Merge 2d76d21b2e into 3d3c42e5aa

* prep v7.0.1 release

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## v7.0.1
+* Bump github/codeql-action from 3 to 4 by @dependabot[bot] in https://github.com/actions/checkout/pull/2475
+* Bump actions/setup-node from 4 to 6 by @dependabot[bot] in https://github.com/actions/checkout/pull/2477
+* Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2478
+* Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2479
+* Bump actions/checkout from 6 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2488
+* Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2476
+* eslint 9 by @dependabot[bot] in https://github.com/actions/checkout/pull/2474
+* Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2499
+* skip running unsafe pr check if input is default by @aiqiaoy in https://github.com/actions/checkout/pull/2518
+* trim only ascii whitespace for branch by @aiqiaoy in https://github.com/actions/checkout/pull/2521
+* escape values passed to --unset by @aiqiaoy in https://github.com/actions/checkout/pull/2530
+
 ## v7.0.0
 * Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in https://github.com/actions/checkout/pull/2454
 * Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in https://github.com/actions/checkout/pull/2458

__test__/git-auth-helper.test.ts

@@ -923,6 +923,25 @@ describe('git-auth-helper tests', () => {
     }
   })
 
+  const configureGlobalAuth_overridesGitConfigGlobal =
+    'configureGlobalAuth overrides GIT_CONFIG_GLOBAL'
+  it(configureGlobalAuth_overridesGitConfigGlobal, async () => {
+    // Arrange
+    await setup(configureGlobalAuth_overridesGitConfigGlobal)
+    const authHelper = gitAuthHelper.createAuthHelper(git, settings)
+
+    // Act
+    await authHelper.configureAuth()
+    await authHelper.configureGlobalAuth()
+
+    // Assert GIT_CONFIG_GLOBAL is pinned to the temporary global config, so an
+    // inherited GIT_CONFIG_GLOBAL cannot redirect --global writes
+    expect(git.env['HOME']).toBeTruthy()
+    expect(git.env['GIT_CONFIG_GLOBAL']).toBe(
+      path.join(git.env['HOME'], '.gitconfig')
+    )
+  })
+
   const removeGlobalConfig_removesOverride =
     'removeGlobalConfig removes override'
   it(removeGlobalConfig_removesOverride, async () => {
@@ -933,6 +952,7 @@ describe('git-auth-helper tests', () => {
     await authHelper.configureGlobalAuth()
     const homeOverride = git.env['HOME'] // Sanity check
     expect(homeOverride).toBeTruthy()
+    expect(git.env['GIT_CONFIG_GLOBAL']).toBeTruthy()
     await fs.promises.stat(path.join(git.env['HOME'], '.gitconfig'))
 
     // Act
@@ -940,6 +960,7 @@ describe('git-auth-helper tests', () => {
 
     // Assert
     expect(git.env['HOME']).toBeUndefined()
+    expect(git.env['GIT_CONFIG_GLOBAL']).toBeUndefined()
     try {
       await fs.promises.stat(homeOverride)
       throw new Error(`Should have been deleted '${homeOverride}'`)

dist/index.js

@@ -35109,6 +35109,10 @@ class GitAuthHelper {
         // Override HOME
         info(`Temporarily overriding HOME='${this.temporaryHomePath}' before making global git config changes`);
         this.git.setEnvironmentVariable('HOME', this.temporaryHomePath);
+        // GIT_CONFIG_GLOBAL takes precedence over HOME when locating the global
+        // config file. Pin it to the temporary config so an inherited
+        // GIT_CONFIG_GLOBAL cannot redirect our global git config writes elsewhere.
+        this.git.setEnvironmentVariable('GIT_CONFIG_GLOBAL', newGitConfigPath);
         return newGitConfigPath;
     }
     async configureGlobalAuth() {
@@ -35183,8 +35187,9 @@ class GitAuthHelper {
     }
     async removeGlobalConfig() {
         if (this.temporaryHomePath?.length > 0) {
-            core_debug(`Unsetting HOME override`);
+            core_debug(`Unsetting HOME and GIT_CONFIG_GLOBAL overrides`);
             this.git.removeEnvironmentVariable('HOME');
+            this.git.removeEnvironmentVariable('GIT_CONFIG_GLOBAL');
             await rmRF(this.temporaryHomePath);
         }
     }
@@ -35913,7 +35918,7 @@ class GitCommandManager {
         else {
             args.push(globalConfig ? '--global' : '--local');
         }
-        args.push('--unset', configKey, configValue);
+        args.push('--unset', configKey, regexp_helper_escape(configValue));
         const output = await this.execGit(args, true);
         return output.exitCode === 0;
     }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "checkout",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "checkout",
-      "version": "7.0.0",
+      "version": "7.0.1",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^3.0.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "checkout",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "description": "checkout action",
   "type": "module",
   "main": "lib/main.js",

src/git-auth-helper.ts

@@ -122,6 +122,11 @@ class GitAuthHelper {
     )
     this.git.setEnvironmentVariable('HOME', this.temporaryHomePath)
 
+    // GIT_CONFIG_GLOBAL takes precedence over HOME when locating the global
+    // config file. Pin it to the temporary config so an inherited
+    // GIT_CONFIG_GLOBAL cannot redirect our global git config writes elsewhere.
+    this.git.setEnvironmentVariable('GIT_CONFIG_GLOBAL', newGitConfigPath)
+
     return newGitConfigPath
   }
 
@@ -237,8 +242,9 @@ class GitAuthHelper {
 
   async removeGlobalConfig(): Promise<void> {
     if (this.temporaryHomePath?.length > 0) {
-      core.debug(`Unsetting HOME override`)
+      core.debug(`Unsetting HOME and GIT_CONFIG_GLOBAL overrides`)
       this.git.removeEnvironmentVariable('HOME')
+      this.git.removeEnvironmentVariable('GIT_CONFIG_GLOBAL')
       await io.rmRF(this.temporaryHomePath)
     }
   }

src/git-command-manager.ts

@@ -510,7 +510,7 @@ class GitCommandManager {
     } else {
       args.push(globalConfig ? '--global' : '--local')
     }
-    args.push('--unset', configKey, configValue)
+    args.push('--unset', configKey, regexpHelper.escape(configValue))
 
     const output = await this.execGit(args, true)
     return output.exitCode === 0