From 12cd2235efa0937479335606d7c3ac9f6c0973b1 Mon Sep 17 00:00:00 2001 From: Aiqiao Yan <55104035+aiqiaoy@users.noreply.github.com> Date: Wed, 15 Jul 2026 15:05:42 -0400 Subject: [PATCH 1/4] trim only ascii whitespace for branch (#2521) * trim only ascii whitespace for branch * rebuild --- __test__/input-helper.test.ts | 47 ++++++++++++++++++++++++++++++++--- dist/index.js | 20 +++++++++++++-- src/input-helper.ts | 21 ++++++++++++++-- 3 files changed, 80 insertions(+), 8 deletions(-) diff --git a/__test__/input-helper.test.ts b/__test__/input-helper.test.ts index 27b023c..afe30fb 100644 --- a/__test__/input-helper.test.ts +++ b/__test__/input-helper.test.ts @@ -24,9 +24,20 @@ const mockGithubContext: any = { payload: {} } +// Replicate @actions/core getInput behavior: it trims whitespace by default +// (String.prototype.trim(), which strips characters such as a leading U+FEFF BOM) +// unless trimWhitespace is explicitly set to false. +const getInputImpl = (name: string, options?: {trimWhitespace?: boolean}) => { + const val = inputs[name] ?? '' + if (options && options.trimWhitespace === false) { + return val + } + return typeof val === 'string' ? val.trim() : val +} + // Mock @actions/core before loading input-helper jest.unstable_mockModule('@actions/core', () => ({ - getInput: jest.fn((name: string) => inputs[name]), + getInput: jest.fn(getInputImpl), getBooleanInput: jest.fn((name: string) => inputs[name]), getMultilineInput: jest.fn((name: string) => inputs[name] ? String(inputs[name]).split('\n').filter(Boolean) : [] @@ -76,9 +87,7 @@ describe('input-helper tests', () => { inputs = {} jest.clearAllMocks() // Re-apply default mocks - ;(core.getInput as jest.Mock).mockImplementation( - (name: string) => inputs[name] - ) + ;(core.getInput as jest.Mock).mockImplementation(getInputImpl as any) mockDirectoryExistsSync.mockImplementation( (p: string) => p === gitHubWorkspace ) @@ -176,6 +185,36 @@ describe('input-helper tests', () => { expect(settings.commit).toBeFalsy() }) + it('does not reclassify a ref as sha when a BOM is prefixed', async () => { + // A fork branch named "" + 40 hex chars. core.getInput trims the + // BOM by default, which previously collapsed this into a bare SHA and + // bypassed the unsafe fork PR checkout guard. + inputs.ref = '\uFEFF522d932fae5296da51fdf431934425ecf891c6a2' + const settings: IGitSourceSettings = await inputHelper.getInputs() + expect(settings.commit).toBeFalsy() + expect(settings.ref).toBe('522d932fae5296da51fdf431934425ecf891c6a2') + }) + + it('does not reclassify a sha-256 ref as sha when a BOM is prefixed', async () => { + inputs.ref = + '\uFEFF1111111111222222222233333333334444444444555555555566666666667777' + const settings: IGitSourceSettings = await inputHelper.getInputs() + expect(settings.commit).toBeFalsy() + expect(settings.ref).toBe( + '1111111111222222222233333333334444444444555555555566666666667777' + ) + }) + + it('treats a sha surrounded by ascii whitespace as a commit', async () => { + // ASCII whitespace can only come from the workflow author's YAML (git ref + // names cannot contain it), so trimming it and treating the value as a + // commit is safe. + inputs.ref = ' 1111111111222222222233333333334444444444 ' + const settings: IGitSourceSettings = await inputHelper.getInputs() + expect(settings.ref).toBeFalsy() + expect(settings.commit).toBe('1111111111222222222233333333334444444444') + }) + it('sets workflow organization ID', async () => { const settings: IGitSourceSettings = await inputHelper.getInputs() expect(settings.workflowOrganizationId).toBe(123456) diff --git a/dist/index.js b/dist/index.js index cc25215..b319687 100644 --- a/dist/index.js +++ b/dist/index.js @@ -42100,6 +42100,22 @@ async function getInputs() { `${github_context.repo.owner}/${github_context.repo.repo}`.toUpperCase(); // Source branch, source version result.ref = getInput('ref'); + // core.getInput()'s default trim strips a range of Unicode characters such as a + // leading BOM (U+FEFF) or NBSP (U+00A0). Those are valid in a git ref name, so + // a fork branch named "" + 40 hex chars would trim down to a bare SHA and + // be silently reclassified as a commit, bypassing the unsafe fork PR checkout + // guard. + // + // The trim below strips only the ASCII whitespace characters which are all forbidden + // in a git branch name. + // \t U+0009 horizontal tab - ASCII control, forbidden in ref names + // \n U+000A line feed - ASCII control, forbidden in ref names + // \v U+000B vertical tab - ASCII control, forbidden in ref names + // \f U+000C form feed - ASCII control, forbidden in ref names + // \r U+000D carriage return - ASCII control, forbidden in ref names + // ' ' U+0020 space - forbidden in ref names + const asciiTrimmedRef = getInput('ref', { trimWhitespace: false }) + .replace(/^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g, ''); if (!result.ref) { if (isWorkflowRepository) { result.ref = github_context.ref; @@ -42112,8 +42128,8 @@ async function getInputs() { } } // SHA? - else if (result.ref.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) { - result.commit = result.ref; + else if (asciiTrimmedRef.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) { + result.commit = asciiTrimmedRef; result.ref = ''; } core_debug(`ref = '${result.ref}'`); diff --git a/src/input-helper.ts b/src/input-helper.ts index 87b2800..9a98b86 100644 --- a/src/input-helper.ts +++ b/src/input-helper.ts @@ -59,6 +59,23 @@ export async function getInputs(): Promise { // Source branch, source version result.ref = core.getInput('ref') + // core.getInput()'s default trim strips a range of Unicode characters such as a + // leading BOM (U+FEFF) or NBSP (U+00A0). Those are valid in a git ref name, so + // a fork branch named "" + 40 hex chars would trim down to a bare SHA and + // be silently reclassified as a commit, bypassing the unsafe fork PR checkout + // guard. + // + // The trim below strips only the ASCII whitespace characters which are all forbidden + // in a git branch name. + // \t U+0009 horizontal tab - ASCII control, forbidden in ref names + // \n U+000A line feed - ASCII control, forbidden in ref names + // \v U+000B vertical tab - ASCII control, forbidden in ref names + // \f U+000C form feed - ASCII control, forbidden in ref names + // \r U+000D carriage return - ASCII control, forbidden in ref names + // ' ' U+0020 space - forbidden in ref names + const asciiTrimmedRef = core + .getInput('ref', {trimWhitespace: false}) + .replace(/^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g, '') if (!result.ref) { if (isWorkflowRepository) { result.ref = github.context.ref @@ -72,8 +89,8 @@ export async function getInputs(): Promise { } } // SHA? - else if (result.ref.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) { - result.commit = result.ref + else if (asciiTrimmedRef.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) { + result.commit = asciiTrimmedRef result.ref = '' } core.debug(`ref = '${result.ref}'`) From 28802689a136bfcdb721715abd713740beecbe07 Mon Sep 17 00:00:00 2001 From: Aiqiao Yan <55104035+aiqiaoy@users.noreply.github.com> Date: Fri, 17 Jul 2026 13:44:40 -0400 Subject: [PATCH 2/4] escape values passed to --unset (#2530) --- dist/index.js | 2 +- src/git-command-manager.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dist/index.js b/dist/index.js index b319687..06ae5d2 100644 --- a/dist/index.js +++ b/dist/index.js @@ -35913,7 +35913,7 @@ class GitCommandManager { else { args.push(globalConfig ? '--global' : '--local'); } - args.push('--unset', configKey, configValue); + args.push('--unset', configKey, regexp_helper_escape(configValue)); const output = await this.execGit(args, true); return output.exitCode === 0; } diff --git a/src/git-command-manager.ts b/src/git-command-manager.ts index 36cdb47..8431658 100644 --- a/src/git-command-manager.ts +++ b/src/git-command-manager.ts @@ -510,7 +510,7 @@ class GitCommandManager { } else { args.push(globalConfig ? '--global' : '--local') } - args.push('--unset', configKey, configValue) + args.push('--unset', configKey, regexpHelper.escape(configValue)) const output = await this.execGit(args, true) return output.exitCode === 0 From 3d3c42e5aac5ba805825da76410c181273ba90b1 Mon Sep 17 00:00:00 2001 From: Aiqiao Yan <55104035+aiqiaoy@users.noreply.github.com> Date: Fri, 17 Jul 2026 14:45:11 -0400 Subject: [PATCH 3/4] prep v7.0.1 release (#2531) * prep v7.0.1 release * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- CHANGELOG.md | 13 +++++++++++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 16 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8ea6e60..0340316 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,18 @@ # Changelog +## v7.0.1 +* Bump github/codeql-action from 3 to 4 by @dependabot[bot] in https://github.com/actions/checkout/pull/2475 +* Bump actions/setup-node from 4 to 6 by @dependabot[bot] in https://github.com/actions/checkout/pull/2477 +* Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2478 +* Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2479 +* Bump actions/checkout from 6 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2488 +* Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2476 +* eslint 9 by @dependabot[bot] in https://github.com/actions/checkout/pull/2474 +* Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2499 +* skip running unsafe pr check if input is default by @aiqiaoy in https://github.com/actions/checkout/pull/2518 +* trim only ascii whitespace for branch by @aiqiaoy in https://github.com/actions/checkout/pull/2521 +* escape values passed to --unset by @aiqiaoy in https://github.com/actions/checkout/pull/2530 + ## v7.0.0 * Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in https://github.com/actions/checkout/pull/2454 * Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in https://github.com/actions/checkout/pull/2458 diff --git a/package-lock.json b/package-lock.json index 09a72c4..faf0e22 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "checkout", - "version": "7.0.0", + "version": "7.0.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "checkout", - "version": "7.0.0", + "version": "7.0.1", "license": "MIT", "dependencies": { "@actions/core": "^3.0.1", diff --git a/package.json b/package.json index 4a38df9..9b02e96 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "checkout", - "version": "7.0.0", + "version": "7.0.1", "description": "checkout action", "type": "module", "main": "lib/main.js", From f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a Mon Sep 17 00:00:00 2001 From: Aiqiao Yan <55104035+aiqiaoy@users.noreply.github.com> Date: Mon, 20 Jul 2026 12:20:47 -0400 Subject: [PATCH 4/4] Consolidate dependency updates in CHANGELOG (#2537) * Consolidate dependency updates in CHANGELOG Removed specific dependency updates and consolidated them into a single entry. * Fix capitalization in v7.0.1 changelog entries Updated changelog entries for v7.0.1 to use consistent capitalization. --- CHANGELOG.md | 22 +++++----------------- 1 file changed, 5 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0340316..0f0f00f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,26 +1,14 @@ # Changelog ## v7.0.1 -* Bump github/codeql-action from 3 to 4 by @dependabot[bot] in https://github.com/actions/checkout/pull/2475 -* Bump actions/setup-node from 4 to 6 by @dependabot[bot] in https://github.com/actions/checkout/pull/2477 -* Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2478 -* Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2479 -* Bump actions/checkout from 6 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2488 -* Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/actions/checkout/pull/2476 -* eslint 9 by @dependabot[bot] in https://github.com/actions/checkout/pull/2474 -* Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2499 -* skip running unsafe pr check if input is default by @aiqiaoy in https://github.com/actions/checkout/pull/2518 -* trim only ascii whitespace for branch by @aiqiaoy in https://github.com/actions/checkout/pull/2521 -* escape values passed to --unset by @aiqiaoy in https://github.com/actions/checkout/pull/2530 +* Skip running unsafe pr check if input is default by @aiqiaoy in https://github.com/actions/checkout/pull/2518 +* Trim only ascii whitespace for branch by @aiqiaoy in https://github.com/actions/checkout/pull/2521 +* Escape values passed to --unset by @aiqiaoy in https://github.com/actions/checkout/pull/2530 +* Various dependency updates ## v7.0.0 * Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in https://github.com/actions/checkout/pull/2454 -* Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in https://github.com/actions/checkout/pull/2458 -* Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in https://github.com/actions/checkout/pull/2460 -* Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2461 -* Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in https://github.com/actions/checkout/pull/2459 -* upgrade module to esm and update dependencies by @aiqiaoy in https://github.com/actions/checkout/pull/2463 -* Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2462 +* Various dependency updates ## v6.0.3 * Fix checkout init for SHA-256 repositories by @yaananth in https://github.com/actions/checkout/pull/2439