Merge d1d381abe7 into 85e6279cec

* Update README.md

* Update README.md

Co-authored-by: Josh Gross <joshmgross@github.com>

---------

Co-authored-by: Josh Gross <joshmgross@github.com>

README.md

@@ -74,6 +74,10 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
     # Relative path under $GITHUB_WORKSPACE to place the repository
     path: ''
 
+    # Allow the checked-out repository to be placed outside of the workspace
+    # Default: false
+    allow-path-outside-workspace: ''
+
     # Whether to execute `git clean -ffdx && git reset --hard HEAD` before fetching
     # Default: true
     clean: ''
@@ -311,8 +315,17 @@ jobs:
           git commit -m "generated"
           git push
 ```
+
 *NOTE:* The user email is `{user.id}+{user.login}@users.noreply.github.com`. See users API: https://api.github.com/users/github-actions%5Bbot%5D
 
+# Recommended permissions
+
+When using the `checkout` action in your GitHub Actions workflow, it is recommended to set the following `GITHUB_TOKEN` permissions to ensure proper functionality, unless alternative auth is provided via the `token` or `ssh-key` inputs:
+
+```yaml
+permissions:
+  contents: read
+```
 
 # License
 

action.yml

@@ -54,6 +54,10 @@ inputs:
     default: true
   path:
     description: 'Relative path under $GITHUB_WORKSPACE to place the repository'
+  allow-path-outside-workspace:
+    description: Allow the checked-out repository to be placed outside of the workspace.
+    default: false
+    required: false
   clean:
     description: 'Whether to execute `git clean -ffdx && git reset --hard HEAD` before fetching'
     default: true

dist/index.js

@@ -1737,7 +1737,8 @@ function getInputs() {
         // Repository path
         result.repositoryPath = core.getInput('path') || '.';
         result.repositoryPath = path.resolve(githubWorkspacePath, result.repositoryPath);
-        if (!(result.repositoryPath + path.sep).startsWith(githubWorkspacePath + path.sep)) {
+        if (!core.getInput('allow-path-outside-workspace') &&
+            !(result.repositoryPath + path.sep).startsWith(githubWorkspacePath + path.sep)) {
             throw new Error(`Repository path '${result.repositoryPath}' is not under '${githubWorkspacePath}'`);
         }
         // Workflow repository?

src/input-helper.ts

@@ -42,6 +42,7 @@ export async function getInputs(): Promise<IGitSourceSettings> {
     result.repositoryPath
   )
   if (
+    !core.getInput('allow-path-outside-workspace') &&
     !(result.repositoryPath + path.sep).startsWith(
       githubWorkspacePath + path.sep
     )