Merge 227ee32e4d into 3d3c42e5aa

* prep v7.0.1 release

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## v7.0.1
+* Bump github/codeql-action from 3 to 4 by @dependabot[bot] in https://github.com/actions/checkout/pull/2475
+* Bump actions/setup-node from 4 to 6 by @dependabot[bot] in https://github.com/actions/checkout/pull/2477
+* Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2478
+* Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2479
+* Bump actions/checkout from 6 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2488
+* Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2476
+* eslint 9 by @dependabot[bot] in https://github.com/actions/checkout/pull/2474
+* Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2499
+* skip running unsafe pr check if input is default by @aiqiaoy in https://github.com/actions/checkout/pull/2518
+* trim only ascii whitespace for branch by @aiqiaoy in https://github.com/actions/checkout/pull/2521
+* escape values passed to --unset by @aiqiaoy in https://github.com/actions/checkout/pull/2530
+
 ## v7.0.0
 * Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in https://github.com/actions/checkout/pull/2454
 * Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in https://github.com/actions/checkout/pull/2458

__test__/git-auth-helper.test.ts

@@ -995,6 +995,91 @@ describe('git-auth-helper tests', () => {
     ).toBe(false)
     expect((authHelper as any).testCredentialsConfigPath('')).toBe(false)
   })
+
+  const configureAuth_uses_default_git_user_when_sshUser_empty =
+    'configureAuth uses default git user when sshUser is empty'
+  it(configureAuth_uses_default_git_user_when_sshUser_empty, async () => {
+    // Arrange
+    await setup(configureAuth_uses_default_git_user_when_sshUser_empty)
+    settings.sshUser = ''
+    settings.sshKey = ''
+    const authHelper = gitAuthHelper.createAuthHelper(git, settings)
+
+    // Act
+    await authHelper.configureAuth()
+    await authHelper.configureGlobalAuth()
+
+    // Assert - verify that git@github.com is in the insteadOf config
+    const home = git.env['HOME'] || tempHomedir
+    const configContent = (
+      await fs.promises.readFile(path.join(home, '.gitconfig'))
+    ).toString()
+    expect(configContent.indexOf('url.https://github.com/.insteadOf git@github.com')).toBeGreaterThanOrEqual(0)
+  })
+
+  const configureAuth_uses_custom_ssh_user_when_sshUser_provided =
+    'configureAuth uses custom SSH user when sshUser is provided'
+  it(configureAuth_uses_custom_ssh_user_when_sshUser_provided, async () => {
+    // Arrange
+    await setup(configureAuth_uses_custom_ssh_user_when_sshUser_provided)
+    settings.sshUser = 'customuser'
+    settings.sshKey = ''
+    const authHelper = gitAuthHelper.createAuthHelper(git, settings)
+
+    // Act
+    await authHelper.configureAuth()
+    await authHelper.configureGlobalAuth()
+
+    // Assert - verify that customuser@github.com is in the insteadOf config
+    const home = git.env['HOME'] || tempHomedir
+    const configContent = (
+      await fs.promises.readFile(path.join(home, '.gitconfig'))
+    ).toString()
+    expect(configContent.indexOf('url.https://github.com/.insteadOf customuser@github.com')).toBeGreaterThanOrEqual(0)
+  })
+
+  const configureGlobalAuth_with_custom_sshUser =
+    'configureGlobalAuth with custom sshUser'
+  it(configureGlobalAuth_with_custom_sshUser, async () => {
+    // Arrange
+    await setup(configureGlobalAuth_with_custom_sshUser)
+    settings.sshUser = 'admin'
+    settings.sshKey = ''
+    const authHelper = gitAuthHelper.createAuthHelper(git, settings)
+
+    // Act
+    await authHelper.configureAuth()
+    await authHelper.configureGlobalAuth()
+
+    // Assert - verify the .insteadOf config contains the custom user
+    const home = git.env['HOME'] || tempHomedir
+    const configContent = (
+      await fs.promises.readFile(path.join(home, '.gitconfig'))
+    ).toString()
+    expect(configContent.indexOf('url.https://github.com/.insteadOf admin@github.com')).toBeGreaterThanOrEqual(0)
+  })
+
+  const configureSubmoduleAuth_with_custom_sshUser =
+    'configureSubmoduleAuth with custom sshUser'
+  it(configureSubmoduleAuth_with_custom_sshUser, async () => {
+    // Arrange
+    await setup(configureSubmoduleAuth_with_custom_sshUser)
+    settings.sshUser = 'deploy'
+    settings.sshKey = ''
+    const authHelper = gitAuthHelper.createAuthHelper(git, settings)
+    await authHelper.configureAuth()
+    const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any>
+    mockSubmoduleForeach.mockClear()
+
+    // Act
+    await authHelper.configureSubmoduleAuth()
+
+    // Assert - verify the insteadOf config uses the custom user
+    expect(mockSubmoduleForeach).toHaveBeenCalledTimes(3)
+    expect(mockSubmoduleForeach.mock.calls[1][0]).toMatch(
+      /url.*insteadOf.*deploy@github.com:/
+    )
+  })
 })
 
 async function setup(testName: string): Promise<void> {

dist/index.js

@@ -35063,7 +35063,10 @@ class GitAuthHelper {
         this.tokenConfigValue = `AUTHORIZATION: basic ${basicCredential}`;
         // Instead of SSH URL
         this.insteadOfKey = `url.${serverUrl.origin}/.insteadOf`; // "origin" is SCHEME://HOSTNAME[:PORT]
-        this.insteadOfValues.push(`git@${serverUrl.hostname}:`);
+        const sshUser = this.settings.sshUser && this.settings.sshUser.length > 0
+            ? this.settings.sshUser
+            : 'git';
+        this.insteadOfValues.push(`${sshUser}@${serverUrl.hostname}:`);
         if (this.settings.workflowOrganizationId) {
             this.insteadOfValues.push(`org-${this.settings.workflowOrganizationId}@github.com:`);
         }
@@ -35913,7 +35916,7 @@ class GitCommandManager {
         else {
             args.push(globalConfig ? '--global' : '--local');
         }
-        args.push('--unset', configKey, configValue);
+        args.push('--unset', configKey, regexp_helper_escape(configValue));
         const output = await this.execGit(args, true);
         return output.exitCode === 0;
     }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "checkout",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "checkout",
-      "version": "7.0.0",
+      "version": "7.0.1",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^3.0.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "checkout",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "description": "checkout action",
   "type": "module",
   "main": "lib/main.js",

src/git-auth-helper.ts

@@ -65,7 +65,11 @@ class GitAuthHelper {
 
     // Instead of SSH URL
     this.insteadOfKey = `url.${serverUrl.origin}/.insteadOf` // "origin" is SCHEME://HOSTNAME[:PORT]
-    this.insteadOfValues.push(`git@${serverUrl.hostname}:`)
+    const sshUser =
+      this.settings.sshUser && this.settings.sshUser.length > 0
+        ? this.settings.sshUser
+        : 'git'
+    this.insteadOfValues.push(`${sshUser}@${serverUrl.hostname}:`)
     if (this.settings.workflowOrganizationId) {
       this.insteadOfValues.push(
         `org-${this.settings.workflowOrganizationId}@github.com:`

src/git-command-manager.ts

@@ -510,7 +510,7 @@ class GitCommandManager {
     } else {
       args.push(globalConfig ? '--global' : '--local')
     }
-    args.push('--unset', configKey, configValue)
+    args.push('--unset', configKey, regexpHelper.escape(configValue))
 
     const output = await this.execGit(args, true)
     return output.exitCode === 0