Merge 057e2c1f09 into 3d3c42e5aa

* prep v7.0.1 release

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## v7.0.1
+* Bump github/codeql-action from 3 to 4 by @dependabot[bot] in https://github.com/actions/checkout/pull/2475
+* Bump actions/setup-node from 4 to 6 by @dependabot[bot] in https://github.com/actions/checkout/pull/2477
+* Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2478
+* Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2479
+* Bump actions/checkout from 6 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2488
+* Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2476
+* eslint 9 by @dependabot[bot] in https://github.com/actions/checkout/pull/2474
+* Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2499
+* skip running unsafe pr check if input is default by @aiqiaoy in https://github.com/actions/checkout/pull/2518
+* trim only ascii whitespace for branch by @aiqiaoy in https://github.com/actions/checkout/pull/2521
+* escape values passed to --unset by @aiqiaoy in https://github.com/actions/checkout/pull/2530
+
 ## v7.0.0
 * Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in https://github.com/actions/checkout/pull/2454
 * Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in https://github.com/actions/checkout/pull/2458

__test__/git-command-manager.test.ts

@@ -403,6 +403,72 @@ describe('Test fetchDepth and fetchTags options', () => {
   })
 })
 
+describe('Test submoduleUpdate filter option', () => {
+  beforeEach(async () => {
+    mockFileExistsSync.mockReset()
+    mockDirectoryExistsSync.mockReset()
+    mockExec.mockImplementation((path: any, args: any, options: any) => {
+      if (args.includes('version')) {
+        options.listeners.stdout(Buffer.from('2.18'))
+      }
+
+      return 0
+    })
+  })
+
+  afterEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('should call execGit with --filter when a filter option is provided', async () => {
+    const workingDirectory = 'test'
+    const lfs = false
+    const doSparseCheckout = false
+    git = await commandManager.createCommandManager(
+      workingDirectory,
+      lfs,
+      doSparseCheckout
+    )
+
+    await git.submoduleUpdate(1, true, 'blob:none')
+
+    expect(mockExec).toHaveBeenCalledWith(
+      expect.any(String),
+      [
+        '-c',
+        'protocol.version=2',
+        'submodule',
+        'update',
+        '--init',
+        '--force',
+        '--depth=1',
+        '--recursive',
+        '--filter=blob:none'
+      ],
+      expect.any(Object)
+    )
+  })
+
+  it('should call execGit without --filter when no filter option is provided', async () => {
+    const workingDirectory = 'test'
+    const lfs = false
+    const doSparseCheckout = false
+    git = await commandManager.createCommandManager(
+      workingDirectory,
+      lfs,
+      doSparseCheckout
+    )
+
+    await git.submoduleUpdate(0, false, undefined)
+
+    expect(mockExec).toHaveBeenCalledWith(
+      expect.any(String),
+      ['-c', 'protocol.version=2', 'submodule', 'update', '--init', '--force'],
+      expect.any(Object)
+    )
+  })
+})
+
 describe('repository initialization object format', () => {
   beforeEach(async () => {
     mockFileExistsSync.mockReset()

dist/index.js

@@ -35872,7 +35872,7 @@ class GitCommandManager {
         }
         await this.execGit(args);
     }
-    async submoduleUpdate(fetchDepth, recursive) {
+    async submoduleUpdate(fetchDepth, recursive, filter) {
         const args = ['-c', 'protocol.version=2'];
         args.push('submodule', 'update', '--init', '--force');
         if (fetchDepth > 0) {
@@ -35881,6 +35881,9 @@ class GitCommandManager {
         if (recursive) {
             args.push('--recursive');
         }
+        if (filter) {
+            args.push(`--filter=${filter}`);
+        }
         await this.execGit(args);
     }
     async submoduleStatus() {
@@ -35913,7 +35916,7 @@ class GitCommandManager {
         else {
             args.push(globalConfig ? '--global' : '--local');
         }
-        args.push('--unset', configKey, configValue);
+        args.push('--unset', configKey, regexp_helper_escape(configValue));
         const output = await this.execGit(args, true);
         return output.exitCode === 0;
     }
@@ -41888,7 +41891,7 @@ async function getSource(settings) {
             // Checkout submodules
             startGroup('Fetching submodules');
             await git.submoduleSync(settings.nestedSubmodules);
-            await git.submoduleUpdate(settings.fetchDepth, settings.nestedSubmodules);
+            await git.submoduleUpdate(settings.fetchDepth, settings.nestedSubmodules, fetchOptions.filter);
             await git.submoduleForeach('git config --local gc.auto 0', settings.nestedSubmodules);
             endGroup();
             // Persist credentials

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "checkout",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "checkout",
-      "version": "7.0.0",
+      "version": "7.0.1",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^3.0.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "checkout",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "description": "checkout action",
   "type": "module",
   "main": "lib/main.js",

src/git-command-manager.ts

@@ -55,7 +55,11 @@ export interface IGitCommandManager {
   shaExists(sha: string): Promise<boolean>
   submoduleForeach(command: string, recursive: boolean): Promise<string>
   submoduleSync(recursive: boolean): Promise<void>
-  submoduleUpdate(fetchDepth: number, recursive: boolean): Promise<void>
+  submoduleUpdate(
+    fetchDepth: number,
+    recursive: boolean,
+    filter: string | undefined
+  ): Promise<void>
   submoduleStatus(): Promise<boolean>
   tagExists(pattern: string): Promise<boolean>
   tryClean(): Promise<boolean>
@@ -452,7 +456,11 @@ class GitCommandManager {
     await this.execGit(args)
   }
 
-  async submoduleUpdate(fetchDepth: number, recursive: boolean): Promise<void> {
+  async submoduleUpdate(
+    fetchDepth: number,
+    recursive: boolean,
+    filter: string | undefined
+  ): Promise<void> {
     const args = ['-c', 'protocol.version=2']
     args.push('submodule', 'update', '--init', '--force')
     if (fetchDepth > 0) {
@@ -463,6 +471,10 @@ class GitCommandManager {
       args.push('--recursive')
     }
 
+    if (filter) {
+      args.push(`--filter=${filter}`)
+    }
+
     await this.execGit(args)
   }
 
@@ -510,7 +522,7 @@ class GitCommandManager {
     } else {
       args.push(globalConfig ? '--global' : '--local')
     }
-    args.push('--unset', configKey, configValue)
+    args.push('--unset', configKey, regexpHelper.escape(configValue))
 
     const output = await this.execGit(args, true)
     return output.exitCode === 0

src/git-source-provider.ts

@@ -281,7 +281,11 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
       // Checkout submodules
       core.startGroup('Fetching submodules')
       await git.submoduleSync(settings.nestedSubmodules)
-      await git.submoduleUpdate(settings.fetchDepth, settings.nestedSubmodules)
+      await git.submoduleUpdate(
+        settings.fetchDepth,
+        settings.nestedSubmodules,
+        fetchOptions.filter
+      )
       await git.submoduleForeach(
         'git config --local gc.auto 0',
         settings.nestedSubmodules