Automate secure repository checkout for GitHub Actions workflows
This action automates the process of downloading code files to the workspace when a GitHub Actions workflow starts. It prepares a specific version or branch of the repository in the execution environment, allowing scripts and build commands to reference the code directly.
Enhanced Fork Request Security
Recent versions changed how code from pull requests in forked repositories is handled. Workflows triggered by pull_request_target or workflow_run use the base repository's token and secrets, so executing forked code can create security vulnerabilities. To prevent this, the action rejects forked code checkouts by default. If you must execute forked code after reviewing the risks, you must set the allow-unsafe-pr-checkout: true option. Additionally, credentials are now stored in a separate file under $RUNNER_TEMP rather than in the .git/config file, strengthening security.
Flexible Checkout Options
In addition to fetching the entire repository, you can selectively download only the necessary parts. Using sparse-checkout allows you to fetch only root files, specific folders, or single files to reduce build time. You can also specify the range of commit history to fetch by adjusting the fetch-depth value. When checking out multiple repositories simultaneously, the path option lets you place each repository side by side or in a nested structure. To check out a private repository, you must provide a personal access token (PAT) with access to that repository as the token input.
Permissions and Requirements
It is recommended to set the GITHUB_TOKEN permissions to contents: read when using this action, as this is the minimum permission required to read repository contents. If Git version 2.18 or higher is not present on the system, the action operates by downloading files via the REST API. To run authenticated git commands in Docker container actions, Actions Runner version v2.329.0 or higher is required. This repository does not currently accept external contributions and only provides bug reports and security updates.
Pre-Implementation Checks
When using this action in a workflow, you should verify which trigger executes it. Specifically, if you use pull_request_target, you must review the risks of executing forked code. For private repositories, it is advisable to minimize the token's scope. This action is released under the MIT license, allowing free use. However, because direct code modifications or contributions for specific features or bug fixes are not possible, it is best to check the official roadmap or community discussions for updates if a required feature is missing.
