backport fixes to releases-v6 (#2527 )

backport allow-unsafe-pr-checkout to v6 (#2500 )
* block checking out fork pr for pull_request_target and workflow_run (#2454) * block checking out fork pr for some events * address copilot and reviewer feedback * run prettier formatting * build * update urls * update readme * update description and url again * edit url one more time * update error wording (#2467)
2026-08-06 03:29:21 +08:00 · 2026-07-16 15:43:33 -04:00 · 2026-07-07 16:34:58 -04:00
72 changed files with 27720 additions and 33280 deletions
@@ -0,0 +1,3 @@
+dist/
+lib/
+node_modules/
@@ -0,0 +1,53 @@
+{
+  "plugins": ["jest", "@typescript-eslint"],
+  "extends": ["plugin:github/recommended"],
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "ecmaVersion": 9,
+    "sourceType": "module",
+    "project": "./tsconfig.json"
+  },
+  "rules": {
+    "eslint-comments/no-use": "off",
+    "import/no-namespace": "off",
+    "no-unused-vars": "off",
+    "@typescript-eslint/no-unused-vars": "error",
+    "@typescript-eslint/explicit-member-accessibility": ["error", {"accessibility": "no-public"}],
+    "@typescript-eslint/no-require-imports": "error",
+    "@typescript-eslint/array-type": "error",
+    "@typescript-eslint/await-thenable": "error",
+    "camelcase": "off",
+    "@typescript-eslint/explicit-function-return-type": ["error", {"allowExpressions": true}],
+    "@typescript-eslint/func-call-spacing": ["error", "never"],
+    "@typescript-eslint/no-array-constructor": "error",
+    "@typescript-eslint/no-empty-interface": "error",
+    "@typescript-eslint/no-explicit-any": "error",
+    "@typescript-eslint/no-extraneous-class": "error",
+    "@typescript-eslint/no-floating-promises": "error",
+    "@typescript-eslint/no-for-in-array": "error",
+    "@typescript-eslint/no-inferrable-types": "error",
+    "@typescript-eslint/no-misused-new": "error",
+    "@typescript-eslint/no-namespace": "error",
+    "@typescript-eslint/no-non-null-assertion": "warn",
+    "@typescript-eslint/no-unnecessary-qualifier": "error",
+    "@typescript-eslint/no-unnecessary-type-assertion": "error",
+    "@typescript-eslint/no-useless-constructor": "error",
+    "@typescript-eslint/no-var-requires": "error",
+    "@typescript-eslint/prefer-for-of": "warn",
+    "@typescript-eslint/prefer-function-type": "warn",
+    "@typescript-eslint/prefer-includes": "error",
+    "@typescript-eslint/prefer-string-starts-ends-with": "error",
+    "@typescript-eslint/promise-function-async": "error",
+    "@typescript-eslint/require-array-sort-compare": "error",
+    "@typescript-eslint/restrict-plus-operands": "error",
+    "semi": "off",
+    "@typescript-eslint/semi": ["error", "never"],
+    "@typescript-eslint/type-annotation-spacing": "error",
+    "@typescript-eslint/unbound-method": "error"
+  },
+  "env": {
+    "node": true,
+    "es6": true,
+    "jest/globals": true
+  }
+}
@@ -22,10 +22,10 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6

      - name: Set Node.js 24.x
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
        with:
          node-version: 24.x

@@ -44,7 +44,7 @@ jobs:
          fi

      # If dist/ was different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v4
        if: ${{ failure() && steps.diff.conclusion == 'failure' }}
        with:
          name: dist
@@ -39,10 +39,10 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v6

    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,4 +55,4 @@ jobs:
    - run: rm -rf dist # We want code scanning to analyze lib instead (individual .js files)

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@v3
@@ -9,6 +9,6 @@ jobs:
    runs-on: ubuntu-latest
    name: Check licenses
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
      - run: npm ci
      - run: npm run licensed-check
@@ -14,7 +14,7 @@ jobs:

    steps:
      - name: Checking out
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
      - name: Publish
        id: publish
-        uses: actions/publish-immutable-action@v0.0.4
+        uses: actions/publish-immutable-action@0.0.3
@@ -16,10 +16,10 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v4
        with:
          node-version: 24.x
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
      - run: npm ci
      - run: npm run build
      - run: npm run format-check
@@ -37,7 +37,7 @@ jobs:
    steps:
      # Clone this repo
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6

      # Basic checkout
      - name: Checkout basic
@@ -229,7 +229,7 @@ jobs:
    steps:
      # Clone this repo
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6

      # Basic checkout using git
      - name: Checkout basic
@@ -261,7 +261,7 @@ jobs:
    steps:
      # Clone this repo
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6

      # Basic checkout using git
      - name: Checkout basic
@@ -291,7 +291,7 @@ jobs:
    steps:
      # Clone this repo
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
        with:
          path: localClone

@@ -319,7 +319,7 @@ jobs:

      # needed to make checkout post cleanup succeed
      - name: Fix Checkout v6
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
        with:
          path: localClone

@@ -328,7 +328,7 @@ jobs:
    steps:
      # Clone this repo
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
        with:
          path: actions-checkout

@@ -23,7 +23,7 @@ jobs:
    # Note this update workflow can also be used as a rollback tool.
    # For that reason, it's best to pin `actions/checkout` to a known, stable version
    # (typically, about two releases back).
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6
      with:
        fetch-depth: 0
    - name: Git config
@@ -26,12 +26,12 @@ jobs:
 
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6

      # Use `docker/login-action` to log in to GHCR.io. 
      # Once published, the packages are scoped to the account defined here.
      - name: Log in to the ghcr.io container registry
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -48,7 +48,7 @@ jobs:

      # Use `docker/build-push-action` to build (and optionally publish) the image. 
      - name: Build Docker Image (with optional Push)
-        uses: docker/build-push-action@v7.3.0
+        uses: docker/build-push-action@v6.5.0
        with:
          context: .
          file: images/test-ubuntu-git.Dockerfile
@@ -11,5 +11,4 @@ allowed:
  - unlicense

 reviewed:
-  npm:
-    - "@actions/http-client" # MIT
+  npm:
@@ -1,14 +1,5 @@
 # Changelog

-## v7.0.0
-* Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in https://github.com/actions/checkout/pull/2454
-* Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in https://github.com/actions/checkout/pull/2458
-* Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in https://github.com/actions/checkout/pull/2460
-* Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/actions/checkout/pull/2461
-* Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in https://github.com/actions/checkout/pull/2459
-* upgrade module to esm and update dependencies by @aiqiaoy in https://github.com/actions/checkout/pull/2463
-* Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/actions/checkout/pull/2462
-
 ## v6.0.3
 * Fix checkout init for SHA-256 repositories by @yaananth in https://github.com/actions/checkout/pull/2439
 * fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in https://github.com/actions/checkout/pull/2414
@@ -1,14 +1,5 @@
 [![Build and Test](https://github.com/actions/checkout/actions/workflows/test.yml/badge.svg)](https://github.com/actions/checkout/actions/workflows/test.yml)

-# Checkout v7
-
-## What's new
-
- Safer fork pull request handling: checkout now refuses to check out fork pull request code by default when the workflow is triggered by `pull_request_target` or `workflow_run`. These triggers run with the base repository's `GITHUB_TOKEN`, secrets, and runner access, where executing a fork's code commonly leads to "pwn request" vulnerabilities.
-  - To opt in after [reviewing the risks](https://gh.io/securely-using-pull_request_target), set the new `allow-unsafe-pr-checkout: true` input.
- Migrated `actions/checkout` to ESM to support new versions of the `@actions/*` packages.
- Updated direct and transitive dependencies, including security fixes for known vulnerabilities.
-
 # Checkout v6

 ## What's new
@@ -24,6 +15,7 @@
 - Updated to the node24 runtime
  - This requires a minimum Actions Runner version of [v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) to run.

+
 # Checkout v4

 This action checks-out your repository under `$GITHUB_WORKSPACE`, so your workflow can access it.
@@ -60,7 +52,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/

 <!-- start usage -->
 ```yaml
- uses: actions/checkout@v7
+- uses: actions/checkout@v6
  with:
    # Repository name with owner. For example, actions/checkout
    # Default: ${{ github.repository }}
@@ -208,7 +200,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Fetch only the root files

 ```yaml
- uses: actions/checkout@v7
+- uses: actions/checkout@v6
  with:
    sparse-checkout: .
 ```
@@ -216,7 +208,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Fetch only the root files and `.github` and `src` folder

 ```yaml
- uses: actions/checkout@v7
+- uses: actions/checkout@v6
  with:
    sparse-checkout: |
      .github
@@ -226,7 +218,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Fetch only a single file

 ```yaml
- uses: actions/checkout@v7
+- uses: actions/checkout@v6
  with:
    sparse-checkout: |
      README.md
@@ -236,7 +228,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Fetch all history for all tags and branches

 ```yaml
- uses: actions/checkout@v7
+- uses: actions/checkout@v6
  with:
    fetch-depth: 0
 ```
@@ -244,7 +236,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Checkout a different branch

 ```yaml
- uses: actions/checkout@v7
+- uses: actions/checkout@v6
  with:
    ref: my-branch
 ```
@@ -252,7 +244,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Checkout HEAD^

 ```yaml
- uses: actions/checkout@v7
+- uses: actions/checkout@v6
  with:
    fetch-depth: 2
 - run: git checkout HEAD^
@@ -262,12 +254,12 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/

 ```yaml
 - name: Checkout
-  uses: actions/checkout@v7
+  uses: actions/checkout@v6
  with:
    path: main

 - name: Checkout tools repo
-  uses: actions/checkout@v7
+  uses: actions/checkout@v6
  with:
    repository: my-org/my-tools
    path: my-tools
@@ -278,10 +270,10 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/

 ```yaml
 - name: Checkout
-  uses: actions/checkout@v7
+  uses: actions/checkout@v6

 - name: Checkout tools repo
-  uses: actions/checkout@v7
+  uses: actions/checkout@v6
  with:
    repository: my-org/my-tools
    path: my-tools
@@ -292,12 +284,12 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/

 ```yaml
 - name: Checkout
-  uses: actions/checkout@v7
+  uses: actions/checkout@v6
  with:
    path: main

 - name: Checkout private tools
-  uses: actions/checkout@v7
+  uses: actions/checkout@v6
  with:
    repository: my-org/my-private-tools
    token: ${{ secrets.GH_PAT }} # `GH_PAT` is a secret that contains your PAT
@@ -310,7 +302,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ## Checkout pull request HEAD commit instead of merge commit

 ```yaml
- uses: actions/checkout@v7
+- uses: actions/checkout@v6
  with:
    ref: ${{ github.event.pull_request.head.sha }}
 ```
@@ -326,7 +318,7 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
 ```

 ## Push a commit using the built-in token
@@ -337,7 +329,7 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
      - run: |
          date > generated.txt
          # Note: the following account information will not work on GHES
@@ -359,7 +351,7 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
        with:
          ref: ${{ github.head_ref }}
      - run: |
@@ -1,46 +1,12 @@
-import {
-  jest,
-  describe,
-  it,
-  expect,
-  beforeAll,
-  beforeEach,
-  afterEach,
-  afterAll
-} from '@jest/globals'
+import * as core from '@actions/core'
 import * as fs from 'fs'
+import * as gitAuthHelper from '../lib/git-auth-helper'
 import * as io from '@actions/io'
 import * as os from 'os'
 import * as path from 'path'
-import {fileURLToPath} from 'url'
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-
-// Mock @actions/core before loading git-auth-helper
-jest.unstable_mockModule('@actions/core', () => ({
-  setSecret: jest.fn(),
-  error: jest.fn(),
-  warning: jest.fn(),
-  info: jest.fn(),
-  debug: jest.fn(),
-  setFailed: jest.fn()
-}))
-
-// Mock state-helper
-jest.unstable_mockModule('../src/state-helper.js', () => ({
-  setSshKeyPath: jest.fn(),
-  setSshKnownHostsPath: jest.fn(),
-  IsPost: false,
-  RepositoryPath: ''
-}))
-
-// Dynamic imports after mocking
-const core = await import('@actions/core')
-const gitAuthHelper = await import('../src/git-auth-helper.js')
-type IGitCommandManager =
-  import('../src/git-command-manager.js').IGitCommandManager
-type IGitSourceSettings =
-  import('../src/git-source-settings.js').IGitSourceSettings
+import * as stateHelper from '../lib/state-helper'
+import {IGitCommandManager} from '../lib/git-command-manager'
+import {IGitSourceSettings} from '../lib/git-source-settings'

 const isWindows = process.platform === 'win32'
 const testWorkspace = path.join(__dirname, '_temp', 'git-auth-helper')
@@ -66,12 +32,25 @@ describe('git-auth-helper tests', () => {
  })

  beforeEach(() => {
-    jest.clearAllMocks()
+    // Mock setSecret
+    jest.spyOn(core, 'setSecret').mockImplementation((secret: string) => {})
+
+    // Mock error/warning/info/debug
+    jest.spyOn(core, 'error').mockImplementation(jest.fn())
+    jest.spyOn(core, 'warning').mockImplementation(jest.fn())
+    jest.spyOn(core, 'info').mockImplementation(jest.fn())
+    jest.spyOn(core, 'debug').mockImplementation(jest.fn())
+
+    // Mock state helper
+    jest.spyOn(stateHelper, 'setSshKeyPath').mockImplementation(jest.fn())
+    jest
+      .spyOn(stateHelper, 'setSshKnownHostsPath')
+      .mockImplementation(jest.fn())
  })

  afterEach(() => {
    // Unregister mocks
-    jest.clearAllMocks()
+    jest.restoreAllMocks()

    // Restore HOME
    if (originalHome) {
@@ -250,7 +229,7 @@ describe('git-auth-helper tests', () => {
    await authHelper.configureAuth()

    // Assert secret
-    const setSecretSpy = core.setSecret as jest.Mock<any>
+    const setSecretSpy = core.setSecret as jest.Mock<any, any>
    expect(setSecretSpy).toHaveBeenCalledTimes(1)
    const expectedSecret = Buffer.from(
      `x-access-token:${settings.authToken}`,
@@ -550,7 +529,7 @@ describe('git-auth-helper tests', () => {
      settings.sshKey = ''
      const authHelper = gitAuthHelper.createAuthHelper(git, settings)
      await authHelper.configureAuth()
-      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any>
+      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any, any>
      mockSubmoduleForeach.mockClear() // reset calls

      // Act
@@ -583,7 +562,7 @@ describe('git-auth-helper tests', () => {
      settings.persistCredentials = false
      const authHelper = gitAuthHelper.createAuthHelper(git, settings)
      await authHelper.configureAuth()
-      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any>
+      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any, any>
      mockSubmoduleForeach.mockClear() // reset calls

      // Act
@@ -609,7 +588,7 @@ describe('git-auth-helper tests', () => {
      settings.sshKey = ''
      const authHelper = gitAuthHelper.createAuthHelper(git, settings)
      await authHelper.configureAuth()
-      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any>
+      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any, any>
      mockSubmoduleForeach.mockClear() // reset calls

      // Act
@@ -648,7 +627,7 @@ describe('git-auth-helper tests', () => {
      )
      const authHelper = gitAuthHelper.createAuthHelper(git, settings)
      await authHelper.configureAuth()
-      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any>
+      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any, any>
      mockSubmoduleForeach.mockClear() // reset calls

      // Act
@@ -830,7 +809,7 @@ describe('git-auth-helper tests', () => {

    // Mock getSubmoduleConfigPaths to return our fake submodules (for both configure and remove)
    const mockGetSubmoduleConfigPaths =
-      git.getSubmoduleConfigPaths as jest.Mock<any>
+      git.getSubmoduleConfigPaths as jest.Mock<any, any>
    mockGetSubmoduleConfigPaths.mockResolvedValue([
      submodule1ConfigPath,
      submodule2ConfigPath
@@ -1168,7 +1147,7 @@ async function setup(testName: string): Promise<void> {
    ),
    tryReset: jest.fn(),
    version: jest.fn()
-  } as unknown as IGitCommandManager & {env: {[key: string]: string}}
+  }

  settings = {
    authToken: 'some auth token',
@@ -1,51 +1,26 @@
-import {
-  jest,
-  describe,
-  it,
-  expect,
-  beforeAll,
-  beforeEach,
-  afterEach,
-  afterAll
-} from '@jest/globals'
+import * as exec from '@actions/exec'
+import * as fshelper from '../lib/fs-helper'
+import * as commandManager from '../lib/git-command-manager'

-// Mock @actions/exec
-const mockExec = jest.fn()
-jest.unstable_mockModule('@actions/exec', () => ({
-  exec: mockExec
-}))
-
-// Mock fs-helper
-const mockFileExistsSync = jest.fn()
-const mockDirectoryExistsSync = jest.fn()
-jest.unstable_mockModule('../src/fs-helper.js', () => ({
-  fileExistsSync: mockFileExistsSync,
-  directoryExistsSync: mockDirectoryExistsSync
-}))
-
-// Dynamic imports after mocking
-const commandManager = await import('../src/git-command-manager.js')
-type IGitCommandManager =
-  import('../src/git-command-manager.js').IGitCommandManager
-
-let git: IGitCommandManager
+let git: commandManager.IGitCommandManager
+let mockExec = jest.fn()

 describe('git-auth-helper tests', () => {
  beforeAll(async () => {})

  beforeEach(async () => {
-    mockFileExistsSync.mockReset()
-    mockDirectoryExistsSync.mockReset()
+    jest.spyOn(fshelper, 'fileExistsSync').mockImplementation(jest.fn())
+    jest.spyOn(fshelper, 'directoryExistsSync').mockImplementation(jest.fn())
  })

  afterEach(() => {
-    jest.clearAllMocks()
+    jest.restoreAllMocks()
  })

  afterAll(() => {})

  it('branch list matches', async () => {
-    mockExec.mockImplementation((path: any, args: any, options: any) => {
+    mockExec.mockImplementation((path, args, options) => {
      console.log(args, options.listeners.stdout)

      if (args.includes('version')) {
@@ -61,7 +36,7 @@ describe('git-auth-helper tests', () => {

      return 1
    })
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
    const workingDirectory = 'test'
    const lfs = false
    const doSparseCheckout = false
@@ -78,7 +53,7 @@ describe('git-auth-helper tests', () => {
  })

  it('ambiguous ref name output is captured', async () => {
-    mockExec.mockImplementation((path: any, args: any, options: any) => {
+    mockExec.mockImplementation((path, args, options) => {
      console.log(args, options.listeners.stdout)

      if (args.includes('version')) {
@@ -97,7 +72,7 @@ describe('git-auth-helper tests', () => {

      return 1
    })
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
    const workingDirectory = 'test'
    const lfs = false
    const doSparseCheckout = false
@@ -116,9 +91,9 @@ describe('git-auth-helper tests', () => {

 describe('Test fetchDepth and fetchTags options', () => {
  beforeEach(async () => {
-    mockFileExistsSync.mockReset()
-    mockDirectoryExistsSync.mockReset()
-    mockExec.mockImplementation((path: any, args: any, options: any) => {
+    jest.spyOn(fshelper, 'fileExistsSync').mockImplementation(jest.fn())
+    jest.spyOn(fshelper, 'directoryExistsSync').mockImplementation(jest.fn())
+    mockExec.mockImplementation((path, args, options) => {
      console.log(args, options.listeners.stdout)

      if (args.includes('version')) {
@@ -130,11 +105,11 @@ describe('Test fetchDepth and fetchTags options', () => {
  })

  afterEach(() => {
-    jest.clearAllMocks()
+    jest.restoreAllMocks()
  })

  it('should call execGit with the correct arguments when fetchDepth is 0', async () => {
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)
    const workingDirectory = 'test'
    const lfs = false
    const doSparseCheckout = false
@@ -171,7 +146,7 @@ describe('Test fetchDepth and fetchTags options', () => {
  })

  it('should call execGit with the correct arguments when fetchDepth is 0 and refSpec includes tags', async () => {
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)

    const workingDirectory = 'test'
    const lfs = false
@@ -209,7 +184,7 @@ describe('Test fetchDepth and fetchTags options', () => {
  })

  it('should call execGit with the correct arguments when fetchDepth is 1', async () => {
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)

    const workingDirectory = 'test'
    const lfs = false
@@ -247,7 +222,7 @@ describe('Test fetchDepth and fetchTags options', () => {
  })

  it('should call execGit with the correct arguments when fetchDepth is 1 and refSpec includes tags', async () => {
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)

    const workingDirectory = 'test'
    const lfs = false
@@ -286,7 +261,7 @@ describe('Test fetchDepth and fetchTags options', () => {
  })

  it('should call execGit with the correct arguments when showProgress is true', async () => {
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)

    const workingDirectory = 'test'
    const lfs = false
@@ -324,7 +299,7 @@ describe('Test fetchDepth and fetchTags options', () => {
  })

  it('should call execGit with the correct arguments when fetchDepth is 42 and showProgress is true', async () => {
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)

    const workingDirectory = 'test'
    const lfs = false
@@ -364,7 +339,7 @@ describe('Test fetchDepth and fetchTags options', () => {
  })

  it('should call execGit with the correct arguments when showProgress is true and refSpec includes tags', async () => {
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)

    const workingDirectory = 'test'
    const lfs = false
@@ -405,23 +380,23 @@ describe('Test fetchDepth and fetchTags options', () => {

 describe('repository initialization object format', () => {
  beforeEach(async () => {
-    mockFileExistsSync.mockReset()
-    mockDirectoryExistsSync.mockReset()
+    jest.spyOn(fshelper, 'fileExistsSync').mockImplementation(jest.fn())
+    jest.spyOn(fshelper, 'directoryExistsSync').mockImplementation(jest.fn())
  })

  afterEach(() => {
-    jest.clearAllMocks()
+    jest.restoreAllMocks()
  })

  it('initializes SHA-256 repositories with the matching object format', async () => {
-    mockExec.mockImplementation((path: any, args: any, options: any) => {
+    mockExec.mockImplementation((path, args, options) => {
      if (args.includes('version')) {
        options.listeners.stdout(Buffer.from('git version 2.50.1'))
      }

      return 0
    })
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)

    git = await commandManager.createCommandManager('test', false, false)

@@ -435,14 +410,14 @@ describe('repository initialization object format', () => {
  })

  it('initializes SHA-1 repositories with existing default arguments', async () => {
-    mockExec.mockImplementation((path: any, args: any, options: any) => {
+    mockExec.mockImplementation((path, args, options) => {
      if (args.includes('version')) {
        options.listeners.stdout(Buffer.from('git version 2.50.1'))
      }

      return 0
    })
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)

    git = await commandManager.createCommandManager('test', false, false)

@@ -458,12 +433,12 @@ describe('repository initialization object format', () => {

 describe('git user-agent with orchestration ID', () => {
  beforeEach(async () => {
-    mockFileExistsSync.mockReset()
-    mockDirectoryExistsSync.mockReset()
+    jest.spyOn(fshelper, 'fileExistsSync').mockImplementation(jest.fn())
+    jest.spyOn(fshelper, 'directoryExistsSync').mockImplementation(jest.fn())
  })

  afterEach(() => {
-    jest.clearAllMocks()
+    jest.restoreAllMocks()
    // Clean up environment variable to prevent test pollution
    delete process.env['ACTIONS_ORCHESTRATION_ID']
  })
@@ -473,7 +448,7 @@ describe('git user-agent with orchestration ID', () => {
    process.env['ACTIONS_ORCHESTRATION_ID'] = orchId

    let capturedEnv: any = null
-    mockExec.mockImplementation((path: any, args: any, options: any) => {
+    mockExec.mockImplementation((path, args, options) => {
      if (args.includes('version')) {
        options.listeners.stdout(Buffer.from('2.18'))
      }
@@ -481,7 +456,7 @@ describe('git user-agent with orchestration ID', () => {
      capturedEnv = options.env
      return 0
    })
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)

    const workingDirectory = 'test'
    const lfs = false
@@ -508,7 +483,7 @@ describe('git user-agent with orchestration ID', () => {
    process.env['ACTIONS_ORCHESTRATION_ID'] = orchId

    let capturedEnv: any = null
-    mockExec.mockImplementation((path: any, args: any, options: any) => {
+    mockExec.mockImplementation((path, args, options) => {
      if (args.includes('version')) {
        options.listeners.stdout(Buffer.from('2.18'))
      }
@@ -516,7 +491,7 @@ describe('git user-agent with orchestration ID', () => {
      capturedEnv = options.env
      return 0
    })
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)

    const workingDirectory = 'test'
    const lfs = false
@@ -542,7 +517,7 @@ describe('git user-agent with orchestration ID', () => {
    delete process.env['ACTIONS_ORCHESTRATION_ID']

    let capturedEnv: any = null
-    mockExec.mockImplementation((path: any, args: any, options: any) => {
+    mockExec.mockImplementation((path, args, options) => {
      if (args.includes('version')) {
        options.listeners.stdout(Buffer.from('2.18'))
      }
@@ -550,7 +525,7 @@ describe('git user-agent with orchestration ID', () => {
      capturedEnv = options.env
      return 0
    })
-    // exec.exec is already mockExec
+    jest.spyOn(exec, 'exec').mockImplementation(mockExec)

    const workingDirectory = 'test'
    const lfs = false
@@ -1,36 +1,9 @@
-import {
-  jest,
-  describe,
-  it,
-  expect,
-  beforeAll,
-  beforeEach,
-  afterEach
-} from '@jest/globals'
+import * as core from '@actions/core'
 import * as fs from 'fs'
+import * as gitDirectoryHelper from '../lib/git-directory-helper'
 import * as io from '@actions/io'
 import * as path from 'path'
-import {fileURLToPath} from 'url'
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-
-// Mock @actions/core before loading git-directory-helper
-jest.unstable_mockModule('@actions/core', () => ({
-  error: jest.fn(),
-  warning: jest.fn(),
-  info: jest.fn(),
-  debug: jest.fn(),
-  setFailed: jest.fn(),
-  startGroup: jest.fn(),
-  endGroup: jest.fn()
-}))
-
-// Dynamic imports after mocking
-const core = await import('@actions/core')
-const gitDirectoryHelper = await import('../src/git-directory-helper.js')
-
-type IGitCommandManager =
-  import('../src/git-command-manager.js').IGitCommandManager
+import {IGitCommandManager} from '../lib/git-command-manager'

 const testWorkspace = path.join(__dirname, '_temp', 'git-directory-helper')
 let repositoryPath: string
@@ -46,11 +19,16 @@ describe('git-directory-helper tests', () => {
  })

  beforeEach(() => {
-    jest.clearAllMocks()
+    // Mock error/warning/info/debug
+    jest.spyOn(core, 'error').mockImplementation(jest.fn())
+    jest.spyOn(core, 'warning').mockImplementation(jest.fn())
+    jest.spyOn(core, 'info').mockImplementation(jest.fn())
+    jest.spyOn(core, 'debug').mockImplementation(jest.fn())
  })

  afterEach(() => {
-    jest.clearAllMocks()
+    // Unregister mocks
+    jest.restoreAllMocks()
  })

  const cleansWhenCleanTrue = 'cleans when clean true'
@@ -103,7 +81,7 @@ describe('git-directory-helper tests', () => {
    // Arrange
    await setup(doesNotCheckoutDetachWhenNotAlreadyDetached)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    const mockIsDetached = git.isDetached as jest.Mock<any>
+    const mockIsDetached = git.isDetached as jest.Mock<any, any>
    mockIsDetached.mockImplementation(async () => {
      return true
    })
@@ -154,7 +132,7 @@ describe('git-directory-helper tests', () => {
    // Arrange
    await setup(removesContentsWhenCleanFails)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    let mockTryClean = git.tryClean as jest.Mock<any>
+    let mockTryClean = git.tryClean as jest.Mock<any, any>
    mockTryClean.mockImplementation(async () => {
      return false
    })
@@ -232,7 +210,7 @@ describe('git-directory-helper tests', () => {
    // Arrange
    await setup(removesContentsWhenResetFails)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    let mockTryReset = git.tryReset as jest.Mock<any>
+    let mockTryReset = git.tryReset as jest.Mock<any, any>
    mockTryReset.mockImplementation(async () => {
      return false
    })
@@ -282,7 +260,7 @@ describe('git-directory-helper tests', () => {
    // Arrange
    await setup(removesLocalBranches)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    const mockBranchList = git.branchList as jest.Mock<any>
+    const mockBranchList = git.branchList as jest.Mock<any, any>
    mockBranchList.mockImplementation(async (remote: boolean) => {
      return remote ? [] : ['local-branch-1', 'local-branch-2']
    })
@@ -313,7 +291,7 @@ describe('git-directory-helper tests', () => {

    //mock bad submodule

-    const submoduleStatus = git.submoduleStatus as jest.Mock<any>
+    const submoduleStatus = git.submoduleStatus as jest.Mock<any, any>
    submoduleStatus.mockImplementation(async (remote: boolean) => {
      return false
    })
@@ -341,7 +319,7 @@ describe('git-directory-helper tests', () => {
    await setup(doesNotCleanWhenSubmoduleStatusIsTrue)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')

-    const submoduleStatus = git.submoduleStatus as jest.Mock<any>
+    const submoduleStatus = git.submoduleStatus as jest.Mock<any, any>
    submoduleStatus.mockImplementation(async (remote: boolean) => {
      return true
    })
@@ -403,7 +381,7 @@ describe('git-directory-helper tests', () => {
    // Arrange
    await setup(removesAncestorRemoteBranch)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    const mockBranchList = git.branchList as jest.Mock<any>
+    const mockBranchList = git.branchList as jest.Mock<any, any>
    mockBranchList.mockImplementation(async (remote: boolean) => {
      return remote ? ['origin/remote-branch-1', 'origin/remote-branch-2'] : []
    })
@@ -433,7 +411,7 @@ describe('git-directory-helper tests', () => {
    // Arrange
    await setup(removesDescendantRemoteBranches)
    await fs.promises.writeFile(path.join(repositoryPath, 'my-file'), '')
-    const mockBranchList = git.branchList as jest.Mock<any>
+    const mockBranchList = git.branchList as jest.Mock<any, any>
    mockBranchList.mockImplementation(async (remote: boolean) => {
      return remote
        ? ['origin/remote-branch-1/conflict', 'origin/remote-branch-2']
@@ -529,5 +507,5 @@ async function setup(testName: string): Promise<void> {
      return true
    }),
    version: jest.fn()
-  } as unknown as IGitCommandManager
+  }
 }
@@ -1,6 +1,5 @@
-import {describe, it, expect} from '@jest/globals'
-import {GitVersion} from '../src/git-version.js'
-import {MinimumGitSparseCheckoutVersion} from '../src/git-command-manager.js'
+import {GitVersion} from '../src/git-version'
+import {MinimumGitSparseCheckoutVersion} from '../src/git-command-manager'

 describe('git-version tests', () => {
  it('basics', async () => {
@@ -1,25 +1,11 @@
-import {jest, describe, it, expect, beforeEach, afterEach} from '@jest/globals'
-
-// Mock @actions/core
-const mockDebug = jest.fn()
-jest.unstable_mockModule('@actions/core', () => ({
-  debug: mockDebug,
-  info: jest.fn(),
-  warning: jest.fn(),
-  error: jest.fn()
-}))
-
-// Mock @actions/github
-const mockGetOctokit = jest.fn()
-jest.unstable_mockModule('@actions/github', () => ({
-  getOctokit: mockGetOctokit
-}))
-
-// Dynamic imports after mocking
-const githubApiHelper = await import('../src/github-api-helper.js')
+import * as core from '@actions/core'
+import * as github from '@actions/github'
+import * as githubApiHelper from '../lib/github-api-helper'

 describe('github-api-helper object format', () => {
-  let request: jest.Mock<any>
+  let getOctokitSpy: jest.SpyInstance
+  let debugSpy: jest.SpyInstance
+  let request: jest.Mock

  function mockHashAlgorithmApi(hashAlgorithm: string): void {
    request = jest.fn(async () => ({
@@ -27,18 +13,17 @@ describe('github-api-helper object format', () => {
        hash_algorithm: hashAlgorithm
      }
    }))
-    mockGetOctokit.mockReturnValue({
+    getOctokitSpy = jest.spyOn(github, 'getOctokit').mockReturnValue({
      request
    } as any)
  }

  beforeEach(() => {
-    mockDebug.mockClear()
-    mockGetOctokit.mockClear()
+    debugSpy = jest.spyOn(core, 'debug').mockImplementation(jest.fn())
  })

  afterEach(() => {
-    jest.clearAllMocks()
+    jest.restoreAllMocks()
  })

  it('detects SHA-256 from the repository hash algorithm endpoint', async () => {
@@ -48,7 +33,7 @@ describe('github-api-helper object format', () => {
      githubApiHelper.tryGetRepositoryObjectFormat('token', 'owner', 'repo')
    ).resolves.toEqual({format: 'sha256', succeeded: true})

-    expect(mockGetOctokit).toHaveBeenCalledWith(
+    expect(getOctokitSpy).toHaveBeenCalledWith(
      'token',
      expect.objectContaining({baseUrl: 'https://api.github.com'})
    )
@@ -69,6 +54,7 @@ describe('github-api-helper object format', () => {
  it('detects object format from an existing commit without API calls', async () => {
    const commitSha =
      '9422233ca7ee1b17f1e905d0e141faf0c401556c41cdc6acd71c6bd685da2e92'
+    getOctokitSpy = jest.spyOn(github, 'getOctokit')

    await expect(
      githubApiHelper.tryGetRepositoryObjectFormat(
@@ -80,7 +66,7 @@ describe('github-api-helper object format', () => {
      )
    ).resolves.toEqual({format: 'sha256', succeeded: true})

-    expect(mockGetOctokit).not.toHaveBeenCalled()
+    expect(getOctokitSpy).not.toHaveBeenCalled()
  })

  it('returns unsuccessful when the hash algorithm endpoint value is not recognized', async () => {
@@ -89,7 +75,7 @@ describe('github-api-helper object format', () => {
    await expect(
      githubApiHelper.tryGetRepositoryObjectFormat('token', 'owner', 'repo')
    ).resolves.toEqual({format: '', succeeded: false})
-    expect(mockDebug).toHaveBeenCalledWith(
+    expect(debugSpy).toHaveBeenCalledWith(
      'Unable to determine repository object format from hash-algorithm endpoint'
    )
  })
@@ -98,14 +84,14 @@ describe('github-api-helper object format', () => {
    request = jest.fn(async () => {
      throw new Error('not found')
    })
-    mockGetOctokit.mockReturnValue({
+    jest.spyOn(github, 'getOctokit').mockReturnValue({
      request
    } as any)

    await expect(
      githubApiHelper.tryGetRepositoryObjectFormat('token', 'owner', 'repo')
    ).resolves.toEqual({format: '', succeeded: false})
-    expect(mockDebug).toHaveBeenCalledWith(
+    expect(debugSpy).toHaveBeenCalledWith(
      'Unable to determine repository object format from hash-algorithm endpoint: not found'
    )
  })
@@ -1,13 +1,10 @@
-import {
-  jest,
-  describe,
-  it,
-  expect,
-  beforeAll,
-  beforeEach,
-  afterAll
-} from '@jest/globals'
+import * as core from '@actions/core'
+import * as fsHelper from '../lib/fs-helper'
+import * as github from '@actions/github'
+import * as inputHelper from '../lib/input-helper'
 import * as path from 'path'
+import * as workflowContextHelper from '../lib/workflow-context-helper'
+import {IGitSourceSettings} from '../lib/git-source-settings'

 const originalGitHubWorkspace = process.env['GITHUB_WORKSPACE']
 const gitHubWorkspace = path.resolve('/checkout-tests/workspace')
@@ -15,58 +12,51 @@ const gitHubWorkspace = path.resolve('/checkout-tests/workspace')
 // Inputs for mock @actions/core
 let inputs = {} as any

-// Mutable mock github context
-const mockGithubContext: any = {
-  ref: 'refs/heads/some-ref',
-  sha: '1234567890123456789012345678901234567890',
-  repo: {owner: 'some-owner', repo: 'some-repo'},
-  eventName: '',
-  payload: {}
+// Replicate @actions/core getInput behavior: it trims whitespace by default
+// (String.prototype.trim(), which strips characters such as a leading U+FEFF BOM)
+// unless trimWhitespace is explicitly set to false.
+const getInputImpl = (name: string, options?: {trimWhitespace?: boolean}) => {
+  const val = inputs[name] ?? ''
+  if (options && options.trimWhitespace === false) {
+    return val
+  }
+  return typeof val === 'string' ? val.trim() : val
 }

-// Mock @actions/core before loading input-helper
-jest.unstable_mockModule('@actions/core', () => ({
-  getInput: jest.fn((name: string) => inputs[name]),
-  getBooleanInput: jest.fn((name: string) => inputs[name]),
-  getMultilineInput: jest.fn((name: string) =>
-    inputs[name] ? String(inputs[name]).split('\n').filter(Boolean) : []
-  ),
-  error: jest.fn(),
-  warning: jest.fn(),
-  info: jest.fn(),
-  debug: jest.fn(),
-  setFailed: jest.fn(),
-  setOutput: jest.fn(),
-  setSecret: jest.fn()
-}))
-
-// Mock @actions/github before loading input-helper
-jest.unstable_mockModule('@actions/github', () => ({
-  context: mockGithubContext,
-  getOctokit: jest.fn()
-}))
-
-// Mock fs-helper
-const mockDirectoryExistsSync = jest.fn((p: string) => p === gitHubWorkspace)
-jest.unstable_mockModule('../src/fs-helper.js', () => ({
-  directoryExistsSync: mockDirectoryExistsSync,
-  fileExistsSync: jest.fn()
-}))
-
-// Mock workflow-context-helper
-const mockGetOrganizationId = jest.fn(async () => 123456)
-jest.unstable_mockModule('../src/workflow-context-helper.js', () => ({
-  getOrganizationId: mockGetOrganizationId
-}))
-
-// Dynamic imports after mocking
-const core = await import('@actions/core')
-const inputHelper = await import('../src/input-helper.js')
-type IGitSourceSettings =
-  import('../src/git-source-settings.js').IGitSourceSettings
+// Shallow clone original @actions/github context
+let originalContext = {...github.context}

 describe('input-helper tests', () => {
  beforeAll(() => {
+    // Mock getInput
+    jest.spyOn(core, 'getInput').mockImplementation(getInputImpl as any)
+
+    // Mock error/warning/info/debug
+    jest.spyOn(core, 'error').mockImplementation(jest.fn())
+    jest.spyOn(core, 'warning').mockImplementation(jest.fn())
+    jest.spyOn(core, 'info').mockImplementation(jest.fn())
+    jest.spyOn(core, 'debug').mockImplementation(jest.fn())
+
+    // Mock github context
+    jest.spyOn(github.context, 'repo', 'get').mockImplementation(() => {
+      return {
+        owner: 'some-owner',
+        repo: 'some-repo'
+      }
+    })
+    github.context.ref = 'refs/heads/some-ref'
+    github.context.sha = '1234567890123456789012345678901234567890'
+
+    // Mock ./fs-helper directoryExistsSync()
+    jest
+      .spyOn(fsHelper, 'directoryExistsSync')
+      .mockImplementation((path: string) => path == gitHubWorkspace)
+
+    // Mock ./workflowContextHelper getOrganizationId()
+    jest
+      .spyOn(workflowContextHelper, 'getOrganizationId')
+      .mockImplementation(() => Promise.resolve(123456))
+
    // GitHub workspace
    process.env['GITHUB_WORKSPACE'] = gitHubWorkspace
  })
@@ -74,15 +64,6 @@ describe('input-helper tests', () => {
  beforeEach(() => {
    // Reset inputs
    inputs = {}
-    jest.clearAllMocks()
-    // Re-apply default mocks
-    ;(core.getInput as jest.Mock<any>).mockImplementation(
-      (name: string) => inputs[name]
-    )
-    mockDirectoryExistsSync.mockImplementation(
-      (p: string) => p === gitHubWorkspace
-    )
-    mockGetOrganizationId.mockResolvedValue(123456)
  })

  afterAll(() => {
@@ -93,8 +74,11 @@ describe('input-helper tests', () => {
    }

    // Restore @actions/github context
-    mockGithubContext.ref = 'refs/heads/some-ref'
-    mockGithubContext.sha = '1234567890123456789012345678901234567890'
+    github.context.ref = originalContext.ref
+    github.context.sha = originalContext.sha
+
+    // Restore
+    jest.restoreAllMocks()
  })

  it('sets defaults', async () => {
@@ -120,15 +104,15 @@ describe('input-helper tests', () => {
  })

  it('qualifies ref', async () => {
-    let originalRef = mockGithubContext.ref
+    let originalRef = github.context.ref
    try {
-      mockGithubContext.ref = 'some-unqualified-ref'
+      github.context.ref = 'some-unqualified-ref'
      const settings: IGitSourceSettings = await inputHelper.getInputs()
      expect(settings).toBeTruthy()
      expect(settings.commit).toBe('1234567890123456789012345678901234567890')
      expect(settings.ref).toBe('refs/heads/some-unqualified-ref')
    } finally {
-      mockGithubContext.ref = originalRef
+      github.context.ref = originalRef
    }
  })

@@ -176,8 +160,86 @@ describe('input-helper tests', () => {
    expect(settings.commit).toBeFalsy()
  })

+  it('does not reclassify a ref as sha when a BOM is prefixed', async () => {
+    // A fork branch named "<U+FEFF>" + 40 hex chars. core.getInput trims the
+    // BOM by default, which previously collapsed this into a bare SHA and
+    // bypassed the unsafe fork PR checkout guard.
+    inputs.ref = '\uFEFF522d932fae5296da51fdf431934425ecf891c6a2'
+    const settings: IGitSourceSettings = await inputHelper.getInputs()
+    expect(settings.commit).toBeFalsy()
+    expect(settings.ref).toBe('522d932fae5296da51fdf431934425ecf891c6a2')
+  })
+
+  it('does not reclassify a sha-256 ref as sha when a BOM is prefixed', async () => {
+    inputs.ref =
+      '\uFEFF1111111111222222222233333333334444444444555555555566666666667777'
+    const settings: IGitSourceSettings = await inputHelper.getInputs()
+    expect(settings.commit).toBeFalsy()
+    expect(settings.ref).toBe(
+      '1111111111222222222233333333334444444444555555555566666666667777'
+    )
+  })
+
+  it('treats a sha surrounded by ascii whitespace as a commit', async () => {
+    // ASCII whitespace can only come from the workflow author's YAML (git ref
+    // names cannot contain it), so trimming it and treating the value as a
+    // commit is safe.
+    inputs.ref = '  1111111111222222222233333333334444444444  '
+    const settings: IGitSourceSettings = await inputHelper.getInputs()
+    expect(settings.ref).toBeFalsy()
+    expect(settings.commit).toBe('1111111111222222222233333333334444444444')
+  })
+
  it('sets workflow organization ID', async () => {
    const settings: IGitSourceSettings = await inputHelper.getInputs()
    expect(settings.workflowOrganizationId).toBe(123456)
  })
+
+  describe('unsafe PR checkout guard', () => {
+    const forkPayload = {
+      repository: {id: 100},
+      pull_request: {
+        head: {
+          sha: '1234567890123456789012345678901234567890',
+          repo: {id: 200, full_name: 'attacker/fork'}
+        },
+        merge_commit_sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
+      }
+    }
+
+    it('allows the default self-checkout on a fork pull_request_target', async () => {
+      const originalEvent = github.context.eventName
+      const originalPayload = github.context.payload
+      const originalSha = github.context.sha
+      try {
+        github.context.eventName = 'pull_request_target'
+        github.context.payload = forkPayload as any
+        // Simulate a rebase/fast-forward merge where the base tip (event SHA)
+        // equals the PR head SHA. The default self-checkout must still succeed.
+        github.context.sha = '1234567890123456789012345678901234567890'
+        const settings: IGitSourceSettings = await inputHelper.getInputs()
+        expect(settings.commit).toBe('1234567890123456789012345678901234567890')
+      } finally {
+        github.context.eventName = originalEvent
+        github.context.payload = originalPayload
+        github.context.sha = originalSha
+      }
+    })
+
+    it('refuses an explicit fork repository on pull_request_target', async () => {
+      const originalEvent = github.context.eventName
+      const originalPayload = github.context.payload
+      try {
+        github.context.eventName = 'pull_request_target'
+        github.context.payload = forkPayload as any
+        inputs.repository = 'attacker/fork'
+        await expect(inputHelper.getInputs()).rejects.toThrow(
+          /Refusing to check out fork pull request code/
+        )
+      } finally {
+        github.context.eventName = originalEvent
+        github.context.payload = originalPayload
+      }
+    })
+  })
 })
@@ -1,36 +1,8 @@
-import {jest, describe, it, expect, beforeEach, afterEach} from '@jest/globals'
 import * as assert from 'assert'
-
-// Mutable mock github context
-const mockGithubContext: any = {
-  eventName: '',
-  payload: {},
-  repo: {owner: 'some-owner', repo: 'some-repo'},
-  ref: '',
-  sha: ''
-}
-
-// Mock @actions/core
-const mockDebug = jest.fn()
-jest.unstable_mockModule('@actions/core', () => ({
-  debug: mockDebug,
-  info: jest.fn(),
-  warning: jest.fn(),
-  error: jest.fn(),
-  setFailed: jest.fn()
-}))
-
-// Mock @actions/github
-const mockGetOctokit = jest.fn()
-jest.unstable_mockModule('@actions/github', () => ({
-  context: mockGithubContext,
-  getOctokit: mockGetOctokit
-}))
-
-// Dynamic imports after mocking
-const refHelper = await import('../src/ref-helper.js')
-type IGitCommandManager =
-  import('../src/git-command-manager.js').IGitCommandManager
+import * as core from '@actions/core'
+import * as github from '@actions/github'
+import * as refHelper from '../lib/ref-helper'
+import {IGitCommandManager} from '../lib/git-command-manager'

 const commit = '1234567890123456789012345678901234567890'
 const sha256Commit =
@@ -40,7 +12,6 @@ let git: IGitCommandManager
 describe('ref-helper tests', () => {
  beforeEach(() => {
    git = {} as unknown as IGitCommandManager
-    jest.clearAllMocks()
  })

  it('getCheckoutInfo requires git', async () => {
@@ -195,12 +166,14 @@ describe('ref-helper tests', () => {
  })

  it('getRefSpec sha + refs/tags/ with fetchTags', async () => {
+    // When fetchTags is true, only include tags wildcard (specific tag is redundant)
    const refSpec = refHelper.getRefSpec('refs/tags/my-tag', commit, true)
    expect(refSpec.length).toBe(1)
    expect(refSpec[0]).toBe('+refs/tags/*:refs/tags/*')
  })

  it('getRefSpec sha + refs/heads/ with fetchTags', async () => {
+    // When fetchTags is true, include both the branch refspec and tags wildcard
    const refSpec = refHelper.getRefSpec('refs/heads/my/branch', commit, true)
    expect(refSpec.length).toBe(2)
    expect(refSpec[0]).toBe('+refs/tags/*:refs/tags/*')
@@ -221,6 +194,7 @@ describe('ref-helper tests', () => {
  })

  it('getRefSpec unqualified ref only with fetchTags', async () => {
+    // When fetchTags is true, skip specific tag pattern since wildcard covers all
    const refSpec = refHelper.getRefSpec('my-ref', '', true)
    expect(refSpec.length).toBe(2)
    expect(refSpec[0]).toBe('+refs/tags/*:refs/tags/*')
@@ -248,12 +222,14 @@ describe('ref-helper tests', () => {
  })

  it('getRefSpec refs/tags/ only with fetchTags', async () => {
+    // When fetchTags is true, only include tags wildcard (specific tag is redundant)
    const refSpec = refHelper.getRefSpec('refs/tags/my-tag', '', true)
    expect(refSpec.length).toBe(1)
    expect(refSpec[0]).toBe('+refs/tags/*:refs/tags/*')
  })

  it('getRefSpec refs/heads/ only with fetchTags', async () => {
+    // When fetchTags is true, include both the branch refspec and tags wildcard
    const refSpec = refHelper.getRefSpec('refs/heads/my/branch', '', true)
    expect(refSpec.length).toBe(2)
    expect(refSpec[0]).toBe('+refs/tags/*:refs/tags/*')
@@ -272,7 +248,9 @@ describe('ref-helper tests', () => {
      '1111111111222222222233333333334444444444555555555566666666667777'
    const sha256Base =
      'aaaaaaaaaabbbbbbbbbbccccccccccddddddddddeeeeeeeeeeffffffffff0000'
-    let repoGetSpy: jest.Mock<any>
+    let debugSpy: jest.SpyInstance
+    let getOctokitSpy: jest.SpyInstance
+    let repoGetSpy: jest.Mock
    let originalEventName: string
    let originalPayload: unknown
    let originalRef: string
@@ -283,10 +261,10 @@ describe('ref-helper tests', () => {
      expectedBaseSha: string,
      mergeCommit: string
    ): void {
-      mockGithubContext.eventName = 'pull_request'
-      mockGithubContext.ref = ref
-      mockGithubContext.sha = mergeCommit
-      mockGithubContext.payload = {
+      ;(github.context as any).eventName = 'pull_request'
+      github.context.ref = ref
+      github.context.sha = mergeCommit
+      ;(github.context as any).payload = {
        action: 'synchronize',
        after: expectedHeadSha,
        number: 123,
@@ -302,18 +280,18 @@ describe('ref-helper tests', () => {
    }

    beforeEach(() => {
-      originalEventName = mockGithubContext.eventName
-      originalPayload = mockGithubContext.payload
-      originalRef = mockGithubContext.ref
-      originalSha = mockGithubContext.sha
+      originalEventName = github.context.eventName
+      originalPayload = github.context.payload
+      originalRef = github.context.ref
+      originalSha = github.context.sha

-      mockGithubContext.repo = {
+      jest.spyOn(github.context, 'repo', 'get').mockReturnValue({
        owner: repositoryOwner,
        repo: repositoryName
-      }
-
+      })
+      debugSpy = jest.spyOn(core, 'debug').mockImplementation(jest.fn())
      repoGetSpy = jest.fn(async () => ({}))
-      mockGetOctokit.mockReturnValue({
+      getOctokitSpy = jest.spyOn(github, 'getOctokit').mockReturnValue({
        rest: {
          repos: {
            get: repoGetSpy
@@ -323,11 +301,11 @@ describe('ref-helper tests', () => {
    })

    afterEach(() => {
-      mockGithubContext.eventName = originalEventName
-      mockGithubContext.payload = originalPayload
-      mockGithubContext.ref = originalRef
-      mockGithubContext.sha = originalSha
-      jest.clearAllMocks()
+      ;(github.context as any).eventName = originalEventName
+      ;(github.context as any).payload = originalPayload
+      github.context.ref = originalRef
+      github.context.sha = originalSha
+      jest.restoreAllMocks()
    })

    it('returns early for SHA-1 merge commit', async () => {
@@ -342,7 +320,7 @@ describe('ref-helper tests', () => {
        commit
      )

-      expect(mockGetOctokit).not.toHaveBeenCalled()
+      expect(getOctokitSpy).not.toHaveBeenCalled()
      expect(repoGetSpy).not.toHaveBeenCalled()
    })

@@ -360,7 +338,7 @@ describe('ref-helper tests', () => {
        sha256Commit
      )

-      expect(mockGetOctokit).toHaveBeenCalledWith(
+      expect(getOctokitSpy).toHaveBeenCalledWith(
        'token',
        expect.objectContaining({
          userAgent: expect.stringContaining(
@@ -372,10 +350,10 @@ describe('ref-helper tests', () => {
        owner: repositoryOwner,
        repo: repositoryName
      })
-      expect(mockDebug).toHaveBeenCalledWith(
+      expect(debugSpy).toHaveBeenCalledWith(
        `Expected head sha ${sha256Head}; actual head sha ${actualHeadSha}`
      )
-      expect(mockDebug).not.toHaveBeenCalledWith('Unexpected message format')
+      expect(debugSpy).not.toHaveBeenCalledWith('Unexpected message format')
    })

    it('does not match 50-char hex as a valid merge', async () => {
@@ -392,9 +370,9 @@ describe('ref-helper tests', () => {
        commit
      )

-      expect(mockGetOctokit).not.toHaveBeenCalled()
+      expect(getOctokitSpy).not.toHaveBeenCalled()
      expect(repoGetSpy).not.toHaveBeenCalled()
-      expect(mockDebug).toHaveBeenCalledWith('Unexpected message format')
+      expect(debugSpy).toHaveBeenCalledWith('Unexpected message format')
    })
  })
 })
@@ -1,32 +1,16 @@
-import {
-  jest,
-  describe,
-  it,
-  expect,
-  beforeAll,
-  beforeEach,
-  afterAll
-} from '@jest/globals'
-
-let info: string[] = []
-
-// Mock @actions/core before loading retry-helper
-jest.unstable_mockModule('@actions/core', () => ({
-  info: jest.fn((message: string) => {
-    info.push(message)
-  }),
-  debug: jest.fn(),
-  warning: jest.fn(),
-  error: jest.fn()
-}))
-
-// Dynamic imports after mocking
-const {RetryHelper} = await import('../src/retry-helper.js')
+import * as core from '@actions/core'
+import {RetryHelper} from '../lib/retry-helper'

+let info: string[]
 let retryHelper: any

 describe('retry-helper tests', () => {
  beforeAll(() => {
+    // Mock @actions/core info()
+    jest.spyOn(core, 'info').mockImplementation((message: string) => {
+      info.push(message)
+    })
+
    retryHelper = new RetryHelper(3, 0, 0)
  })

@@ -36,6 +20,7 @@ describe('retry-helper tests', () => {
  })

  afterAll(() => {
+    // Restore
    jest.restoreAllMocks()
  })

@@ -1,12 +1,10 @@
-import {
-  jest,
-  describe,
-  it,
-  expect,
-  beforeAll,
-  afterEach,
-  afterAll
-} from '@jest/globals'
+import * as github from '@actions/github'
+import {assertSafePrCheckout} from '../lib/unsafe-pr-checkout-helper'
+
+// Shallow clone original @actions/github context
+const originalContext = {...github.context}
+const originalEventName = github.context.eventName
+const originalPayload = github.context.payload

 const BASE_REPO_ID = 100
 const FORK_REPO_ID = 200
@@ -17,29 +15,9 @@ const WORKFLOW_RUN_HEAD_COMMIT_SHA = '4444444444444444444444444444444444444444'
 const BASE_QUALIFIED_REPO = 'some-owner/some-repo'
 const FORK_QUALIFIED_REPO = 'another-repo/fork'

-// Mutable mock context
-const mockContext: any = {
-  eventName: '',
-  payload: {},
-  repo: {owner: 'some-owner', repo: 'some-repo'},
-  ref: '',
-  sha: ''
-}
-
-jest.unstable_mockModule('@actions/github', () => ({
-  context: mockContext
-}))
-
-// Dynamic imports after mocking
-const {assertSafePrCheckout} =
-  await import('../src/unsafe-pr-checkout-helper.js')
-
-const originalEventName = mockContext.eventName
-const originalPayload = mockContext.payload
-
 function setContext(eventName: string, payload: object): void {
-  mockContext.eventName = eventName
-  mockContext.payload = payload
+  ;(github.context as {eventName: string}).eventName = eventName
+  ;(github.context as {payload: object}).payload = payload
 }

 function forkPullRequestTargetPayload(): object {
@@ -81,17 +59,22 @@ function forkWorkflowRunPayload(): object {

 describe('unsafe-pr-checkout-helper', () => {
  beforeAll(() => {
-    mockContext.repo = {owner: 'some-owner', repo: 'some-repo'}
+    jest.spyOn(github.context, 'repo', 'get').mockReturnValue({
+      owner: 'some-owner',
+      repo: 'some-repo'
+    })
  })

  afterEach(() => {
-    mockContext.eventName = originalEventName
-    mockContext.payload = originalPayload
+    ;(github.context as {eventName: string}).eventName = originalEventName
+    ;(github.context as {payload: object}).payload = originalPayload
  })

  afterAll(() => {
-    mockContext.eventName = originalEventName
-    mockContext.payload = originalPayload
+    ;(github.context as {eventName: string}).eventName =
+      originalContext.eventName
+    ;(github.context as {payload: object}).payload = originalContext.payload
+    jest.restoreAllMocks()
  })

  it('allows pull_request events untouched', () => {
@@ -1,5 +1,4 @@
-import {jest, describe, it, expect, beforeEach, afterAll} from '@jest/globals'
-import * as urlHelper from '../src/url-helper.js'
+import * as urlHelper from '../src/url-helper'

 describe('getServerUrl tests', () => {
  it('basics', async () => {
@@ -1,3 +0,0 @@
-{
-  "type": "module"
-}
@@ -1,62 +0,0 @@
-import github from 'eslint-plugin-github'
-import jest from 'eslint-plugin-jest'
-
-const githubConfigs = github.getFlatConfigs()
-
-export default [
-  {
-    ignores: ['**/node_modules/**', '**/lib/**', '**/dist/**']
-  },
-  githubConfigs.recommended,
-  ...githubConfigs.typescript,
-  {
-    files: ['**/*.ts'],
-    languageOptions: {
-      parserOptions: {
-        project: './tsconfig.json'
-      }
-    },
-    rules: {
-      'eslint-comments/no-use': 'off',
-      'import/no-namespace': 'off',
-      'no-unused-vars': 'off',
-      '@typescript-eslint/no-unused-vars': 'error',
-      '@typescript-eslint/explicit-member-accessibility': [
-        'error',
-        {accessibility: 'no-public'}
-      ],
-      '@typescript-eslint/no-require-imports': 'error',
-      '@typescript-eslint/array-type': 'error',
-      '@typescript-eslint/await-thenable': 'error',
-      camelcase: 'off',
-      '@typescript-eslint/explicit-function-return-type': [
-        'error',
-        {allowExpressions: true}
-      ],
-      '@typescript-eslint/no-array-constructor': 'error',
-      '@typescript-eslint/no-explicit-any': 'error',
-      '@typescript-eslint/no-extraneous-class': 'error',
-      '@typescript-eslint/no-floating-promises': 'error',
-      '@typescript-eslint/no-for-in-array': 'error',
-      '@typescript-eslint/no-inferrable-types': 'error',
-      '@typescript-eslint/no-misused-new': 'error',
-      '@typescript-eslint/no-namespace': 'error',
-      '@typescript-eslint/no-non-null-assertion': 'warn',
-      '@typescript-eslint/no-unnecessary-qualifier': 'error',
-      '@typescript-eslint/no-unnecessary-type-assertion': 'error',
-      '@typescript-eslint/no-useless-constructor': 'error',
-      '@typescript-eslint/prefer-for-of': 'warn',
-      '@typescript-eslint/prefer-function-type': 'warn',
-      '@typescript-eslint/prefer-includes': 'error',
-      '@typescript-eslint/prefer-string-starts-ends-with': 'error',
-      '@typescript-eslint/promise-function-async': 'error',
-      '@typescript-eslint/require-array-sort-compare': 'error',
-      '@typescript-eslint/restrict-plus-operands': 'error',
-      '@typescript-eslint/unbound-method': 'error'
-    }
-  },
-  {
-    files: ['__test__/**/*.ts'],
-    ...jest.configs['flat/recommended']
-  }
-]
@@ -0,0 +1,12 @@
+module.exports = {
+  clearMocks: true,
+  fakeTimers: {},
+  moduleFileExtensions: ['js', 'ts'],
+  testEnvironment: 'node',
+  testMatch: ['**/*.test.ts'],
+  testRunner: 'jest-circus/runner',
+  transform: {
+    '^.+\\.ts$': 'ts-jest'
+  },
+  verbose: true
+}
@@ -1,24 +0,0 @@
-export default {
-  clearMocks: true,
-  moduleFileExtensions: ['js', 'ts'],
-  roots: ['<rootDir>'],
-  testEnvironment: 'node',
-  testMatch: ['**/*.test.ts'],
-  transform: {
-    '^.+\\.ts$': [
-      'ts-jest',
-      {
-        useESM: true,
-        diagnostics: {
-          ignoreCodes: [151002]
-        }
-      }
-    ]
-  },
-  extensionsToTreatAsEsm: ['.ts'],
-  transformIgnorePatterns: ['node_modules/(?!(@actions)/)'],
-  moduleNameMapper: {
-    '^(\\.{1,2}/.*)\\.js$': '$1'
-  },
-  verbose: true
-}
@@ -1,15 +1,14 @@
 {
  "name": "checkout",
-  "version": "7.0.0",
+  "version": "5.0.0",
  "description": "checkout action",
-  "type": "module",
  "main": "lib/main.js",
  "scripts": {
-    "build": "tsc && ncc build src/main.ts -o dist && node lib/misc/generate-docs.js",
+    "build": "tsc && ncc build && node lib/misc/generate-docs.js",
    "format": "prettier --write '**/*.ts'",
    "format-check": "prettier --check '**/*.ts'",
    "lint": "eslint src/**/*.ts",
-    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",
+    "test": "jest",
    "licensed-check": "src/misc/licensed-check.sh",
    "licensed-generate": "src/misc/licensed-generate.sh"
  },
@@ -28,30 +27,29 @@
    "url": "https://github.com/actions/checkout/issues"
  },
  "homepage": "https://github.com/actions/checkout#readme",
-  "engines": {
-    "node": ">=24"
-  },
  "dependencies": {
-    "@actions/core": "^3.0.1",
-    "@actions/exec": "^3.0.0",
-    "@actions/github": "^9.1.1",
-    "@actions/io": "^3.0.2",
-    "@actions/tool-cache": "^4.0.0"
+    "@actions/core": "^1.10.1",
+    "@actions/exec": "^1.1.1",
+    "@actions/github": "^6.0.0",
+    "@actions/io": "^1.1.3",
+    "@actions/tool-cache": "^2.0.1",
+    "uuid": "^9.0.1"
  },
  "devDependencies": {
-    "@types/jest": "^30.0.0",
+    "@types/jest": "^29.5.12",
    "@types/node": "^24.1.0",
-    "@typescript-eslint/eslint-plugin": "^8.54.0",
-    "@typescript-eslint/parser": "^8.54.0",
-    "@vercel/ncc": "^0.44.0",
-    "eslint": "^9.39.2",
-    "eslint-plugin-github": "^6.0.0",
-    "eslint-plugin-jest": "^29.12.1",
-    "jest": "^30.4.2",
-    "js-yaml": "^4.2.0",
-    "prettier": "^3.8.4",
-    "ts-jest": "^29.4.11",
-    "ts-node": "^10.9.2",
+    "@types/uuid": "^9.0.8",
+    "@typescript-eslint/eslint-plugin": "^7.9.0",
+    "@typescript-eslint/parser": "^7.9.0",
+    "@vercel/ncc": "^0.38.1",
+    "eslint": "^8.57.0",
+    "eslint-plugin-github": "^4.10.2",
+    "eslint-plugin-jest": "^28.8.2",
+    "jest": "^29.7.0",
+    "jest-circus": "^29.7.0",
+    "js-yaml": "^4.1.0",
+    "prettier": "^3.3.3",
+    "ts-jest": "^29.2.5",
    "typescript": "^5.5.4"
  }
 }
@@ -5,12 +5,12 @@ import * as fs from 'fs'
 import * as io from '@actions/io'
 import * as os from 'os'
 import * as path from 'path'
-import * as regexpHelper from './regexp-helper.js'
-import * as stateHelper from './state-helper.js'
-import * as urlHelper from './url-helper.js'
-import {randomUUID} from 'crypto'
-import {IGitCommandManager} from './git-command-manager.js'
-import {IGitSourceSettings} from './git-source-settings.js'
+import * as regexpHelper from './regexp-helper'
+import * as stateHelper from './state-helper'
+import * as urlHelper from './url-helper'
+import {v4 as uuid} from 'uuid'
+import {IGitCommandManager} from './git-command-manager'
+import {IGitSourceSettings} from './git-source-settings'

 const IS_WINDOWS = process.platform === 'win32'
 const SSH_COMMAND_KEY = 'core.sshCommand'
@@ -90,7 +90,7 @@ class GitAuthHelper {
    // Create a temp home directory
    const runnerTemp = process.env['RUNNER_TEMP'] || ''
    assert.ok(runnerTemp, 'RUNNER_TEMP is not defined')
-    const uniqueId = randomUUID()
+    const uniqueId = uuid()
    this.temporaryHomePath = path.join(runnerTemp, uniqueId)
    await fs.promises.mkdir(this.temporaryHomePath, {recursive: true})

@@ -255,7 +255,7 @@ class GitAuthHelper {
    // Write key
    const runnerTemp = process.env['RUNNER_TEMP'] || ''
    assert.ok(runnerTemp, 'RUNNER_TEMP is not defined')
-    const uniqueId = randomUUID()
+    const uniqueId = uuid()
    this.sshKeyPath = path.join(runnerTemp, uniqueId)
    stateHelper.setSshKeyPath(this.sshKeyPath)
    await fs.promises.mkdir(runnerTemp, {recursive: true})
@@ -422,7 +422,7 @@ class GitAuthHelper {
    assert.ok(runnerTemp, 'RUNNER_TEMP is not defined')

    // Create a unique filename for this checkout instance
-    const configFileName = `git-credentials-${randomUUID()}.config`
+    const configFileName = `git-credentials-${uuid()}.config`
    this.credentialsConfigPath = path.join(runnerTemp, configFileName)

    core.debug(`Credentials config path: ${this.credentialsConfigPath}`)
@@ -1,13 +1,13 @@
 import * as core from '@actions/core'
 import * as exec from '@actions/exec'
 import * as fs from 'fs'
-import * as fshelper from './fs-helper.js'
+import * as fshelper from './fs-helper'
 import * as io from '@actions/io'
 import * as path from 'path'
-import * as refHelper from './ref-helper.js'
-import * as regexpHelper from './regexp-helper.js'
-import * as retryHelper from './retry-helper.js'
-import {GitVersion} from './git-version.js'
+import * as refHelper from './ref-helper'
+import * as regexpHelper from './regexp-helper'
+import * as retryHelper from './retry-helper'
+import {GitVersion} from './git-version'

 // Auth header not supported before 2.9
 // Wire protocol v2 not supported before 2.18
@@ -1,10 +1,10 @@
 import * as assert from 'assert'
 import * as core from '@actions/core'
 import * as fs from 'fs'
-import * as fsHelper from './fs-helper.js'
+import * as fsHelper from './fs-helper'
 import * as io from '@actions/io'
 import * as path from 'path'
-import {IGitCommandManager} from './git-command-manager.js'
+import {IGitCommandManager} from './git-command-manager'

 export async function prepareExistingDirectory(
  git: IGitCommandManager | undefined,
@@ -1,19 +1,19 @@
 import * as core from '@actions/core'
-import * as fsHelper from './fs-helper.js'
-import * as gitAuthHelper from './git-auth-helper.js'
-import * as gitCommandManager from './git-command-manager.js'
-import * as gitDirectoryHelper from './git-directory-helper.js'
-import * as githubApiHelper from './github-api-helper.js'
+import * as fsHelper from './fs-helper'
+import * as gitAuthHelper from './git-auth-helper'
+import * as gitCommandManager from './git-command-manager'
+import * as gitDirectoryHelper from './git-directory-helper'
+import * as githubApiHelper from './github-api-helper'
 import * as io from '@actions/io'
 import * as path from 'path'
-import * as refHelper from './ref-helper.js'
-import * as stateHelper from './state-helper.js'
-import * as urlHelper from './url-helper.js'
+import * as refHelper from './ref-helper'
+import * as stateHelper from './state-helper'
+import * as urlHelper from './url-helper'
 import {
  MinimumGitSparseCheckoutVersion,
  IGitCommandManager
-} from './git-command-manager.js'
-import {IGitSourceSettings} from './git-source-settings.js'
+} from './git-command-manager'
+import {IGitSourceSettings} from './git-source-settings'

 export async function getSource(settings: IGitSourceSettings): Promise<void> {
  // Repository URL
@@ -4,10 +4,10 @@ import * as fs from 'fs'
 import * as github from '@actions/github'
 import * as io from '@actions/io'
 import * as path from 'path'
-import * as retryHelper from './retry-helper.js'
+import * as retryHelper from './retry-helper'
 import * as toolCache from '@actions/tool-cache'
-import {randomUUID} from 'crypto'
-import {getServerApiUrl} from './url-helper.js'
+import {v4 as uuid} from 'uuid'
+import {getServerApiUrl} from './url-helper'

 const IS_WINDOWS = process.platform === 'win32'

@@ -39,7 +39,7 @@ export async function downloadRepository(

  // Write archive to disk
  core.info('Writing archive to disk')
-  const uniqueId = randomUUID()
+  const uniqueId = uuid()
  const archivePath = IS_WINDOWS
    ? path.join(repositoryPath, `${uniqueId}.zip`)
    : path.join(repositoryPath, `${uniqueId}.tar.gz`)
@@ -1,10 +1,10 @@
 import * as core from '@actions/core'
-import * as fsHelper from './fs-helper.js'
+import * as fsHelper from './fs-helper'
 import * as github from '@actions/github'
 import * as path from 'path'
-import * as unsafePrCheckoutHelper from './unsafe-pr-checkout-helper.js'
-import * as workflowContextHelper from './workflow-context-helper.js'
-import {IGitSourceSettings} from './git-source-settings.js'
+import * as unsafePrCheckoutHelper from './unsafe-pr-checkout-helper'
+import * as workflowContextHelper from './workflow-context-helper'
+import {IGitSourceSettings} from './git-source-settings'

 export async function getInputs(): Promise<IGitSourceSettings> {
  const result = {} as unknown as IGitSourceSettings
@@ -59,6 +59,23 @@ export async function getInputs(): Promise<IGitSourceSettings> {

  // Source branch, source version
  result.ref = core.getInput('ref')
+  // core.getInput()'s default trim strips a range of Unicode characters such as a
+  // leading BOM (U+FEFF) or NBSP (U+00A0). Those are valid in a git ref name, so
+  // a fork branch named "<BOM>" + 40 hex chars would trim down to a bare SHA and
+  // be silently reclassified as a commit, bypassing the unsafe fork PR checkout
+  // guard.
+  //
+  // The trim below strips only the ASCII whitespace characters which are all forbidden
+  // in a git branch name.
+  //   \t  U+0009  horizontal tab   - ASCII control, forbidden in ref names
+  //   \n  U+000A  line feed        - ASCII control, forbidden in ref names
+  //   \v  U+000B  vertical tab     - ASCII control, forbidden in ref names
+  //   \f  U+000C  form feed        - ASCII control, forbidden in ref names
+  //   \r  U+000D  carriage return  - ASCII control, forbidden in ref names
+  //   ' ' U+0020  space            - forbidden in ref names
+  const asciiTrimmedRef = core
+    .getInput('ref', {trimWhitespace: false})
+    .replace(/^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g, '')
  if (!result.ref) {
    if (isWorkflowRepository) {
      result.ref = github.context.ref
@@ -72,8 +89,8 @@ export async function getInputs(): Promise<IGitSourceSettings> {
    }
  }
  // SHA?
-  else if (result.ref.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) {
-    result.commit = result.ref
+  else if (asciiTrimmedRef.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) {
+    result.commit = asciiTrimmedRef
    result.ref = ''
  }
  core.debug(`ref = '${result.ref}'`)
@@ -168,12 +185,19 @@ export async function getInputs(): Promise<IGitSourceSettings> {
    'TRUE'
  core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`)

-  unsafePrCheckoutHelper.assertSafePrCheckout({
-    qualifiedRepository,
-    ref: result.ref,
-    commit: result.commit,
-    allowUnsafePrCheckout: result.allowUnsafePrCheckout
-  })
+  // The default self-checkout (this repository with no explicit ref) always
+  // resolves to the trusted ref/commit GitHub set for the triggering event, so
+  // the fork-checkout guard only needs to run when the caller customized the
+  // repository or ref.
+  const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref')
+  if (!isDefaultCheckout) {
+    unsafePrCheckoutHelper.assertSafePrCheckout({
+      qualifiedRepository,
+      ref: result.ref,
+      commit: result.commit,
+      allowUnsafePrCheckout: result.allowUnsafePrCheckout
+    })
+  }

  return result
 }
@@ -1,11 +1,9 @@
 import * as core from '@actions/core'
-import * as gitSourceProvider from './git-source-provider.js'
-import * as inputHelper from './input-helper.js'
+import * as coreCommand from '@actions/core/lib/command'
+import * as gitSourceProvider from './git-source-provider'
+import * as inputHelper from './input-helper'
 import * as path from 'path'
-import * as stateHelper from './state-helper.js'
-import {fileURLToPath} from 'url'
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
+import * as stateHelper from './state-helper'

 async function run(): Promise<void> {
  try {
@@ -13,8 +11,10 @@ async function run(): Promise<void> {

    try {
      // Register problem matcher
-      core.info(
-        `::add-matcher::${path.join(__dirname, 'problem-matcher.json')}`
+      coreCommand.issueCommand(
+        'add-matcher',
+        {},
+        path.join(__dirname, 'problem-matcher.json')
      )

      // Get sources
@@ -22,7 +22,7 @@ async function run(): Promise<void> {
      core.setOutput('ref', sourceSettings.ref)
    } finally {
      // Unregister problem matcher
-      core.info('::remove-matcher owner=checkout-git::')
+      coreCommand.issueCommand('remove-matcher', {owner: 'checkout-git'}, '')
    }
  } catch (error) {
    core.setFailed(`${(error as any)?.message ?? error}`)
@@ -2,9 +2,6 @@ import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
 import * as yaml from 'js-yaml'
-import {fileURLToPath} from 'url'
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))

 //
 // SUMMARY
@@ -123,7 +120,7 @@ function updateUsage(
 }

 updateUsage(
-  'actions/checkout@v7',
+  'actions/checkout@v6',
  path.join(__dirname, '..', '..', 'action.yml'),
  path.join(__dirname, '..', '..', 'README.md')
 )
@@ -1,7 +1,7 @@
-import {IGitCommandManager} from './git-command-manager.js'
+import {IGitCommandManager} from './git-command-manager'
 import * as core from '@actions/core'
 import * as github from '@actions/github'
-import {getServerApiUrl, isGhes} from './url-helper.js'
+import {getServerApiUrl, isGhes} from './url-helper'

 export const tagsRefSpec = '+refs/tags/*:refs/tags/*'

@@ -1,5 +1,5 @@
 import * as github from '@actions/github'
-import {fromPayload} from './ref-helper.js'
+import {fromPayload} from './ref-helper'

 const PR_REF_PATTERN = /^refs\/pull\/[0-9]+\/(?:head|merge)$/

@@ -1,6 +1,6 @@
 import * as assert from 'assert'
 import {URL} from 'url'
-import {IGitSourceSettings} from './git-source-settings.js'
+import {IGitSourceSettings} from './git-source-settings'

 export function getFetchUrl(settings: IGitSourceSettings): string {
  assert.ok(
@@ -1,13 +1,17 @@
 {
  "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
+    "target": "es6",
+    "module": "commonjs",
+    "lib": [
+      "es6"
+    ],
    "outDir": "./lib",
    "rootDir": "./src",
+    "declaration": true,
    "strict": true,
    "noImplicitAny": false,
-    "esModuleInterop": true
+    "esModuleInterop": true,
+    "skipLibCheck": true
  },
-  "exclude": ["__test__", "lib", "node_modules", "jest.config.ts"]
+  "exclude": ["__test__", "lib", "node_modules"]
 }