty/
    )
  })
  it('getRefSpec sha + refs/heads/', async () => {
    const refSpec = refHelper.getRefSpec('refs/heads/my/branch', commit)
    expect(refSpec.length).toBe(1)
    expect(refSpec[0]).toBe(`+${commit}:refs/remotes/origin/my/branch`)
  })
  it('getRefSpec sha + refs/pull/', async () => {
    const refSpec = refHelper.getRefSpec('refs/pull/123/merge', commit)
    expect(refSpec.length).toBe(1)
    expect(refSpec[0]).toBe(`+${commit}:refs/remotes/pull/123/merge`)
  })
  it('getRefSpec sha + refs/tags/', async () => {
    const refSpec = refHelper.getRefSpec('refs/tags/my-tag', commit)
    expect(refSpec.length).toBe(1)
    expect(refSpec[0]).toBe(`+${commit}:refs/tags/my-tag`)
  })
  it('getRefSpec sha only', async () => {
    const refSpec = refHelper.getRefSpec('', commit)
+