skip running unsafe pr check if input is default (backport #2518 to releases/v4)

backport allow-unsafe-pr-checkout to v4 (#2502 )
* block checking out fork pr for pull_request_target and workflow_run (#2454) * block checking out fork pr for some events * address copilot and reviewer feedback * run prettier formatting * build * update urls * update readme * update description and url again * edit url one more time * update error wording (#2467)
2026-07-17 20:04:26 +02:00 · 2026-07-15 14:55:26 +00:00 · 2026-07-07 16:34:51 -04:00 · 2025-11-13 17:20:02 -06:00
12 changed files with 54 additions and 136 deletions
@@ -24,10 +24,10 @@ jobs:
    steps:
      - uses: actions/checkout@v4.1.6

-      - name: Set Node.js 24.x
+      - name: Set Node.js 20.x
        uses: actions/setup-node@v4
        with:
-          node-version: 24.x
+          node-version: 20.x

      - name: Install dependencies
        run: npm ci
@@ -18,7 +18,7 @@ jobs:
    steps:
      - uses: actions/setup-node@v4
        with:
-          node-version: 24.x
+          node-version: 20.x
      - uses: actions/checkout@v4.1.6
      - run: npm ci
      - run: npm run build
@@ -11,7 +11,6 @@ on:
        type: choice
        description: The major version to update
        options:
-          - v5
          - v4
          - v3
          - v2
@@ -1,9 +1,5 @@
 # Changelog

-## V5.0.0
-* Update actions checkout to use node 24 by @salmanmkc in https://github.com/actions/checkout/pull/2226
-
-
 ## V4.3.0
 * docs: update README.md by @motss in https://github.com/actions/checkout/pull/1971
 * Add internal repos for checking out multiple repositories by @mouismail in https://github.com/actions/checkout/pull/1977
@@ -1,9 +1,5 @@
 [![Build and Test](https://github.com/actions/checkout/actions/workflows/test.yml/badge.svg)](https://github.com/actions/checkout/actions/workflows/test.yml)

-# Checkout V5
-
-Checkout v5 now supports Node.js 24
-
 # Checkout V4

 This action checks-out your repository under `$GITHUB_WORKSPACE`, so your workflow can access it.
@@ -40,7 +36,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/

 <!-- start usage -->
 ```yaml
- uses: actions/checkout@v5
+- uses: actions/checkout@v4
  with:
    # Repository name with owner. For example, actions/checkout
    # Default: ${{ github.repository }}
@@ -162,32 +158,24 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/

 # Scenarios

- [Checkout V5](#checkout-v5)
- [Checkout V4](#checkout-v4)
-    - [Note](#note)
- [What's new](#whats-new)
- [Usage](#usage)
- [Scenarios](#scenarios)
-  - [Fetch only the root files](#fetch-only-the-root-files)
-  - [Fetch only the root files and `.github` and `src` folder](#fetch-only-the-root-files-and-github-and-src-folder)
-  - [Fetch only a single file](#fetch-only-a-single-file)
-  - [Fetch all history for all tags and branches](#fetch-all-history-for-all-tags-and-branches)
-  - [Checkout a different branch](#checkout-a-different-branch)
-  - [Checkout HEAD^](#checkout-head)
-  - [Checkout multiple repos (side by side)](#checkout-multiple-repos-side-by-side)
-  - [Checkout multiple repos (nested)](#checkout-multiple-repos-nested)
-  - [Checkout multiple repos (private)](#checkout-multiple-repos-private)
-  - [Checkout pull request HEAD commit instead of merge commit](#checkout-pull-request-head-commit-instead-of-merge-commit)
-  - [Checkout pull request on closed event](#checkout-pull-request-on-closed-event)
-  - [Push a commit using the built-in token](#push-a-commit-using-the-built-in-token)
-  - [Push a commit to a PR using the built-in token](#push-a-commit-to-a-pr-using-the-built-in-token)
- [Recommended permissions](#recommended-permissions)
- [License](#license)
+- [Fetch only the root files](#Fetch-only-the-root-files)
+- [Fetch only the root files and `.github` and `src` folder](#Fetch-only-the-root-files-and-github-and-src-folder)
+- [Fetch only a single file](#Fetch-only-a-single-file)
+- [Fetch all history for all tags and branches](#Fetch-all-history-for-all-tags-and-branches)
+- [Checkout a different branch](#Checkout-a-different-branch)
+- [Checkout HEAD^](#Checkout-HEAD)
+- [Checkout multiple repos (side by side)](#Checkout-multiple-repos-side-by-side)
+- [Checkout multiple repos (nested)](#Checkout-multiple-repos-nested)
+- [Checkout multiple repos (private)](#Checkout-multiple-repos-private)
+- [Checkout pull request HEAD commit instead of merge commit](#Checkout-pull-request-HEAD-commit-instead-of-merge-commit)
+- [Checkout pull request on closed event](#Checkout-pull-request-on-closed-event)
+- [Push a commit using the built-in token](#Push-a-commit-using-the-built-in-token)
+- [Push a commit to a PR using the built-in token](#Push-a-commit-to-a-PR-using-the-built-in-token)

 ## Fetch only the root files

 ```yaml
- uses: actions/checkout@v5
+- uses: actions/checkout@v4
  with:
    sparse-checkout: .
 ```
@@ -195,7 +183,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Fetch only the root files and `.github` and `src` folder

 ```yaml
- uses: actions/checkout@v5
+- uses: actions/checkout@v4
  with:
    sparse-checkout: |
      .github
@@ -205,7 +193,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Fetch only a single file

 ```yaml
- uses: actions/checkout@v5
+- uses: actions/checkout@v4
  with:
    sparse-checkout: |
      README.md
@@ -215,7 +203,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Fetch all history for all tags and branches

 ```yaml
- uses: actions/checkout@v5
+- uses: actions/checkout@v4
  with:
    fetch-depth: 0
 ```
@@ -223,7 +211,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Checkout a different branch

 ```yaml
- uses: actions/checkout@v5
+- uses: actions/checkout@v4
  with:
    ref: my-branch
 ```
@@ -231,7 +219,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Checkout HEAD^

 ```yaml
- uses: actions/checkout@v5
+- uses: actions/checkout@v4
  with:
    fetch-depth: 2
 - run: git checkout HEAD^
@@ -241,12 +229,12 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/

 ```yaml
 - name: Checkout
-  uses: actions/checkout@v5
+  uses: actions/checkout@v4
  with:
    path: main

 - name: Checkout tools repo
-  uses: actions/checkout@v5
+  uses: actions/checkout@v4
  with:
    repository: my-org/my-tools
    path: my-tools
@@ -257,10 +245,10 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/

 ```yaml
 - name: Checkout
-  uses: actions/checkout@v5
+  uses: actions/checkout@v4

 - name: Checkout tools repo
-  uses: actions/checkout@v5
+  uses: actions/checkout@v4
  with:
    repository: my-org/my-tools
    path: my-tools
@@ -271,12 +259,12 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/

 ```yaml
 - name: Checkout
-  uses: actions/checkout@v5
+  uses: actions/checkout@v4
  with:
    path: main

 - name: Checkout private tools
-  uses: actions/checkout@v5
+  uses: actions/checkout@v4
  with:
    repository: my-org/my-private-tools
    token: ${{ secrets.GH_PAT }} # `GH_PAT` is a secret that contains your PAT
@@ -289,7 +277,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Checkout pull request HEAD commit instead of merge commit

 ```yaml
- uses: actions/checkout@v5
+- uses: actions/checkout@v4
  with:
    ref: ${{ github.event.pull_request.head.sha }}
 ```
@@ -305,7 +293,7 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
 ```

 ## Push a commit using the built-in token
@@ -316,7 +304,7 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
      - run: |
          date > generated.txt
          # Note: the following account information will not work on GHES
@@ -338,7 +326,7 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}
      - run: |
@@ -12,24 +12,15 @@ const gitHubWorkspace = path.resolve('/checkout-tests/workspace')
 // Inputs for mock @actions/core
 let inputs = {} as any

-// Replicate @actions/core getInput behavior: it trims whitespace by default
-// (String.prototype.trim(), which strips characters such as a leading U+FEFF BOM)
-// unless trimWhitespace is explicitly set to false.
-const getInputImpl = (name: string, options?: {trimWhitespace?: boolean}) => {
-  const val = inputs[name] ?? ''
-  if (options && options.trimWhitespace === false) {
-    return val
-  }
-  return typeof val === 'string' ? val.trim() : val
-}
-
 // Shallow clone original @actions/github context
 let originalContext = {...github.context}

 describe('input-helper tests', () => {
  beforeAll(() => {
    // Mock getInput
-    jest.spyOn(core, 'getInput').mockImplementation(getInputImpl as any)
+    jest.spyOn(core, 'getInput').mockImplementation((name: string) => {
+      return inputs[name]
+    })

    // Mock error/warning/info/debug
    jest.spyOn(core, 'error').mockImplementation(jest.fn())
@@ -150,26 +141,6 @@ describe('input-helper tests', () => {
    expect(settings.commit).toBeFalsy()
  })

-  it('does not reclassify a ref as sha when a BOM is prefixed', async () => {
-    // A fork branch named "<U+FEFF>" + 40 hex chars. core.getInput trims the
-    // BOM by default, which previously collapsed this into a bare SHA and
-    // bypassed the unsafe fork PR checkout guard.
-    inputs.ref = '\uFEFF522d932fae5296da51fdf431934425ecf891c6a2'
-    const settings: IGitSourceSettings = await inputHelper.getInputs()
-    expect(settings.commit).toBeFalsy()
-    expect(settings.ref).toBe('522d932fae5296da51fdf431934425ecf891c6a2')
-  })
-
-  it('treats a sha surrounded by ascii whitespace as a commit', async () => {
-    // ASCII whitespace can only come from the workflow author's YAML (git ref
-    // names cannot contain it), so trimming it and treating the value as a
-    // commit is safe.
-    inputs.ref = '  1111111111222222222233333333334444444444  '
-    const settings: IGitSourceSettings = await inputHelper.getInputs()
-    expect(settings.ref).toBeFalsy()
-    expect(settings.commit).toBe('1111111111222222222233333333334444444444')
-  })
-
  it('sets workflow organization ID', async () => {
    const settings: IGitSourceSettings = await inputHelper.getInputs()
    expect(settings.workflowOrganizationId).toBe(123456)
@@ -190,7 +161,6 @@ describe('input-helper tests', () => {
    it('allows the default self-checkout on a fork pull_request_target', async () => {
      const originalEvent = github.context.eventName
      const originalPayload = github.context.payload
-      const originalSha = github.context.sha
      try {
        github.context.eventName = 'pull_request_target'
        github.context.payload = forkPayload as any
@@ -202,7 +172,6 @@ describe('input-helper tests', () => {
      } finally {
        github.context.eventName = originalEvent
        github.context.payload = originalPayload
-        github.context.sha = originalSha
      }
    })

@@ -113,6 +113,6 @@ outputs:
  commit:
    description: 'The commit SHA that was checked out'
 runs:
-  using: node24
+  using: node20
  main: dist/index.js
  post: dist/index.js
@@ -1895,23 +1895,6 @@ function getInputs() {
            `${github.context.repo.owner}/${github.context.repo.repo}`.toUpperCase();
        // Source branch, source version
        result.ref = core.getInput('ref');
-        // core.getInput()'s default trim strips a range of Unicode characters such as a
-        // leading BOM (U+FEFF) or NBSP (U+00A0). Those are valid in a git ref name, so
-        // a fork branch named "<BOM>" + 40 hex chars would trim down to a bare SHA and
-        // be silently reclassified as a commit, bypassing the unsafe fork PR checkout
-        // guard.
-        //
-        // The trim below strips only the ASCII whitespace characters which are all forbidden
-        // in a git branch name.
-        //   \t  U+0009  horizontal tab   - ASCII control, forbidden in ref names
-        //   \n  U+000A  line feed        - ASCII control, forbidden in ref names
-        //   \v  U+000B  vertical tab     - ASCII control, forbidden in ref names
-        //   \f  U+000C  form feed        - ASCII control, forbidden in ref names
-        //   \r  U+000D  carriage return  - ASCII control, forbidden in ref names
-        //   ' ' U+0020  space            - forbidden in ref names
-        const asciiTrimmedRef = core
-            .getInput('ref', { trimWhitespace: false })
-            .replace(/^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g, '');
        if (!result.ref) {
            if (isWorkflowRepository) {
                result.ref = github.context.ref;
@@ -1924,8 +1907,8 @@ function getInputs() {
            }
        }
        // SHA?
-        else if (asciiTrimmedRef.match(/^[0-9a-fA-F]{40}$/)) {
-            result.commit = asciiTrimmedRef;
+        else if (result.ref.match(/^[0-9a-fA-F]{40}$/)) {
+            result.commit = result.ref;
            result.ref = '';
        }
        core.debug(`ref = '${result.ref}'`);
@@ -1,12 +1,12 @@
 {
  "name": "checkout",
-  "version": "5.0.0",
+  "version": "4.3.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "checkout",
-      "version": "5.0.0",
+      "version": "4.3.0",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^1.10.1",
@@ -18,7 +18,7 @@
      },
      "devDependencies": {
        "@types/jest": "^29.5.12",
-        "@types/node": "^24.1.0",
+        "@types/node": "^20.12.12",
        "@types/uuid": "^9.0.8",
        "@typescript-eslint/eslint-plugin": "^7.9.0",
        "@typescript-eslint/parser": "^7.9.0",
@@ -1515,12 +1515,12 @@
      "dev": true
    },
    "node_modules/@types/node": {
-      "version": "24.1.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.1.0.tgz",
-      "integrity": "sha512-ut5FthK5moxFKH2T1CUOC6ctR67rQRvvHdFLCD2Ql6KXmMuCrjsSsRI9UsLCm9M18BMwClv4pn327UvB7eeO1w==",
+      "version": "20.12.12",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.12.12.tgz",
+      "integrity": "sha512-eWLDGF/FOSPtAvEqeRAQ4C8LSA7M1I7i0ky1I8U7kD1J5ITyW3AsRhQrKVoWf5pFKZ2kILsEGJhsI9r93PYnOw==",
      "dev": true,
      "dependencies": {
-        "undici-types": "~7.8.0"
+        "undici-types": "~5.26.4"
      }
    },
    "node_modules/@types/stack-utils": {
@@ -6865,9 +6865,9 @@
      }
    },
    "node_modules/undici-types": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.8.0.tgz",
-      "integrity": "sha512-9UJ2xGDvQ43tYyVMpuHlsgApydB8ZKfVYTsLDhXkFL/6gfkp+U8xTGdh8pMJv1SpZna0zxG1DwsKZsreLbXBxw==",
+      "version": "5.26.5",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
+      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==",
      "dev": true
    },
    "node_modules/universal-user-agent": {
@@ -1,6 +1,6 @@
 {
  "name": "checkout",
-  "version": "5.0.0",
+  "version": "4.3.0",
  "description": "checkout action",
  "main": "lib/main.js",
  "scripts": {
@@ -37,7 +37,7 @@
  },
  "devDependencies": {
    "@types/jest": "^29.5.12",
-    "@types/node": "^24.1.0",
+    "@types/node": "^20.12.12",
    "@types/uuid": "^9.0.8",
    "@typescript-eslint/eslint-plugin": "^7.9.0",
    "@typescript-eslint/parser": "^7.9.0",
@@ -59,23 +59,6 @@ export async function getInputs(): Promise<IGitSourceSettings> {

  // Source branch, source version
  result.ref = core.getInput('ref')
-  // core.getInput()'s default trim strips a range of Unicode characters such as a
-  // leading BOM (U+FEFF) or NBSP (U+00A0). Those are valid in a git ref name, so
-  // a fork branch named "<BOM>" + 40 hex chars would trim down to a bare SHA and
-  // be silently reclassified as a commit, bypassing the unsafe fork PR checkout
-  // guard.
-  //
-  // The trim below strips only the ASCII whitespace characters which are all forbidden
-  // in a git branch name.
-  //   \t  U+0009  horizontal tab   - ASCII control, forbidden in ref names
-  //   \n  U+000A  line feed        - ASCII control, forbidden in ref names
-  //   \v  U+000B  vertical tab     - ASCII control, forbidden in ref names
-  //   \f  U+000C  form feed        - ASCII control, forbidden in ref names
-  //   \r  U+000D  carriage return  - ASCII control, forbidden in ref names
-  //   ' ' U+0020  space            - forbidden in ref names
-  const asciiTrimmedRef = core
-    .getInput('ref', {trimWhitespace: false})
-    .replace(/^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g, '')
  if (!result.ref) {
    if (isWorkflowRepository) {
      result.ref = github.context.ref
@@ -89,8 +72,8 @@ export async function getInputs(): Promise<IGitSourceSettings> {
    }
  }
  // SHA?
-  else if (asciiTrimmedRef.match(/^[0-9a-fA-F]{40}$/)) {
-    result.commit = asciiTrimmedRef
+  else if (result.ref.match(/^[0-9a-fA-F]{40}$/)) {
+    result.commit = result.ref
    result.ref = ''
  }
  core.debug(`ref = '${result.ref}'`)
@@ -120,7 +120,7 @@ function updateUsage(
 }

 updateUsage(
-  'actions/checkout@v5',
+  'actions/checkout@v4',
  path.join(__dirname, '..', '..', 'action.yml'),
  path.join(__dirname, '..', '..', 'README.md')
 )
Author	SHA1	Message	Date
copilot-swe-agent[bot]andGitHub	d8f3cc5f1d	skip running unsafe pr check if input is default (backport #2518 to releases/v4)	2026-07-15 14:55:26 +00:00
Aiqiao YanandGitHub	c915c33a16	backport `allow-unsafe-pr-checkout` to v4 (#2502 ) * block checking out fork pr for pull_request_target and workflow_run (#2454) * block checking out fork pr for some events * address copilot and reviewer feedback * run prettier formatting * build * update urls * update readme * update description and url again * edit url one more time * update error wording (#2467)	2026-07-07 16:34:51 -04:00
eric scipleandGitHub	34e114876b	Cleanup actions/checkout@v6 auth style (#2305 )	2025-11-13 17:20:02 -06:00