Compare commits

...

3 Commits

Author SHA1 Message Date
Michi Mutsuzaki c989dc645b
Merge e832aee124 into f548e57e54 2026-07-22 00:37:17 -04:00
Aiqiao Yan f548e57e54
Consolidate dependency updates in CHANGELOG (#2537)
* Consolidate dependency updates in CHANGELOG

Removed specific dependency updates and consolidated them into a single entry.

* Fix capitalization in v7.0.1 changelog entries

Updated changelog entries for v7.0.1 to use consistent capitalization.
2026-07-20 12:20:47 -04:00
Michi Mutsuzaki e832aee124
Change the default value of persist-credentials to false
Change the default value of persist-credentials setting from true to
false to reduce the risk of unintentionally exposing the GITHUB_TOKEN
secret.

Fixes: #485

Signed-off-by: Michi Mutsuzaki <michi@isovalent.com>
2024-04-20 23:37:24 +00:00
3 changed files with 8 additions and 20 deletions

View File

@ -1,26 +1,14 @@
# Changelog
## v7.0.1
* Bump github/codeql-action from 3 to 4 by @dependabot[bot] in https://github.com/actions/checkout/pull/2475
* Bump actions/setup-node from 4 to 6 by @dependabot[bot] in https://github.com/actions/checkout/pull/2477
* Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2478
* Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2479
* Bump actions/checkout from 6 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2488
* Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2476
* eslint 9 by @dependabot[bot] in https://github.com/actions/checkout/pull/2474
* Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2499
* skip running unsafe pr check if input is default by @aiqiaoy in https://github.com/actions/checkout/pull/2518
* trim only ascii whitespace for branch by @aiqiaoy in https://github.com/actions/checkout/pull/2521
* escape values passed to --unset by @aiqiaoy in https://github.com/actions/checkout/pull/2530
* Skip running unsafe pr check if input is default by @aiqiaoy in https://github.com/actions/checkout/pull/2518
* Trim only ascii whitespace for branch by @aiqiaoy in https://github.com/actions/checkout/pull/2521
* Escape values passed to --unset by @aiqiaoy in https://github.com/actions/checkout/pull/2530
* Various dependency updates
## v7.0.0
* Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in https://github.com/actions/checkout/pull/2454
* Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in https://github.com/actions/checkout/pull/2458
* Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in https://github.com/actions/checkout/pull/2460
* Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2461
* Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in https://github.com/actions/checkout/pull/2459
* upgrade module to esm and update dependencies by @aiqiaoy in https://github.com/actions/checkout/pull/2463
* Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2462
* Various dependency updates
## v6.0.3
* Fix checkout init for SHA-256 repositories by @yaananth in https://github.com/actions/checkout/pull/2439

View File

@ -30,7 +30,7 @@ This action checks-out your repository under `$GITHUB_WORKSPACE`, so your workfl
Only a single commit is fetched by default, for the ref/SHA that triggered the workflow. Set `fetch-depth: 0` to fetch all history for all branches and tags. Refer [here](https://docs.github.com/actions/using-workflows/events-that-trigger-workflows) to learn which commit `$GITHUB_SHA` points to for different events.
The auth token is persisted in the local git config. This enables your scripts to run authenticated git commands. The token is removed during post-job cleanup. Set `persist-credentials: false` to opt-out.
Set `persist-credentials: true` to opt-in to persist the auth token in the local git config. This enables your scripts to run authenticated git commands. The token is removed during post-job cleanup.
When Git 2.18 or higher is not in your PATH, falls back to the REST API to download the files.
@ -110,7 +110,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
ssh-user: ''
# Whether to configure the token or SSH key with the local git config
# Default: true
# Default: false
persist-credentials: ''
# Relative path under $GITHUB_WORKSPACE to place the repository

View File

@ -51,7 +51,7 @@ inputs:
default: git
persist-credentials:
description: 'Whether to configure the token or SSH key with the local git config'
default: true
default: false
path:
description: 'Relative path under $GITHUB_WORKSPACE to place the repository'
clean: