Merge b23eb344e8 into e8d4307400

Bumps the minor-actions-dependencies group with 2 updates: [docker/login-action](https://github.com/docker/login-action) and [docker/build-push-action](https://github.com/docker/build-push-action).


Updates `docker/login-action` from 4.2.0 to 4.4.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v4.2.0...v4.4.0)

Updates `docker/build-push-action` from 7.2.0 to 7.3.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v7.2.0...v7.3.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-actions-dependencies
- dependency-name: docker/build-push-action
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.eslintignore

@@ -1,3 +0,0 @@
-dist/
-lib/
-node_modules/

.eslintrc.json

@@ -1,53 +0,0 @@
-{
-  "plugins": ["jest", "@typescript-eslint"],
-  "extends": ["plugin:github/recommended"],
-  "parser": "@typescript-eslint/parser",
-  "parserOptions": {
-    "ecmaVersion": 9,
-    "sourceType": "module",
-    "project": "./tsconfig.json"
-  },
-  "rules": {
-    "eslint-comments/no-use": "off",
-    "import/no-namespace": "off",
-    "no-unused-vars": "off",
-    "@typescript-eslint/no-unused-vars": "error",
-    "@typescript-eslint/explicit-member-accessibility": ["error", {"accessibility": "no-public"}],
-    "@typescript-eslint/no-require-imports": "error",
-    "@typescript-eslint/array-type": "error",
-    "@typescript-eslint/await-thenable": "error",
-    "camelcase": "off",
-    "@typescript-eslint/explicit-function-return-type": ["error", {"allowExpressions": true}],
-    "@typescript-eslint/func-call-spacing": ["error", "never"],
-    "@typescript-eslint/no-array-constructor": "error",
-    "@typescript-eslint/no-empty-interface": "error",
-    "@typescript-eslint/no-explicit-any": "error",
-    "@typescript-eslint/no-extraneous-class": "error",
-    "@typescript-eslint/no-floating-promises": "error",
-    "@typescript-eslint/no-for-in-array": "error",
-    "@typescript-eslint/no-inferrable-types": "error",
-    "@typescript-eslint/no-misused-new": "error",
-    "@typescript-eslint/no-namespace": "error",
-    "@typescript-eslint/no-non-null-assertion": "warn",
-    "@typescript-eslint/no-unnecessary-qualifier": "error",
-    "@typescript-eslint/no-unnecessary-type-assertion": "error",
-    "@typescript-eslint/no-useless-constructor": "error",
-    "@typescript-eslint/no-var-requires": "error",
-    "@typescript-eslint/prefer-for-of": "warn",
-    "@typescript-eslint/prefer-function-type": "warn",
-    "@typescript-eslint/prefer-includes": "error",
-    "@typescript-eslint/prefer-string-starts-ends-with": "error",
-    "@typescript-eslint/promise-function-async": "error",
-    "@typescript-eslint/require-array-sort-compare": "error",
-    "@typescript-eslint/restrict-plus-operands": "error",
-    "semi": "off",
-    "@typescript-eslint/semi": ["error", "never"],
-    "@typescript-eslint/type-annotation-spacing": "error",
-    "@typescript-eslint/unbound-method": "error"
-  },
-  "env": {
-    "node": true,
-    "es6": true,
-    "jest/globals": true
-  }
-}

.github/workflows/test.yml

@@ -314,7 +314,6 @@ jobs:
           fi
 
           # Verify auth token
-          git config --global --add safe.directory "*"
           git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
 
       # needed to make checkout post cleanup succeed

.github/workflows/update-test-ubuntu-git.yml

@@ -31,7 +31,7 @@ jobs:
       # Use `docker/login-action` to log in to GHCR.io. 
       # Once published, the packages are scoped to the account defined here.
       - name: Log in to the ghcr.io container registry
-        uses: docker/login-action@v4.2.0
+        uses: docker/login-action@v4.4.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -48,7 +48,7 @@ jobs:
 
       # Use `docker/build-push-action` to build (and optionally publish) the image. 
       - name: Build Docker Image (with optional Push)
-        uses: docker/build-push-action@v7.2.0
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           file: images/test-ubuntu-git.Dockerfile

__test__/verify-worktree.sh

@@ -15,9 +15,6 @@ fi
 
 cd "$CHECKOUT_PATH"
 
-# Add safe directory for container environments
-git config --global --add safe.directory "*" 2>/dev/null || true
-
 # Show the includeIf configuration
 echo "Git config includeIf entries:"
 git config --list --show-origin | grep -i include || true

eslint.config.mjs

@@ -0,0 +1,62 @@
+import github from 'eslint-plugin-github'
+import jest from 'eslint-plugin-jest'
+
+const githubConfigs = github.getFlatConfigs()
+
+export default [
+  {
+    ignores: ['**/node_modules/**', '**/lib/**', '**/dist/**']
+  },
+  githubConfigs.recommended,
+  ...githubConfigs.typescript,
+  {
+    files: ['**/*.ts'],
+    languageOptions: {
+      parserOptions: {
+        project: './tsconfig.json'
+      }
+    },
+    rules: {
+      'eslint-comments/no-use': 'off',
+      'import/no-namespace': 'off',
+      'no-unused-vars': 'off',
+      '@typescript-eslint/no-unused-vars': 'error',
+      '@typescript-eslint/explicit-member-accessibility': [
+        'error',
+        {accessibility: 'no-public'}
+      ],
+      '@typescript-eslint/no-require-imports': 'error',
+      '@typescript-eslint/array-type': 'error',
+      '@typescript-eslint/await-thenable': 'error',
+      camelcase: 'off',
+      '@typescript-eslint/explicit-function-return-type': [
+        'error',
+        {allowExpressions: true}
+      ],
+      '@typescript-eslint/no-array-constructor': 'error',
+      '@typescript-eslint/no-explicit-any': 'error',
+      '@typescript-eslint/no-extraneous-class': 'error',
+      '@typescript-eslint/no-floating-promises': 'error',
+      '@typescript-eslint/no-for-in-array': 'error',
+      '@typescript-eslint/no-inferrable-types': 'error',
+      '@typescript-eslint/no-misused-new': 'error',
+      '@typescript-eslint/no-namespace': 'error',
+      '@typescript-eslint/no-non-null-assertion': 'warn',
+      '@typescript-eslint/no-unnecessary-qualifier': 'error',
+      '@typescript-eslint/no-unnecessary-type-assertion': 'error',
+      '@typescript-eslint/no-useless-constructor': 'error',
+      '@typescript-eslint/prefer-for-of': 'warn',
+      '@typescript-eslint/prefer-function-type': 'warn',
+      '@typescript-eslint/prefer-includes': 'error',
+      '@typescript-eslint/prefer-string-starts-ends-with': 'error',
+      '@typescript-eslint/promise-function-async': 'error',
+      '@typescript-eslint/require-array-sort-compare': 'error',
+      '@typescript-eslint/restrict-plus-operands': 'error',
+      '@typescript-eslint/unbound-method': 'error'
+    }
+  },
+  {
+    files: ['__test__/**/*.ts'],
+    ...jest.configs['flat/recommended']
+  }
+]

package.json

@@ -41,12 +41,12 @@
   "devDependencies": {
     "@types/jest": "^29.5.12",
     "@types/node": "^24.1.0",
-    "@typescript-eslint/eslint-plugin": "^7.9.0",
+    "@typescript-eslint/eslint-plugin": "^8.54.0",
-    "@typescript-eslint/parser": "^7.9.0",
+    "@typescript-eslint/parser": "^8.54.0",
     "@vercel/ncc": "^0.44.0",
-    "eslint": "^8.57.0",
+    "eslint": "^9.39.2",
-    "eslint-plugin-github": "^4.10.2",
+    "eslint-plugin-github": "^6.0.0",
-    "eslint-plugin-jest": "^28.8.2",
+    "eslint-plugin-jest": "^29.12.1",
     "jest": "^29.7.0",
     "js-yaml": "^4.2.0",
     "prettier": "^3.8.4",

src/git-source-provider.ts

@@ -44,20 +44,14 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
     if (git) {
       authHelper = gitAuthHelper.createAuthHelper(git, settings)
       if (settings.setSafeDirectory) {
-        // Setup the repository path as a safe directory, so if we pass this into a container job with a different user it doesn't fail
+        await addSafeDirectory(settings.repositoryPath, git, authHelper)
-        // Otherwise all git commands we run in a container fail
+        const containerPath = getContainerRepositoryPath(
-        await authHelper.configureTempGlobalConfig()
+          settings.repositoryPath,
-        core.info(
+          settings.githubWorkspacePath
-          `Adding repository directory to the temporary git global config as a safe directory`
         )
-
+        if (containerPath && containerPath !== settings.repositoryPath) {
-        await git
+          await addSafeDirectory(containerPath, git, authHelper)
-          .config('safe.directory', settings.repositoryPath, true, true)
+        }
-          .catch(error => {
-            core.info(
-              `Failed to initialize safe directory with error: ${error}`
-            )
-          })
 
         stateHelper.setSafeDirectory()
       }
@@ -350,18 +344,7 @@ export async function cleanup(repositoryPath: string): Promise<void> {
   const authHelper = gitAuthHelper.createAuthHelper(git)
   try {
     if (stateHelper.PostSetSafeDirectory) {
-      // Setup the repository path as a safe directory, so if we pass this into a container job with a different user it doesn't fail
+      await addSafeDirectory(repositoryPath, git, authHelper)
-      // Otherwise all git commands we run in a container fail
-      await authHelper.configureTempGlobalConfig()
-      core.info(
-        `Adding repository directory to the temporary git global config as a safe directory`
-      )
-
-      await git
-        .config('safe.directory', repositoryPath, true, true)
-        .catch(error => {
-          core.info(`Failed to initialize safe directory with error: ${error}`)
-        })
     }
 
     await authHelper.removeAuth()
@@ -390,3 +373,39 @@ async function getGitCommandManager(
     return undefined
   }
 }
+
+async function addSafeDirectory(
+  safeDirectory: string,
+  git: IGitCommandManager,
+  authHelper: gitAuthHelper.IGitAuthHelper
+): Promise<void> {
+  await authHelper.configureTempGlobalConfig()
+  core.info(`Adding '${safeDirectory}' to the git global config as a safe directory`)
+  await git.config('safe.directory', safeDirectory, true, true).catch(error => {
+    core.info(`Failed to initialize safe directory with error: ${error}`)
+  })
+}
+
+function getContainerRepositoryPath(
+  repositoryPath: string,
+  githubWorkspace?: string
+): string {
+  if (!githubWorkspace) {
+    return ''
+  }
+
+  let relativeRepositoryPath = path.relative(githubWorkspace, repositoryPath)
+  if (!relativeRepositoryPath || relativeRepositoryPath === '.') {
+    return '/github/workspace'
+  }
+
+  if (
+    relativeRepositoryPath.startsWith('..') ||
+    path.isAbsolute(relativeRepositoryPath)
+  ) {
+    return ''
+  }
+
+  relativeRepositoryPath = relativeRepositoryPath.replace(/\\/g, '/')
+  return path.posix.join('/github/workspace', relativeRepositoryPath)
+}

src/git-source-settings.ts

@@ -1,4 +1,9 @@
 export interface IGitSourceSettings {
+  /**
+   * The workflow workspace path
+   */
+  githubWorkspacePath?: string
+
   /**
    * The location on disk where the repository will be placed
    */

src/input-helper.ts

@@ -15,6 +15,7 @@ export async function getInputs(): Promise<IGitSourceSettings> {
     throw new Error('GITHUB_WORKSPACE not defined')
   }
   githubWorkspacePath = path.resolve(githubWorkspacePath)
+  result.githubWorkspacePath = githubWorkspacePath
   core.debug(`GITHUB_WORKSPACE = '${githubWorkspacePath}'`)
   fsHelper.directoryExistsSync(githubWorkspacePath, true)