Enforce safe directory (#762)

* set safe directory when running checkout

* Update CHANGELOG.md

.github/workflows/check-dist.yml

@@ -22,12 +22,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
-      - name: Set Node.js 12.x
+      - name: Set Node.js 16.x
         uses: actions/setup-node@v1
         with:
-          node-version: 12.x
+          node-version: 16.x
 
       - name: Install dependencies
         run: npm ci
@@ -44,7 +44,7 @@ jobs:
           fi
 
       # If dist/ was different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v2
         if: ${{ failure() && steps.diff.conclusion == 'failure' }}
         with:
           name: dist

.github/workflows/codeql-analysis.yml

@@ -39,7 +39,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v1

.github/workflows/licensed.yml

@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     name: Check licenses
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - run: npm ci
       - run: npm run licensed-check

.github/workflows/test.yml

@@ -13,8 +13,8 @@ jobs:
     steps:
       - uses: actions/setup-node@v1
         with:
-          node-version: 12.x
-      - uses: actions/checkout@v2
+          node-version: 16.x
+      - uses: actions/checkout@v3
       - run: npm ci
       - run: npm run build
       - run: npm run format-check
@@ -32,7 +32,7 @@ jobs:
     steps:
       # Clone this repo
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       # Basic checkout
       - name: Checkout basic
@@ -142,7 +142,7 @@ jobs:
       options: --dns 127.0.0.1
     services:
       squid-proxy:
-        image: ubuntu/squid:latest
+        image: datadog/squid:latest
         ports:
           - 3128:3128
     env:
@@ -150,7 +150,7 @@ jobs:
     steps:
       # Clone this repo
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       # Basic checkout using git
       - name: Checkout basic
@@ -182,7 +182,7 @@ jobs:
     steps:
       # Clone this repo
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       # Basic checkout using git
       - name: Checkout basic
@@ -205,41 +205,3 @@ jobs:
           path: basic
       - name: Verify basic
         run: __test__/verify-basic.sh --archive
-    
-  test-git-container:
-    runs-on: ubuntu-latest
-    container: bitnami/git:latest
-    steps:
-      # Clone this repo
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          path: v3
-
-      # Basic checkout using git
-      - name: Checkout basic
-        uses: ./v3
-        with:
-          ref: test-data/v2/basic
-      - name: Verify basic
-        run: |
-          if [ ! -f "./basic-file.txt" ]; then
-              echo "Expected basic file does not exist"
-              exit 1
-          fi
-
-          # Verify .git folder
-          if [ ! -d "./.git" ]; then
-            echo "Expected ./.git folder to exist"
-            exit 1
-          fi
-
-          # Verify auth token
-          git config --global --add safe.directory "*"
-          git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
-
-      # needed to make checkout post cleanup succeed
-      - name: Fix Checkout v3
-        uses: actions/checkout@v3
-        with:
-          path: v3

CHANGELOG.md

@@ -1,19 +1,17 @@
 # Changelog
 
-## v2.5.0
-- [Bump @actions/core to v1.10.0](https://github.com/actions/checkout/pull/962)
+## v3.0.1
+- [Fixed an issue where checkout failed to run in container jobs due to the new git setting `safe.directory`](https://github.com/actions/checkout/pull/762)
+- [Bumped various npm package versions](https://github.com/actions/checkout/pull/744)
 
-## v2.4.2
-- [Add input `set-safe-directory`](https://github.com/actions/checkout/pull/776)
+## v3.0.0
 
-## v2.4.1
-- [Set the safe directory option on git to prevent git commands failing when running in containers](https://github.com/actions/checkout/pull/762)
+- [Update to node 16](https://github.com/actions/checkout/pull/689)
 
 ## v2.3.1
 
 - [Fix default branch resolution for .wiki and when using SSH](https://github.com/actions/checkout/pull/284)
 
-
 ## v2.3.0
 
 - [Fallback to the default branch](https://github.com/actions/checkout/pull/278)

README.md

@@ -2,7 +2,7 @@
   <a href="https://github.com/actions/checkout"><img alt="GitHub Actions status" src="https://github.com/actions/checkout/workflows/test-local/badge.svg"></a>
 </p>
 
-# Checkout V2
+# Checkout V3
 
 This action checks-out your repository under `$GITHUB_WORKSPACE`, so your workflow can access it.
 
@@ -14,27 +14,14 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl
 
 # What's new
 
-- Improved performance
-  - Fetches only a single commit by default
-- Script authenticated git commands
-  - Auth token persisted in the local git config
-- Supports SSH
-- Creates a local branch
-  - No longer detached HEAD when checking out a branch
-- Improved layout
-  - The input `path` is always relative to $GITHUB_WORKSPACE
-  - Aligns better with container actions, where $GITHUB_WORKSPACE gets mapped in
-- Fallback to REST API download
-  - When Git 2.18 or higher is not in the PATH, the REST API will be used to download the files
-  - When using a job container, the container's PATH is used
-
-Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous versions.
+- Updated to the node16 runtime by default
+  - This requires a minimum [Actions Runner](https://github.com/actions/runner/releases/tag/v2.285.0) version of v2.285.0 to run, which is by default available in GHES 3.4 or later.
 
 # Usage
 
 <!-- start usage -->
 ```yaml
-- uses: actions/checkout@v2
+- uses: actions/checkout@v3
   with:
     # Repository name with owner. For example, actions/checkout
     # Default: ${{ github.repository }}
@@ -105,20 +92,6 @@ Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous
     #
     # Default: false
     submodules: ''
-
-    # Add repository path as safe.directory for Git global config by running `git
-    # config --global --add safe.directory <path>`
-    # Default: true
-    set-safe-directory: ''
-
-    # Required to check out fork pull request code from a workflow triggered by
-    # `pull_request_target` or `workflow_run`. These workflows run with the base
-    # repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner
-    # access; fetching and executing a fork's code in that trusted context commonly
-    # leads to "pwn request" vulnerabilities. Set to `true` only after reviewing the
-    # risks at https://gh.io/securely-using-pull_request_target.
-    # Default: false
-    allow-unsafe-pr-checkout: ''
 ```
 <!-- end usage -->
 
@@ -137,7 +110,7 @@ Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous
 ## Fetch all history for all tags and branches
 
 ```yaml
-- uses: actions/checkout@v2
+- uses: actions/checkout@v3
   with:
     fetch-depth: 0
 ```
@@ -145,7 +118,7 @@ Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous
 ## Checkout a different branch
 
 ```yaml
-- uses: actions/checkout@v2
+- uses: actions/checkout@v3
   with:
     ref: my-branch
 ```
@@ -153,7 +126,7 @@ Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous
 ## Checkout HEAD^
 
 ```yaml
-- uses: actions/checkout@v2
+- uses: actions/checkout@v3
   with:
     fetch-depth: 2
 - run: git checkout HEAD^
@@ -163,12 +136,12 @@ Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous
 
 ```yaml
 - name: Checkout
-  uses: actions/checkout@v2
+  uses: actions/checkout@v3
   with:
     path: main
 
 - name: Checkout tools repo
-  uses: actions/checkout@v2
+  uses: actions/checkout@v3
   with:
     repository: my-org/my-tools
     path: my-tools
@@ -178,10 +151,10 @@ Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous
 
 ```yaml
 - name: Checkout
-  uses: actions/checkout@v2
+  uses: actions/checkout@v3
 
 - name: Checkout tools repo
-  uses: actions/checkout@v2
+  uses: actions/checkout@v3
   with:
     repository: my-org/my-tools
     path: my-tools
@@ -191,12 +164,12 @@ Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous
 
 ```yaml
 - name: Checkout
-  uses: actions/checkout@v2
+  uses: actions/checkout@v3
   with:
     path: main
 
 - name: Checkout private tools
-  uses: actions/checkout@v2
+  uses: actions/checkout@v3
   with:
     repository: my-org/my-private-tools
     token: ${{ secrets.GH_PAT }} # `GH_PAT` is a secret that contains your PAT
@@ -209,7 +182,7 @@ Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous
 ## Checkout pull request HEAD commit instead of merge commit
 
 ```yaml
-- uses: actions/checkout@v2
+- uses: actions/checkout@v3
   with:
     ref: ${{ github.event.pull_request.head.sha }}
 ```
@@ -225,7 +198,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 ```
 
 ## Push a commit using the built-in token
@@ -236,7 +209,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - run: |
           date > generated.txt
           git config user.name github-actions

__test__/git-auth-helper.test.ts

@@ -777,9 +777,7 @@ async function setup(testName: string): Promise<void> {
     sshKey: sshPath ? 'some ssh private key' : '',
     sshKnownHosts: '',
     sshStrict: true,
-    workflowOrganizationId: 123456,
-    setSafeDirectory: true,
-    allowUnsafePrCheckout: false
+    workflowOrganizationId: 123456
   }
 }
 

__test__/input-helper.test.ts

@@ -85,8 +85,6 @@ describe('input-helper tests', () => {
     expect(settings.repositoryName).toBe('some-repo')
     expect(settings.repositoryOwner).toBe('some-owner')
     expect(settings.repositoryPath).toBe(gitHubWorkspace)
-    expect(settings.setSafeDirectory).toBe(true)
-    expect(settings.allowUnsafePrCheckout).toBe(false)
   })
 
   it('qualifies ref', async () => {
@@ -140,50 +138,4 @@ describe('input-helper tests', () => {
     const settings: IGitSourceSettings = await inputHelper.getInputs()
     expect(settings.workflowOrganizationId).toBe(123456)
   })
-
-  describe('unsafe PR checkout guard', () => {
-    const forkPayload = {
-      repository: {id: 100},
-      pull_request: {
-        head: {
-          sha: '1234567890123456789012345678901234567890',
-          repo: {id: 200, full_name: 'attacker/fork'}
-        },
-        merge_commit_sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
-      }
-    }
-
-    it('allows the default self-checkout on a fork pull_request_target', async () => {
-      const originalEvent = github.context.eventName
-      const originalPayload = github.context.payload
-      try {
-        github.context.eventName = 'pull_request_target'
-        github.context.payload = forkPayload as any
-        // Simulate a rebase/fast-forward merge where the base tip (event SHA)
-        // equals the PR head SHA. The default self-checkout must still succeed.
-        github.context.sha = '1234567890123456789012345678901234567890'
-        const settings: IGitSourceSettings = await inputHelper.getInputs()
-        expect(settings.commit).toBe('1234567890123456789012345678901234567890')
-      } finally {
-        github.context.eventName = originalEvent
-        github.context.payload = originalPayload
-      }
-    })
-
-    it('refuses an explicit fork repository on pull_request_target', async () => {
-      const originalEvent = github.context.eventName
-      const originalPayload = github.context.payload
-      try {
-        github.context.eventName = 'pull_request_target'
-        github.context.payload = forkPayload as any
-        inputs.repository = 'attacker/fork'
-        await expect(inputHelper.getInputs()).rejects.toThrow(
-          /Refusing to check out fork pull request code/
-        )
-      } finally {
-        github.context.eventName = originalEvent
-        github.context.payload = originalPayload
-      }
-    })
-  })
 })

__test__/unsafe-pr-checkout-helper.test.ts

@@ -1,267 +0,0 @@
-import * as github from '@actions/github'
-import {assertSafePrCheckout} from '../lib/unsafe-pr-checkout-helper'
-
-// Shallow clone original @actions/github context
-const originalContext = {...github.context}
-const originalEventName = github.context.eventName
-const originalPayload = github.context.payload
-
-const BASE_REPO_ID = 100
-const FORK_REPO_ID = 200
-const PR_HEAD_SHA = '1111111111111111111111111111111111111111'
-const PR_MERGE_SHA = '2222222222222222222222222222222222222222'
-const SAFE_BASE_SHA = '3333333333333333333333333333333333333333'
-const WORKFLOW_RUN_HEAD_COMMIT_SHA = '4444444444444444444444444444444444444444'
-const BASE_QUALIFIED_REPO = 'some-owner/some-repo'
-const FORK_QUALIFIED_REPO = 'another-repo/fork'
-
-function setContext(eventName: string, payload: object): void {
-  ;(github.context as {eventName: string}).eventName = eventName
-  ;(github.context as {payload: object}).payload = payload
-}
-
-function forkPullRequestTargetPayload(): object {
-  return {
-    repository: {id: BASE_REPO_ID},
-    pull_request: {
-      head: {
-        sha: PR_HEAD_SHA,
-        repo: {id: FORK_REPO_ID, full_name: FORK_QUALIFIED_REPO}
-      },
-      merge_commit_sha: PR_MERGE_SHA
-    }
-  }
-}
-
-function sameRepoPullRequestTargetPayload(): object {
-  return {
-    repository: {id: BASE_REPO_ID},
-    pull_request: {
-      head: {
-        sha: PR_HEAD_SHA,
-        repo: {id: BASE_REPO_ID, full_name: BASE_QUALIFIED_REPO}
-      },
-      merge_commit_sha: PR_MERGE_SHA
-    }
-  }
-}
-
-function forkWorkflowRunPayload(): object {
-  return {
-    repository: {id: BASE_REPO_ID},
-    workflow_run: {
-      event: 'pull_request',
-      head_commit: {id: WORKFLOW_RUN_HEAD_COMMIT_SHA},
-      head_repository: {id: FORK_REPO_ID, full_name: FORK_QUALIFIED_REPO}
-    }
-  }
-}
-
-describe('unsafe-pr-checkout-helper', () => {
-  beforeAll(() => {
-    jest.spyOn(github.context, 'repo', 'get').mockReturnValue({
-      owner: 'some-owner',
-      repo: 'some-repo'
-    })
-  })
-
-  afterEach(() => {
-    ;(github.context as {eventName: string}).eventName = originalEventName
-    ;(github.context as {payload: object}).payload = originalPayload
-  })
-
-  afterAll(() => {
-    ;(github.context as {eventName: string}).eventName =
-      originalContext.eventName
-    ;(github.context as {payload: object}).payload = originalContext.payload
-    jest.restoreAllMocks()
-  })
-
-  it('allows pull_request events untouched', () => {
-    setContext('pull_request', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: 'attacker/fork',
-        ref: 'refs/pull/1/merge',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).not.toThrow()
-  })
-
-  it('allows pull_request_target default checkout (base branch)', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: 'refs/heads/main',
-        commit: SAFE_BASE_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).not.toThrow()
-  })
-
-  it('allows same-repo pull_request_target checkout of PR head', () => {
-    setContext('pull_request_target', sameRepoPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: PR_HEAD_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).not.toThrow()
-  })
-
-  it('refuses pull_request_target fork PR head SHA checkout', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: PR_HEAD_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow(/Refusing to check out fork pull request code/)
-  })
-
-  it('refuses pull_request_target fork PR merge_commit_sha checkout', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: PR_MERGE_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow(/allow-unsafe-pr-checkout/)
-  })
-
-  it('refuses pull_request_target fork PR ref pattern (head)', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: 'refs/pull/42/head',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('refuses pull_request_target fork PR ref pattern (merge)', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: 'refs/pull/42/merge',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('refuses pull_request_target when repository points at the fork', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: FORK_QUALIFIED_REPO,
-        ref: 'refs/heads/main',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('allows pull_request_target checkout of an unrelated third-party repo', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: 'some-other/unrelated',
-        ref: 'refs/heads/main',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).not.toThrow()
-  })
-
-  it('refuses pull_request_target ignoring repository case differences', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: FORK_QUALIFIED_REPO.toUpperCase(),
-        ref: '',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('refuses pull_request_target ignoring commit SHA case differences', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: PR_HEAD_SHA.toUpperCase(),
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('allows pull_request_target fork PR checkout when opted in', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: 'refs/pull/42/merge',
-        commit: '',
-        allowUnsafePrCheckout: true
-      })
-    ).not.toThrow()
-  })
-
-  it('refuses workflow_run fork PR head_commit.id checkout', () => {
-    setContext('workflow_run', forkWorkflowRunPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: WORKFLOW_RUN_HEAD_COMMIT_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('refuses workflow_run with pull_request_target underlying event', () => {
-    const payload = forkWorkflowRunPayload() as {
-      workflow_run: {event: string}
-    }
-    payload.workflow_run.event = 'pull_request_target'
-    setContext('workflow_run', payload)
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: WORKFLOW_RUN_HEAD_COMMIT_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).toThrow()
-  })
-
-  it('allows workflow_run same-repo PR (head_repository.id matches base)', () => {
-    const payload = forkWorkflowRunPayload() as {
-      workflow_run: {head_repository: {id: number}}
-    }
-    payload.workflow_run.head_repository.id = BASE_REPO_ID
-    setContext('workflow_run', payload)
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: BASE_QUALIFIED_REPO,
-        ref: '',
-        commit: WORKFLOW_RUN_HEAD_COMMIT_SHA,
-        allowUnsafePrCheckout: false
-      })
-    ).not.toThrow()
-  })
-})

action.yml

@@ -68,19 +68,7 @@ inputs:
       When the `ssh-key` input is not provided, SSH URLs beginning with `git@github.com:` are
       converted to HTTPS.
     default: false
-  set-safe-directory:
-    description: Add repository path as safe.directory for Git global config by running `git config --global --add safe.directory <path>`
-    default: true
-  allow-unsafe-pr-checkout:
-    description: >
-      Required to check out fork pull request code from a workflow triggered by
-      `pull_request_target` or `workflow_run`. These workflows run with the
-      base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and
-      runner access; fetching and executing a fork's code in that trusted
-      context commonly leads to "pwn request" vulnerabilities. Set to `true`
-      only after reviewing the risks at https://gh.io/securely-using-pull_request_target.
-    default: false
 runs:
-  using: node12
+  using: node16
   main: dist/index.js
   post: dist/index.js

package.json

@@ -1,6 +1,6 @@
 {
   "name": "checkout",
-  "version": "2.6.0",
+  "version": "2.0.2",
   "description": "checkout action",
   "main": "lib/main.js",
   "scripts": {
@@ -28,10 +28,10 @@
   },
   "homepage": "https://github.com/actions/checkout#readme",
   "dependencies": {
-    "@actions/core": "^1.10.0",
+    "@actions/core": "^1.2.6",
     "@actions/exec": "^1.0.1",
     "@actions/github": "^2.2.0",
-    "@actions/io": "^1.1.2",
+    "@actions/io": "^1.0.1",
     "@actions/tool-cache": "^1.1.2",
     "uuid": "^3.3.3"
   },
@@ -39,12 +39,11 @@
     "@types/jest": "^27.0.2",
     "@types/node": "^12.7.12",
     "@types/uuid": "^3.4.6",
-    "@typescript-eslint/eslint-plugin": "^5.45.0",
-    "@typescript-eslint/parser": "^5.45.0",
+    "@typescript-eslint/parser": "^5.1.0",
     "@zeit/ncc": "^0.20.5",
     "eslint": "^7.32.0",
     "eslint-plugin-github": "^4.3.2",
-    "eslint-plugin-jest": "^25.7.0",
+    "eslint-plugin-jest": "^25.2.2",
     "jest": "^27.3.0",
     "jest-circus": "^27.3.0",
     "js-yaml": "^3.13.1",

src/git-auth-helper.ts

@@ -19,7 +19,7 @@ export interface IGitAuthHelper {
   configureAuth(): Promise<void>
   configureGlobalAuth(): Promise<void>
   configureSubmoduleAuth(): Promise<void>
-  configureTempGlobalConfig(): Promise<string>
+  configureTempGlobalConfig(repositoryPath?: string): Promise<string>
   removeAuth(): Promise<void>
   removeGlobalConfig(): Promise<void>
 }
@@ -81,7 +81,7 @@ class GitAuthHelper {
     await this.configureToken()
   }
 
-  async configureTempGlobalConfig(): Promise<string> {
+  async configureTempGlobalConfig(repositoryPath?: string): Promise<string> {
     // Already setup global config
     if (this.temporaryHomePath?.length > 0) {
       return path.join(this.temporaryHomePath, '.gitconfig')
@@ -121,6 +121,21 @@ class GitAuthHelper {
     )
     this.git.setEnvironmentVariable('HOME', this.temporaryHomePath)
 
+    // Setup the workspace as a safe directory, so if we pass this into a container job with a different user it doesn't fail
+    // Otherwise all git commands we run in a container fail
+    core.info(
+      `Adding working directory to the temporary git global config as a safe directory`
+    )
+    await this.git
+      .config(
+        'safe.directory',
+        repositoryPath ?? this.settings.repositoryPath,
+        true,
+        true
+      )
+      .catch(error => {
+        core.info(`Failed to initialize safe directory with error: ${error}`)
+      })
     return newGitConfigPath
   }
 
@@ -157,8 +172,7 @@ class GitAuthHelper {
       // by process creation audit events, which are commonly logged. For more information,
       // refer to https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing
       const output = await this.git.submoduleForeach(
-        // wrap the pipeline in quotes to make sure it's handled properly by submoduleForeach, rather than just the first part of the pipeline
-        `sh -c "git config --local '${this.tokenConfigKey}' '${this.tokenPlaceholderConfigValue}' && git config --local --show-origin --name-only --get-regexp remote.origin.url"`,
+        `git config --local '${this.tokenConfigKey}' '${this.tokenPlaceholderConfigValue}' && git config --local --show-origin --name-only --get-regexp remote.origin.url`,
         this.settings.nestedSubmodules
       )
 
@@ -247,7 +261,7 @@ class GitAuthHelper {
     if (this.settings.sshKnownHosts) {
       knownHosts += `# Begin from input known hosts\n${this.settings.sshKnownHosts}\n# end from input known hosts\n`
     }
-    knownHosts += `# Begin implicitly added github.com\ngithub.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=\n# End implicitly added github.com\n`
+    knownHosts += `# Begin implicitly added github.com\ngithub.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==\n# End implicitly added github.com\n`
     this.sshKnownHostsPath = path.join(runnerTemp, `${uniqueId}_known_hosts`)
     stateHelper.setSshKnownHostsPath(this.sshKnownHostsPath)
     await fs.promises.writeFile(this.sshKnownHostsPath, knownHosts)
@@ -366,8 +380,7 @@ class GitAuthHelper {
 
     const pattern = regexpHelper.escape(configKey)
     await this.git.submoduleForeach(
-      // wrap the pipeline in quotes to make sure it's handled properly by submoduleForeach, rather than just the first part of the pipeline
-      `sh -c "git config --local --name-only --get-regexp '${pattern}' && git config --local --unset-all '${configKey}' || :"`,
+      `git config --local --name-only --get-regexp '${pattern}' && git config --local --unset-all '${configKey}' || :`,
       true
     )
   }

src/git-source-provider.ts

@@ -40,24 +40,7 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
   try {
     if (git) {
       authHelper = gitAuthHelper.createAuthHelper(git, settings)
-      if (settings.setSafeDirectory) {
-        // Setup the repository path as a safe directory, so if we pass this into a container job with a different user it doesn't fail
-        // Otherwise all git commands we run in a container fail
-        await authHelper.configureTempGlobalConfig()
-        core.info(
-          `Adding repository directory to the temporary git global config as a safe directory`
-        )
-
-        await git
-          .config('safe.directory', settings.repositoryPath, true, true)
-          .catch(error => {
-            core.info(
-              `Failed to initialize safe directory with error: ${error}`
-            )
-          })
-
-        stateHelper.setSafeDirectory()
-      }
+      await authHelper.configureTempGlobalConfig()
     }
 
     // Prepare existing directory, otherwise recreate
@@ -266,21 +249,7 @@ export async function cleanup(repositoryPath: string): Promise<void> {
   // Remove auth
   const authHelper = gitAuthHelper.createAuthHelper(git)
   try {
-    if (stateHelper.PostSetSafeDirectory) {
-      // Setup the repository path as a safe directory, so if we pass this into a container job with a different user it doesn't fail
-      // Otherwise all git commands we run in a container fail
-      await authHelper.configureTempGlobalConfig()
-      core.info(
-        `Adding repository directory to the temporary git global config as a safe directory`
-      )
-
-      await git
-        .config('safe.directory', repositoryPath, true, true)
-        .catch(error => {
-          core.info(`Failed to initialize safe directory with error: ${error}`)
-        })
-    }
-
+    await authHelper.configureTempGlobalConfig(repositoryPath)
     await authHelper.removeAuth()
   } finally {
     await authHelper.removeGlobalConfig()

src/git-source-settings.ts

@@ -78,15 +78,4 @@ export interface IGitSourceSettings {
    * Organization ID for the currently running workflow (used for auth settings)
    */
   workflowOrganizationId: number | undefined
-
-  /**
-   * Indicates whether to add repositoryPath as safe.directory in git global config
-   */
-  setSafeDirectory: boolean
-
-  /**
-   * Opt-in to allow checking out fork pull request code from a workflow
-   * triggered by pull_request_target or workflow_run.
-   */
-  allowUnsafePrCheckout: boolean
 }

src/input-helper.ts

@@ -2,12 +2,11 @@ import * as core from '@actions/core'
 import * as fsHelper from './fs-helper'
 import * as github from '@actions/github'
 import * as path from 'path'
-import * as unsafePrCheckoutHelper from './unsafe-pr-checkout-helper'
 import * as workflowContextHelper from './workflow-context-helper'
 import {IGitSourceSettings} from './git-source-settings'
 
 export async function getInputs(): Promise<IGitSourceSettings> {
-  const result = {} as unknown as IGitSourceSettings
+  const result = ({} as unknown) as IGitSourceSettings
 
   // GitHub workspace
   let githubWorkspacePath = process.env['GITHUB_WORKSPACE']
@@ -121,32 +120,7 @@ export async function getInputs(): Promise<IGitSourceSettings> {
     (core.getInput('persist-credentials') || 'false').toUpperCase() === 'TRUE'
 
   // Workflow organization ID
-  result.workflowOrganizationId =
-    await workflowContextHelper.getOrganizationId()
-
-  // Set safe.directory in git global config.
-  result.setSafeDirectory =
-    (core.getInput('set-safe-directory') || 'true').toUpperCase() === 'TRUE'
-
-  // Allow unsafe PR checkout (opt-in for pull_request_target / workflow_run fork PRs)
-  result.allowUnsafePrCheckout =
-    (core.getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() ===
-    'TRUE'
-  core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`)
-
-  // The default self-checkout (this repository with no explicit ref) always
-  // resolves to the trusted ref/commit GitHub set for the triggering event, so
-  // the fork-checkout guard only needs to run when the caller customized the
-  // repository or ref.
-  const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref')
-  if (!isDefaultCheckout) {
-    unsafePrCheckoutHelper.assertSafePrCheckout({
-      qualifiedRepository,
-      ref: result.ref,
-      commit: result.commit,
-      allowUnsafePrCheckout: result.allowUnsafePrCheckout
-    })
-  }
+  result.workflowOrganizationId = await workflowContextHelper.getOrganizationId()
 
   return result
 }

src/misc/generate-docs.ts

@@ -120,7 +120,7 @@ function updateUsage(
 }
 
 updateUsage(
-  'actions/checkout@v2',
+  'actions/checkout@v3',
   path.join(__dirname, '..', '..', 'action.yml'),
   path.join(__dirname, '..', '..', 'README.md')
 )

src/ref-helper.ts

@@ -259,7 +259,7 @@ export async function checkCommitInfo(
   }
 }
 
-export function fromPayload(path: string): any {
+function fromPayload(path: string): any {
   return select(github.context.payload, path)
 }
 

src/state-helper.ts

@@ -1,60 +1,58 @@
-import * as core from '@actions/core'
+import * as coreCommand from '@actions/core/lib/command'
 
 /**
  * Indicates whether the POST action is running
  */
-export const IsPost = !!core.getState('isPost')
+export const IsPost = !!process.env['STATE_isPost']
 
 /**
  * The repository path for the POST action. The value is empty during the MAIN action.
  */
-export const RepositoryPath = core.getState('repositoryPath')
-
-/**
- * The set-safe-directory for the POST action. The value is set if input: 'safe-directory' is set during the MAIN action.
- */
-export const PostSetSafeDirectory = core.getState('setSafeDirectory') === 'true'
+export const RepositoryPath =
+  (process.env['STATE_repositoryPath'] as string) || ''
 
 /**
  * The SSH key path for the POST action. The value is empty during the MAIN action.
  */
-export const SshKeyPath = core.getState('sshKeyPath')
+export const SshKeyPath = (process.env['STATE_sshKeyPath'] as string) || ''
 
 /**
  * The SSH known hosts path for the POST action. The value is empty during the MAIN action.
  */
-export const SshKnownHostsPath = core.getState('sshKnownHostsPath')
+export const SshKnownHostsPath =
+  (process.env['STATE_sshKnownHostsPath'] as string) || ''
 
 /**
  * Save the repository path so the POST action can retrieve the value.
  */
 export function setRepositoryPath(repositoryPath: string) {
-  core.saveState('repositoryPath', repositoryPath)
+  coreCommand.issueCommand(
+    'save-state',
+    {name: 'repositoryPath'},
+    repositoryPath
+  )
 }
 
 /**
  * Save the SSH key path so the POST action can retrieve the value.
  */
 export function setSshKeyPath(sshKeyPath: string) {
-  core.saveState('sshKeyPath', sshKeyPath)
+  coreCommand.issueCommand('save-state', {name: 'sshKeyPath'}, sshKeyPath)
 }
 
 /**
  * Save the SSH known hosts path so the POST action can retrieve the value.
  */
 export function setSshKnownHostsPath(sshKnownHostsPath: string) {
-  core.saveState('sshKnownHostsPath', sshKnownHostsPath)
-}
-
-/**
- * Save the sef-safe-directory input so the POST action can retrieve the value.
- */
-export function setSafeDirectory() {
-  core.saveState('setSafeDirectory', 'true')
+  coreCommand.issueCommand(
+    'save-state',
+    {name: 'sshKnownHostsPath'},
+    sshKnownHostsPath
+  )
 }
 
 // Publish a variable so that when the POST action runs, it can determine it should run the cleanup logic.
 // This is necessary since we don't have a separate entry point.
 if (!IsPost) {
-  core.saveState('isPost', 'true')
+  coreCommand.issueCommand('save-state', {name: 'isPost'}, 'true')
 }

src/unsafe-pr-checkout-helper.ts

@@ -1,88 +0,0 @@
-import * as github from '@actions/github'
-import {fromPayload} from './ref-helper'
-
-const PR_REF_PATTERN = /^refs\/pull\/[0-9]+\/(?:head|merge)$/
-
-export interface IUnsafePrCheckoutInput {
-  qualifiedRepository: string
-  ref: string
-  commit: string | undefined
-  allowUnsafePrCheckout: boolean
-}
-
-export function assertSafePrCheckout(input: IUnsafePrCheckoutInput): void {
-  if (input.allowUnsafePrCheckout) {
-    return
-  }
-
-  const eventName = github.context.eventName
-  if (eventName !== 'pull_request_target' && eventName !== 'workflow_run') {
-    return
-  }
-
-  const baseRepoId = fromPayload('repository.id')
-  if (typeof baseRepoId !== 'number') {
-    return
-  }
-
-  let prHeadRepoId: unknown
-  let prHeadRepoFullName: unknown
-  const prShas: string[] = []
-
-  if (eventName === 'pull_request_target') {
-    prHeadRepoId = fromPayload('pull_request.head.repo.id')
-    prHeadRepoFullName = fromPayload('pull_request.head.repo.full_name')
-    pushIfSha(prShas, fromPayload('pull_request.head.sha'))
-    pushIfSha(prShas, fromPayload('pull_request.merge_commit_sha'))
-  } else {
-    const wrEvent = fromPayload('workflow_run.event')
-    if (typeof wrEvent !== 'string' || !wrEvent.startsWith('pull_request')) {
-      return
-    }
-    prHeadRepoId = fromPayload('workflow_run.head_repository.id')
-    prHeadRepoFullName = fromPayload('workflow_run.head_repository.full_name')
-    pushIfSha(prShas, fromPayload('workflow_run.head_commit.id'))
-    // For `pull_request_target`-triggered workflow_run, `head_sha` is the base
-    // default branch SHA (not the PR head)
-    if (wrEvent !== 'pull_request_target') {
-      pushIfSha(prShas, fromPayload('workflow_run.head_sha'))
-    }
-  }
-
-  // (A) Fork PR?
-  if (typeof prHeadRepoId !== 'number' || prHeadRepoId === baseRepoId) {
-    return
-  }
-
-  // (B) We cannot check for all fork PR refs so check to see
-  // if the resolved input points to the fork PR sha we have in the payload
-  const repositoryMatchesPrHead =
-    typeof prHeadRepoFullName === 'string' &&
-    input.qualifiedRepository.toLowerCase() === prHeadRepoFullName.toLowerCase()
-  const refMatchesPullPattern = PR_REF_PATTERN.test(input.ref)
-  const commitMatchesPrHeadSha =
-    !!input.commit && prShas.includes(input.commit.toLowerCase())
-
-  if (
-    !repositoryMatchesPrHead &&
-    !refMatchesPullPattern &&
-    !commitMatchesPrHeadSha
-  ) {
-    return
-  }
-
-  throw new Error(
-    `Refusing to check out fork pull request code from a '${eventName}' workflow. ` +
-      `This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch ` +
-      `cache scope, and runner access. Fetching and executing a fork's code in that trusted ` +
-      `context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks ` +
-      `at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' ` +
-      `on the actions/checkout step.`
-  )
-}
-
-function pushIfSha(target: string[], value: unknown): void {
-  if (typeof value === 'string' && value.length > 0) {
-    target.push(value.toLowerCase())
-  }
-}