Merge 7358b1bbf5 into 3d3c42e5aa

* prep v7.0.1 release

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## v7.0.1
+* Bump github/codeql-action from 3 to 4 by @dependabot[bot] in https://github.com/actions/checkout/pull/2475
+* Bump actions/setup-node from 4 to 6 by @dependabot[bot] in https://github.com/actions/checkout/pull/2477
+* Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2478
+* Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2479
+* Bump actions/checkout from 6 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2488
+* Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2476
+* eslint 9 by @dependabot[bot] in https://github.com/actions/checkout/pull/2474
+* Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2499
+* skip running unsafe pr check if input is default by @aiqiaoy in https://github.com/actions/checkout/pull/2518
+* trim only ascii whitespace for branch by @aiqiaoy in https://github.com/actions/checkout/pull/2521
+* escape values passed to --unset by @aiqiaoy in https://github.com/actions/checkout/pull/2530
+
 ## v7.0.0
 * Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in https://github.com/actions/checkout/pull/2454
 * Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in https://github.com/actions/checkout/pull/2458

action.yml

@@ -9,6 +9,7 @@ inputs:
       The branch, tag or SHA to checkout. When checking out the repository that
       triggered a workflow, this defaults to the reference or SHA for that
       event.  Otherwise, uses the default branch.
+    required: false
   token:
     description: >
       Personal access token (PAT) used to fetch the repository. The PAT is configured
@@ -34,11 +35,13 @@ inputs:
 
       [Learn more about creating and using
       encrypted secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)
+    required: false
   ssh-known-hosts:
     description: >
       Known hosts in addition to the user and global host key database. The public
       SSH keys for a host may be obtained using the utility `ssh-keyscan`. For example,
       `ssh-keyscan github.com`. The public key for github.com is always implicitly added.
+    required: false
   ssh-strict:
     description: >
       Whether to perform strict host key checking. When true, adds the options `StrictHostKeyChecking=yes`
@@ -50,23 +53,30 @@ inputs:
       The user to use when connecting to the remote SSH host. By default 'git' is used.
     default: git
   persist-credentials:
-    description: 'Whether to configure the token or SSH key with the local git config'
+    description: >
+      Whether to persist the token or SSH key credentials for use by subsequent
+      steps. When true, credentials are stored in a file under `$RUNNER_TEMP`
+      and referenced from the local git config. The post-job step removes the
+      credential file.
     default: true
   path:
     description: 'Relative path under $GITHUB_WORKSPACE to place the repository'
+    default: '.'
+    required: false
   clean:
     description: 'Whether to execute `git clean -ffdx && git reset --hard HEAD` before fetching'
     default: true
   filter:
     description: >
-      Partially clone against a given filter.
-      Overrides sparse-checkout if set.
-    default: null
+      Partially clone against a given filter. When `sparse-checkout` is also
+      set, overrides the default `blob:none` filter that would otherwise be
+      used for fetching.
+    required: false
   sparse-checkout:
     description: >
       Do a sparse checkout on given patterns.
       Each pattern should be separated with new lines.
-    default: null
+    required: false
   sparse-checkout-cone-mode:
     description: >
       Specifies whether to use cone-mode when doing a sparse checkout.
@@ -109,9 +119,13 @@ inputs:
     default: false
 outputs:
   ref:
-    description: 'The branch, tag or SHA that was checked out'
+    description: >
+      The branch or tag ref that was checked out. Empty when the checkout was
+      performed by a full commit SHA.
   commit:
-    description: 'The commit SHA that was checked out'
+    description: >
+      The commit SHA that was checked out. Only set when Git is available (not
+      set when the repository was downloaded via the GitHub REST API fallback).
 runs:
   using: node24
   main: dist/index.js

dist/index.js

@@ -35913,7 +35913,7 @@ class GitCommandManager {
         else {
             args.push(globalConfig ? '--global' : '--local');
         }
-        args.push('--unset', configKey, configValue);
+        args.push('--unset', configKey, regexp_helper_escape(configValue));
         const output = await this.execGit(args, true);
         return output.exitCode === 0;
     }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "checkout",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "checkout",
-      "version": "7.0.0",
+      "version": "7.0.1",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^3.0.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "checkout",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "description": "checkout action",
   "type": "module",
   "main": "lib/main.js",

src/git-command-manager.ts

@@ -510,7 +510,7 @@ class GitCommandManager {
     } else {
       args.push(globalConfig ? '--global' : '--local')
     }
-    args.push('--unset', configKey, configValue)
+    args.push('--unset', configKey, regexpHelper.escape(configValue))
 
     const output = await this.execGit(args, true)
     return output.exitCode === 0