Merge f6b63ceb9e79ee917ff77ed8ef9f79097ad2cfc6 into 692973e3d937129bcbf40652eb9f2f61becf3332

* Prepare 4.1.7 release

* Include #1776 in 4.1.7 release

.github/workflows/check-dist.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.6
 
       - name: Set Node.js 20.x
         uses: actions/setup-node@v4

.github/workflows/codeql-analysis.yml

@@ -39,7 +39,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v4.1.6
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v3

.github/workflows/licensed.yml

@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     name: Check licenses
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.6
       - run: npm ci
       - run: npm run licensed-check

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 20.x
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.6
       - run: npm ci
       - run: npm run build
       - run: npm run format-check
@@ -37,7 +37,7 @@ jobs:
     steps:
       # Clone this repo
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.6
 
       # Basic checkout
       - name: Checkout basic
@@ -202,7 +202,7 @@ jobs:
     steps:
       # Clone this repo
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.6
 
       # Basic checkout using git
       - name: Checkout basic
@@ -234,7 +234,7 @@ jobs:
     steps:
       # Clone this repo
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.6
 
       # Basic checkout using git
       - name: Checkout basic
@@ -264,13 +264,13 @@ jobs:
     steps:
       # Clone this repo
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.6
         with:
-          path: v4
+          path: localClone
 
       # Basic checkout using git
       - name: Checkout basic
-        uses: ./v4
+        uses: ./localClone
         with:
           ref: test-data/v2/basic
       - name: Verify basic
@@ -292,6 +292,6 @@ jobs:
 
       # needed to make checkout post cleanup succeed
       - name: Fix Checkout v4
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.6
         with:
-          path: v4
+          path: localClone

.github/workflows/update-main-version.yml

@@ -22,7 +22,7 @@ jobs:
     # Note this update workflow can also be used as a rollback tool.
     # For that reason, it's best to pin `actions/checkout` to a known, stable version
     # (typically, about two releases back).
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v4.1.6
       with:
         fetch-depth: 0
     - name: Git config

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## v4.1.7
+* Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in https://github.com/actions/checkout/pull/1739
+* Bump actions/checkout from 3 to 4 by @dependabot in https://github.com/actions/checkout/pull/1697
+* Check out other refs/* by commit by @orhantoy in https://github.com/actions/checkout/pull/1774
+* Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in https://github.com/actions/checkout/pull/1776
+
 ## v4.1.6
 * Check platform to set archive extension appropriately by @cory-miller in https://github.com/actions/checkout/pull/1732
 

README.md

@@ -251,7 +251,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 ```yaml
 - uses: actions/checkout@v4
   with:
-    ref: ${{ github.event.pull_request.head.sha }}
+    ref: ${{ github.event.pull_request.head.sha || github.ref }}
 ```
 
 ## Checkout pull request on closed event

__test__/ref-helper.test.ts

@@ -67,6 +67,16 @@ describe('ref-helper tests', () => {
     expect(checkoutInfo.startPoint).toBeFalsy()
   })
 
+  it('getCheckoutInfo refs/', async () => {
+    const checkoutInfo = await refHelper.getCheckoutInfo(
+      git,
+      'refs/gh/queue/main/pr-123',
+      commit
+    )
+    expect(checkoutInfo.ref).toBe(commit)
+    expect(checkoutInfo.startPoint).toBeFalsy()
+  })
+
   it('getCheckoutInfo unqualified branch only', async () => {
     git.branchExists = jest.fn(async (remote: boolean, pattern: string) => {
       return true

dist/index.js

@@ -2000,9 +2000,13 @@ function getCheckoutInfo(git, ref, commit) {
             result.ref = `refs/remotes/pull/${branch}`;
         }
         // refs/tags/
-        else if (upperRef.startsWith('REFS/')) {
+        else if (upperRef.startsWith('REFS/TAGS/')) {
             result.ref = ref;
         }
+        // refs/
+        else if (upperRef.startsWith('REFS/') && commit) {
+            result.ref = commit;
+        }
         // Unqualified ref, check for a matching branch or tag
         else {
             if (yield git.branchExists(true, `origin/${ref}`)) {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "checkout",
-  "version": "4.1.6",
+  "version": "4.1.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "checkout",
-      "version": "4.1.6",
+      "version": "4.1.7",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "checkout",
-  "version": "4.1.6",
+  "version": "4.1.7",
   "description": "checkout action",
   "main": "lib/main.js",
   "scripts": {

src/ref-helper.ts

@@ -42,9 +42,13 @@ export async function getCheckoutInfo(
     result.ref = `refs/remotes/pull/${branch}`
   }
   // refs/tags/
-  else if (upperRef.startsWith('REFS/')) {
+  else if (upperRef.startsWith('REFS/TAGS/')) {
     result.ref = ref
   }
+  // refs/
+  else if (upperRef.startsWith('REFS/') && commit) {
+    result.ref = commit
+  }
   // Unqualified ref, check for a matching branch or tag
   else {
     if (await git.branchExists(true, `origin/${ref}`)) {