Bump the minor-actions-dependencies group across 1 directory with 2 updates

Bumps the minor-actions-dependencies group with 2 updates in the / directory: [actions/publish-immutable-action](https://github.com/actions/publish-immutable-action) and [docker/build-push-action](https://github.com/docker/build-push-action).


Updates `actions/publish-immutable-action` from 0.0.3 to 0.0.4
- [Release notes](https://github.com/actions/publish-immutable-action/releases)
- [Commits](https://github.com/actions/publish-immutable-action/compare/0.0.3...v0.0.4)

Updates `docker/build-push-action` from 6.5.0 to 6.10.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6.5.0...v6.10.0)

---
updated-dependencies:
- dependency-name: actions/publish-immutable-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-actions-dependencies
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/publish-immutable-actions.yml

@@ -17,4 +17,4 @@ jobs:
         uses: actions/checkout@v4
       - name: Publish
         id: publish
-        uses: actions/publish-immutable-action@0.0.3
+        uses: actions/publish-immutable-action@v0.0.4

.github/workflows/update-test-ubuntu-git.yml

@@ -48,7 +48,7 @@ jobs:
 
       # Use `docker/build-push-action` to build (and optionally publish) the image. 
       - name: Build Docker Image (with optional Push)
-        uses: docker/build-push-action@v6.5.0
+        uses: docker/build-push-action@v6.10.0
         with:
           context: .
           file: images/test-ubuntu-git.Dockerfile

README.md

@@ -29,11 +29,6 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
     # Otherwise, uses the default branch.
     ref: ''
 
-    # The commit SHA to checkout. Used when ref is not specified or is ambiguous. This
-    # can be used as a replacement for ref, or alongside it to checkout a specific
-    # commit of the ref.
-    commit: ''
-
     # Personal access token (PAT) used to fetch the repository. The PAT is configured
     # with the local git config, which enables your scripts to run authenticated git
     # commands. The post-job step removes the PAT.
@@ -217,7 +212,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
     repository: my-org/my-tools
     path: my-tools
 ```
-> - If your secondary repository is private you will need to add the option noted in [Checkout multiple repos (private)](#Checkout-multiple-repos-private)
+> - If your secondary repository is private or internal you will need to add the option noted in [Checkout multiple repos (private)](#Checkout-multiple-repos-private)
 
 ## Checkout multiple repos (nested)
 
@@ -231,7 +226,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
     repository: my-org/my-tools
     path: my-tools
 ```
-> - If your secondary repository is private you will need to add the option noted in [Checkout multiple repos (private)](#Checkout-multiple-repos-private)
+> - If your secondary repository is private or internal you will need to add the option noted in [Checkout multiple repos (private)](#Checkout-multiple-repos-private)
 
 ## Checkout multiple repos (private)
 

__test__/input-helper.test.ts

@@ -144,30 +144,4 @@ describe('input-helper tests', () => {
     const settings: IGitSourceSettings = await inputHelper.getInputs()
     expect(settings.workflowOrganizationId).toBe(123456)
   })
-
-  it('accepts ref and commit', async () => {
-    inputs.ref = 'refs/pull/123/merge'
-    inputs.commit = '0123456789012345678901234567890123456789'
-    const settings: IGitSourceSettings = await inputHelper.getInputs()
-    expect(settings).toBeTruthy()
-    expect(settings.ref).toBeTruthy()
-    expect(settings.ref).toStrictEqual('refs/pull/123/merge')
-    expect(settings.commit).toBeTruthy()
-    expect(settings.commit).toStrictEqual(
-      '0123456789012345678901234567890123456789'
-    )
-  })
-
-  it('ref fallbacks to commit if ref is empty but commit is specified', async () => {
-    inputs.ref = ''
-    inputs.commit = '0123456789012345678901234567890123456789'
-    const settings: IGitSourceSettings = await inputHelper.getInputs()
-    expect(settings).toBeTruthy()
-    expect(settings.ref).toBeFalsy()
-    expect(settings.ref).toStrictEqual('')
-    expect(settings.commit).toBeTruthy()
-    expect(settings.commit).toStrictEqual(
-      '0123456789012345678901234567890123456789'
-    )
-  })
 })

action.yml

@@ -9,11 +9,6 @@ inputs:
       The branch, tag or SHA to checkout. When checking out the repository that
       triggered a workflow, this defaults to the reference or SHA for that
       event.  Otherwise, uses the default branch.
-  commit:
-    description: >
-      The commit SHA to checkout. Used when ref is not specified or is ambiguous.
-      This can be used as a replacement for ref, or alongside it to checkout a
-      specific commit of the ref.
   token:
     description: >
       Personal access token (PAT) used to fetch the repository. The PAT is configured

dist/index.js

@@ -1744,11 +1744,7 @@ function getInputs() {
         const isWorkflowRepository = qualifiedRepository.toUpperCase() ===
             `${github.context.repo.owner}/${github.context.repo.repo}`.toUpperCase();
         // Source branch, source version
-        result.commit = core.getInput('commit');
-        if (result.commit && !result.commit.match(/^[0-9a-fA-F]{40}$/)) {
-            throw new Error(`The commit SHA '${result.commit}' is not a valid SHA.`);
-        }
-        result.ref = core.getInput('ref') || result.commit;
+        result.ref = core.getInput('ref');
         if (!result.ref) {
             if (isWorkflowRepository) {
                 result.ref = github.context.ref;

src/input-helper.ts

@@ -57,12 +57,7 @@ export async function getInputs(): Promise<IGitSourceSettings> {
     `${github.context.repo.owner}/${github.context.repo.repo}`.toUpperCase()
 
   // Source branch, source version
-  result.commit = core.getInput('commit')
-  if (result.commit && !result.commit.match(/^[0-9a-fA-F]{40}$/)) {
-    throw new Error(`The commit SHA '${result.commit}' is not a valid SHA.`)
-  }
-
-  result.ref = core.getInput('ref') || result.commit
+  result.ref = core.getInput('ref')
   if (!result.ref) {
     if (isWorkflowRepository) {
       result.ref = github.context.ref