-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Explicitly disable sparse checkout unless asked for #1598
Changes from 13 commits
5adf77f
c4cda12
6f108b2
6d74269
4dfc3ce
463d088
ed56252
268a122
b300d42
9b4fb8b
9397c07
3940af5
572f5de
78c6190
a48123a
34a3ecd
6af92d2
894f97f
996d145
87e9846
772739e
97826d9
eb87b7a
d5b8261
2349742
28a19e1
82808ae
365131c
e7b6c8e
9af61b0
7aa0640
159fd98
5ecc8b5
f0ae198
bbd0474
4d1347d
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -576,6 +576,11 @@ class GitCommandManager { | |
return result; | ||
}); | ||
} | ||
disableSparseCheckout() { | ||
return __awaiter(this, void 0, void 0, function* () { | ||
yield this.execGit(['sparse-checkout', 'disable']); | ||
}); | ||
} | ||
sparseCheckout(sparseCheckout) { | ||
return __awaiter(this, void 0, void 0, function* () { | ||
yield this.execGit(['sparse-checkout', 'set', ...sparseCheckout]); | ||
|
@@ -1282,7 +1287,10 @@ function getSource(settings) { | |
core.endGroup(); | ||
} | ||
// Sparse checkout | ||
if (settings.sparseCheckout) { | ||
if (!settings.sparseCheckout) { | ||
yield git.disableSparseCheckout(); | ||
} | ||
else { | ||
core.startGroup('Setting up sparse checkout'); | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. do you want to pop the Consider There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. No, because we're not actually setting up a sparse checkout. We're disabling it. But saying that would only make sense if there was a worktree already, otherwise there'd be no sparse checkout to disable. |
||
if (settings.sparseCheckoutConeMode) { | ||
yield git.sparseCheckout(settings.sparseCheckout); | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We should be very careful about adding in external dependencies to our workflows - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
If this is something we internally built, could we publish it to ghcr.io within this repository or org?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Agreed. This was something @fhammerl provided as a proof-of-concept, but I was just reading up about how to publish packages to ghcr.io and like the idea of hosting this container image at ghcr.io/actions (see neighboring packages here)