Repository navigation
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Convert the checkout preflight to TypeScript and retain seven focused regression cases. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Prototype install and build scripts can read Git metadata in their workspace. The shared action should require a credential-free checkout before running those scripts, rather than relying only on each consuming workflow's configuration.
What changes
Add a checkout check before repository scripts run. It rejects persisted Git authentication settings in root, nested, and submodule metadata without printing their values. Credential-free submodules remain supported. Git configuration includes, symbolic links within Git metadata, and metadata references outside the workspace are rejected to keep the check self-contained.
Set
persist-credentials: falsein the action's own CI caller and document the requirement for custom workflows. The check does not remove credentials or scan arbitrary source files for secrets. Existing consumers receive it when they upgrade their pinned action version.Run the new TypeScript check through
tsxfrom the action's locked runtime dependencies. Keep regression coverage focused on normal checkouts and the critical rejection and credential-redaction paths.The complete local Hub check still reports an existing dependency-audit finding outside this change.
Created from a Slack conversation.