Merge d03156b5b8 into f548e57e54

* Consolidate dependency updates in CHANGELOG

Removed specific dependency updates and consolidated them into a single entry.

* Fix capitalization in v7.0.1 changelog entries

Updated changelog entries for v7.0.1 to use consistent capitalization.

CHANGELOG.md

@@ -1,26 +1,14 @@
 # Changelog
 
 ## v7.0.1
-* Bump github/codeql-action from 3 to 4 by @dependabot[bot] in https://github.com/actions/checkout/pull/2475
+* Skip running unsafe pr check if input is default by @aiqiaoy in https://github.com/actions/checkout/pull/2518
-* Bump actions/setup-node from 4 to 6 by @dependabot[bot] in https://github.com/actions/checkout/pull/2477
+* Trim only ascii whitespace for branch by @aiqiaoy in https://github.com/actions/checkout/pull/2521
-* Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2478
+* Escape values passed to --unset by @aiqiaoy in https://github.com/actions/checkout/pull/2530
-* Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2479
+* Various dependency updates
-* Bump actions/checkout from 6 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2488
-* Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2476
-* eslint 9 by @dependabot[bot] in https://github.com/actions/checkout/pull/2474
-* Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2499
-* skip running unsafe pr check if input is default by @aiqiaoy in https://github.com/actions/checkout/pull/2518
-* trim only ascii whitespace for branch by @aiqiaoy in https://github.com/actions/checkout/pull/2521
-* escape values passed to --unset by @aiqiaoy in https://github.com/actions/checkout/pull/2530
 
 ## v7.0.0
 * Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in https://github.com/actions/checkout/pull/2454
-* Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in https://github.com/actions/checkout/pull/2458
+* Various dependency updates 
-* Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in https://github.com/actions/checkout/pull/2460
-* Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2461
-* Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in https://github.com/actions/checkout/pull/2459
-* upgrade module to esm and update dependencies by @aiqiaoy in https://github.com/actions/checkout/pull/2463
-* Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2462
 
 ## v6.0.3
 * Fix checkout init for SHA-256 repositories by @yaananth in https://github.com/actions/checkout/pull/2439

README.md

@@ -75,6 +75,9 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
     # with the local git config, which enables your scripts to run authenticated git
     # commands. The post-job step removes the PAT.
     #
+    # If any of the submodules are private GitHub repos, pass in a PAT with read-access 
+    # to them. 
+    #
     # We recommend using a service account with the least permissions necessary. Also
     # when generating a new PAT, select the least scopes necessary.
     #
@@ -152,8 +155,8 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
     # Whether to checkout submodules: `true` to checkout submodules or `recursive` to
     # recursively checkout submodules.
     #
-    # When the `ssh-key` input is not provided, SSH URLs beginning with
+    # When neither the `ssh-key` nor the `token` inputs are provided, SSH URLs 
-    # `git@github.com:` are converted to HTTPS.
+    # beginning with `git@github.com:` are converted to HTTPS. 
     #
     # Default: false
     submodules: ''
@@ -300,12 +303,19 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
   uses: actions/checkout@v7
   with:
     repository: my-org/my-private-tools
-    token: ${{ secrets.GH_PAT }} # `GH_PAT` is a secret that contains your PAT
+    token: ${{ secrets.GH_PAT }}  # `GH_PAT` is a secret that contains a PAT with read-access to this private repository
     path: my-tools
 ```
 
-> - `${{ github.token }}` is scoped to the current repository, so if you want to checkout a different repository that is private you will need to provide your own [PAT](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line).
+## Checkout a repo and its private submodules
 
+```yaml
+- name: Checkout
+  uses: actions/checkout@v2
+  with:
+    submodules: true
+    token: ${{ secrets.GH_PAT }} # `GH_PAT` is a secret that contains a PAT with read-access to the private submodules
+```
 
 ## Checkout pull request HEAD commit instead of merge commit