changelog

* persist core.sshCommand for submodules

* update verbiage; add comments

* fail when submodules or ssh-key and fallback to REST API

CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## v2.1.1
+- Changes to support GHES ([here](https://github.com/actions/checkout/pull/236) and [here](https://github.com/actions/checkout/pull/248))
+
+## v2.1.0
+
+- [Group output](https://github.com/actions/checkout/pull/191)
+- [Changes to support GHES alpha release](https://github.com/actions/checkout/pull/199)
+- [Persist core.sshCommand for submodules](https://github.com/actions/checkout/pull/184)
+- [Add support ssh](https://github.com/actions/checkout/pull/163)
+- [Convert submodule SSH URL to HTTPS, when not using SSH](https://github.com/actions/checkout/pull/179)
+- [Add submodule support](https://github.com/actions/checkout/pull/157)
+- [Follow proxy settings](https://github.com/actions/checkout/pull/144)
+- [Fix ref for pr closed event when a pr is merged](https://github.com/actions/checkout/pull/141)
+- [Fix issue checking detached when git less than 2.22](https://github.com/actions/checkout/pull/128)
+
+## v2.0.0
+
+- [Do not pass cred on command line](https://github.com/actions/checkout/pull/108)
+- [Add input persist-credentials](https://github.com/actions/checkout/pull/107)
+- [Fallback to REST API to download repo](https://github.com/actions/checkout/pull/104)
+
 ## v2 (beta)
 
 - Improved fetch performance

README.md

@@ -18,6 +18,7 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl
   - Fetches only a single commit by default
 - Script authenticated git commands
   - Auth token persisted in the local git config
+- Supports SSH
 - Creates a local branch
   - No longer detached HEAD when checking out a branch
 - Improved layout
@@ -26,7 +27,6 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl
 - Fallback to REST API download
   - When Git 2.18 or higher is not in the PATH, the REST API will be used to download the files
   - When using a job container, the container's PATH is used
-- Removed input `submodules`
 
 Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous versions.
 
@@ -49,19 +49,19 @@ Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous
     # with the local git config, which enables your scripts to run authenticated git
     # commands. The post-job step removes the PAT.
     #
-    # We recommend creating a service account with the least permissions necessary.
+    # We recommend using a service account with the least permissions necessary. Also
-    # Also when generating a new PAT, select the least scopes necessary.
+    # when generating a new PAT, select the least scopes necessary.
     #
     # [Learn more about creating and using encrypted secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)
     #
     # Default: ${{ github.token }}
     token: ''
 
-    # SSH key used to fetch the repository. SSH key is configured with the local git
+    # SSH key used to fetch the repository. The SSH key is configured with the local
-    # config, which enables your scripts to run authenticated git commands. The
+    # git config, which enables your scripts to run authenticated git commands. The
     # post-job step removes the SSH key.
     #
-    # We recommend creating a service account with the least permissions necessary.
+    # We recommend using a service account with the least permissions necessary.
     #
     # [Learn more about creating and using encrypted secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)
     ssh-key: ''
@@ -117,7 +117,6 @@ Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous
 - [Checkout multiple repos (private)](#Checkout-multiple-repos-private)
 - [Checkout pull request HEAD commit instead of merge commit](#Checkout-pull-request-HEAD-commit-instead-of-merge-commit)
 - [Checkout pull request on closed event](#Checkout-pull-request-on-closed-event)
-- [Checkout submodules](#Checkout-submodules)
 - [Fetch all tags](#Fetch-all-tags)
 - [Fetch all branches](#Fetch-all-branches)
 - [Fetch all history for all tags and branches](#Fetch-all-history-for-all-tags-and-branches)
@@ -208,20 +207,6 @@ jobs:
       - uses: actions/checkout@v2
 ```
 
-## Checkout submodules
-
-```yaml
-- uses: actions/checkout@v2
-- name: Checkout submodules
-  shell: bash
-  run: |
-    # If your submodules are configured to use SSH instead of HTTPS please uncomment the following line
-    # git config --global url."https://github.com/".insteadOf "git@github.com:"
-    auth_header="$(git config --local --get http.https://github.com/.extraheader)"
-    git submodule sync --recursive
-    git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --init --force --recursive --depth=1
-```
-
 ## Fetch all tags
 
 ```yaml

__test__/git-auth-helper.test.ts

@@ -320,6 +320,8 @@ describe('git-auth-helper tests', () => {
     ).toString()
     expect(actualSshKeyContent).toBe(settings.sshKey + '\n')
     if (!isWindows) {
+      // Assert read/write for user, not group or others.
+      // Otherwise SSH client will error.
       expect((await fs.promises.stat(actualSshKeyPath)).mode & 0o777).toBe(
         0o600
       )
@@ -437,14 +439,74 @@ describe('git-auth-helper tests', () => {
     }
   )
 
-  const configureSubmoduleAuth_configuresTokenWhenPersistCredentialsTrueAndSshKeyNotSet =
+  const configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsFalseAndSshKeyNotSet =
-    'configureSubmoduleAuth configures token when persist credentials true and SSH key not set'
+    'configureSubmoduleAuth configures submodules when persist credentials false and SSH key not set'
   it(
-    configureSubmoduleAuth_configuresTokenWhenPersistCredentialsTrueAndSshKeyNotSet,
+    configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsFalseAndSshKeyNotSet,
     async () => {
       // Arrange
       await setup(
-        configureSubmoduleAuth_configuresTokenWhenPersistCredentialsTrueAndSshKeyNotSet
+        configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsFalseAndSshKeyNotSet
+      )
+      settings.persistCredentials = false
+      settings.sshKey = ''
+      const authHelper = gitAuthHelper.createAuthHelper(git, settings)
+      await authHelper.configureAuth()
+      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any, any>
+      mockSubmoduleForeach.mockClear() // reset calls
+
+      // Act
+      await authHelper.configureSubmoduleAuth()
+
+      // Assert
+      expect(mockSubmoduleForeach).toBeCalledTimes(1)
+      expect(mockSubmoduleForeach.mock.calls[0][0] as string).toMatch(
+        /unset-all.*insteadOf/
+      )
+    }
+  )
+
+  const configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsFalseAndSshKeySet =
+    'configureSubmoduleAuth configures submodules when persist credentials false and SSH key set'
+  it(
+    configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsFalseAndSshKeySet,
+    async () => {
+      if (!sshPath) {
+        process.stdout.write(
+          `Skipped test "${configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsFalseAndSshKeySet}". Executable 'ssh' not found in the PATH.\n`
+        )
+        return
+      }
+
+      // Arrange
+      await setup(
+        configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsFalseAndSshKeySet
+      )
+      settings.persistCredentials = false
+      const authHelper = gitAuthHelper.createAuthHelper(git, settings)
+      await authHelper.configureAuth()
+      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any, any>
+      mockSubmoduleForeach.mockClear() // reset calls
+
+      // Act
+      await authHelper.configureSubmoduleAuth()
+
+      // Assert
+      expect(mockSubmoduleForeach).toHaveBeenCalledTimes(1)
+      expect(mockSubmoduleForeach.mock.calls[0][0]).toMatch(
+        /unset-all.*insteadOf/
+      )
+    }
+  )
+
+  const configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsTrueAndSshKeyNotSet =
+    'configureSubmoduleAuth configures submodules when persist credentials true and SSH key not set'
+  it(
+    configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsTrueAndSshKeyNotSet,
+    async () => {
+      // Arrange
+      await setup(
+        configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsTrueAndSshKeyNotSet
       )
       settings.sshKey = ''
       const authHelper = gitAuthHelper.createAuthHelper(git, settings)
@@ -465,21 +527,21 @@ describe('git-auth-helper tests', () => {
     }
   )
 
-  const configureSubmoduleAuth_configuresTokenWhenPersistCredentialsTrueAndSshKeySet =
+  const configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsTrueAndSshKeySet =
-    'configureSubmoduleAuth configures token when persist credentials true and SSH key set'
+    'configureSubmoduleAuth configures submodules when persist credentials true and SSH key set'
   it(
-    configureSubmoduleAuth_configuresTokenWhenPersistCredentialsTrueAndSshKeySet,
+    configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsTrueAndSshKeySet,
     async () => {
       if (!sshPath) {
         process.stdout.write(
-          `Skipped test "${configureSubmoduleAuth_configuresTokenWhenPersistCredentialsTrueAndSshKeySet}". Executable 'ssh' not found in the PATH.\n`
+          `Skipped test "${configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsTrueAndSshKeySet}". Executable 'ssh' not found in the PATH.\n`
         )
         return
       }
 
       // Arrange
       await setup(
-        configureSubmoduleAuth_configuresTokenWhenPersistCredentialsTrueAndSshKeySet
+        configureSubmoduleAuth_configuresSubmodulesWhenPersistCredentialsTrueAndSshKeySet
       )
       const authHelper = gitAuthHelper.createAuthHelper(git, settings)
       await authHelper.configureAuth()
@@ -490,96 +552,12 @@ describe('git-auth-helper tests', () => {
       await authHelper.configureSubmoduleAuth()
 
       // Assert
-      expect(mockSubmoduleForeach).toHaveBeenCalledTimes(2)
+      expect(mockSubmoduleForeach).toHaveBeenCalledTimes(3)
       expect(mockSubmoduleForeach.mock.calls[0][0]).toMatch(
         /unset-all.*insteadOf/
       )
       expect(mockSubmoduleForeach.mock.calls[1][0]).toMatch(/http.*extraheader/)
-    }
+      expect(mockSubmoduleForeach.mock.calls[2][0]).toMatch(/core\.sshCommand/)
-  )
-
-  const configureSubmoduleAuth_doesNotConfigureTokenWhenPersistCredentialsFalse =
-    'configureSubmoduleAuth does not configure token when persist credentials false'
-  it(
-    configureSubmoduleAuth_doesNotConfigureTokenWhenPersistCredentialsFalse,
-    async () => {
-      // Arrange
-      await setup(
-        configureSubmoduleAuth_doesNotConfigureTokenWhenPersistCredentialsFalse
-      )
-      settings.persistCredentials = false
-      const authHelper = gitAuthHelper.createAuthHelper(git, settings)
-      await authHelper.configureAuth()
-      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any, any>
-      mockSubmoduleForeach.mockClear() // reset calls
-
-      // Act
-      await authHelper.configureSubmoduleAuth()
-
-      // Assert
-      expect(mockSubmoduleForeach).toBeCalledTimes(1)
-      expect(mockSubmoduleForeach.mock.calls[0][0] as string).toMatch(
-        /unset-all.*insteadOf/
-      )
-    }
-  )
-
-  const configureSubmoduleAuth_doesNotConfigureUrlInsteadOfWhenPersistCredentialsTrueAndSshKeySet =
-    'configureSubmoduleAuth does not configure URL insteadOf when persist credentials true and SSH key set'
-  it(
-    configureSubmoduleAuth_doesNotConfigureUrlInsteadOfWhenPersistCredentialsTrueAndSshKeySet,
-    async () => {
-      if (!sshPath) {
-        process.stdout.write(
-          `Skipped test "${configureSubmoduleAuth_doesNotConfigureUrlInsteadOfWhenPersistCredentialsTrueAndSshKeySet}". Executable 'ssh' not found in the PATH.\n`
-        )
-        return
-      }
-
-      // Arrange
-      await setup(
-        configureSubmoduleAuth_doesNotConfigureUrlInsteadOfWhenPersistCredentialsTrueAndSshKeySet
-      )
-      const authHelper = gitAuthHelper.createAuthHelper(git, settings)
-      await authHelper.configureAuth()
-      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any, any>
-      mockSubmoduleForeach.mockClear() // reset calls
-
-      // Act
-      await authHelper.configureSubmoduleAuth()
-
-      // Assert
-      expect(mockSubmoduleForeach).toHaveBeenCalledTimes(2)
-      expect(mockSubmoduleForeach.mock.calls[0][0]).toMatch(
-        /unset-all.*insteadOf/
-      )
-      expect(mockSubmoduleForeach.mock.calls[1][0]).toMatch(/http.*extraheader/)
-    }
-  )
-
-  const configureSubmoduleAuth_removesUrlInsteadOfWhenPersistCredentialsFalse =
-    'configureSubmoduleAuth removes URL insteadOf when persist credentials false'
-  it(
-    configureSubmoduleAuth_removesUrlInsteadOfWhenPersistCredentialsFalse,
-    async () => {
-      // Arrange
-      await setup(
-        configureSubmoduleAuth_removesUrlInsteadOfWhenPersistCredentialsFalse
-      )
-      settings.persistCredentials = false
-      const authHelper = gitAuthHelper.createAuthHelper(git, settings)
-      await authHelper.configureAuth()
-      const mockSubmoduleForeach = git.submoduleForeach as jest.Mock<any, any>
-      mockSubmoduleForeach.mockClear() // reset calls
-
-      // Act
-      await authHelper.configureSubmoduleAuth()
-
-      // Assert
-      expect(mockSubmoduleForeach).toBeCalledTimes(1)
-      expect(mockSubmoduleForeach.mock.calls[0][0] as string).toMatch(
-        /unset-all.*insteadOf/
-      )
     }
   )
 

action.yml

@@ -16,7 +16,7 @@ inputs:
       commands. The post-job step removes the PAT.
 
 
-      We recommend creating a service account with the least permissions necessary.
+      We recommend using a service account with the least permissions necessary.
       Also when generating a new PAT, select the least scopes necessary.
 
 
@@ -24,12 +24,12 @@ inputs:
     default: ${{ github.token }}
   ssh-key:
     description: >
-      SSH key used to fetch the repository. SSH key is configured with the local
+      SSH key used to fetch the repository. The SSH key is configured with the local
       git config, which enables your scripts to run authenticated git commands.
       The post-job step removes the SSH key.
 
 
-      We recommend creating a service account with the least permissions necessary.
+      We recommend using a service account with the least permissions necessary.
 
 
       [Learn more about creating and using

adrs/0153-checkout-v2.md

@@ -29,14 +29,26 @@ We want to take this opportunity to make behavioral changes, from v1. This docum
     description: >
       Personal access token (PAT) used to fetch the repository. The PAT is configured
       with the local git config, which enables your scripts to run authenticated git
-      commands. The post-job step removes the PAT. [Learn more about creating and using
+      commands. The post-job step removes the PAT.
-      encrypted secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)
+
+
+      We recommend using a service account with the least permissions necessary.
+      Also when generating a new PAT, select the least scopes necessary.
+
+
+      [Learn more about creating and using encrypted secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)
     default: ${{ github.token }}
   ssh-key:
     description: >
-      SSH key used to fetch the repository. SSH key is configured with the local
+      SSH key used to fetch the repository. The SSH key is configured with the local
       git config, which enables your scripts to run authenticated git commands.
-      The post-job step removes the SSH key. [Learn more about creating and using
+      The post-job step removes the SSH key.
+
+
+      We recommend using a service account with the least permissions necessary.
+
+
+      [Learn more about creating and using
       encrypted secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)
   ssh-known-hosts:
     description: >
@@ -44,7 +56,10 @@ We want to take this opportunity to make behavioral changes, from v1. This docum
       SSH keys for a host may be obtained using the utility `ssh-keyscan`. For example,
       `ssh-keyscan github.com`. The public key for github.com is always implicitly added.
   ssh-strict:
-    description: 'Whether to perform strict host key checking'
+    description: >
+      Whether to perform strict host key checking. When true, adds the options `StrictHostKeyChecking=yes`
+      and `CheckHostIP=no` to the SSH command line. Use the input `ssh-known-hosts` to
+      configure additional hosts.
     default: true
   persist-credentials:
     description: 'Whether to configure the token or SSH key with the local git config'
@@ -64,7 +79,11 @@ We want to take this opportunity to make behavioral changes, from v1. This docum
     description: >
       Whether to checkout submodules: `true` to checkout submodules or `recursive` to
       recursively checkout submodules.
-    default: 'false'
+
+
+      When the `ssh-key` input is not provided, SSH URLs beginning with `git@github.com:` are
+      converted to HTTPS.
+    default: false
 ```
 
 Note:

package-lock.json

@@ -15,19 +15,19 @@
       "integrity": "sha512-nvFkxwiicvpzNiCBF4wFBDfnBvi7xp/as7LE1hBxBxKG2L29+gkIPBiLKMVORL+Hg3JNf07AKRfl0V5djoypjQ=="
     },
     "@actions/github": {
-      "version": "2.1.0",
+      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@actions/github/-/github-2.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-2.2.0.tgz",
-      "integrity": "sha512-G4ncMlh4pLLAvNgHUYUtpWQ1zPf/VYqmRH9oshxLabdaOOnp7i1hgSgzr2xne2YUaSND3uqemd3YYTIsm2f/KQ==",
+      "integrity": "sha512-9UAZqn8ywdR70n3GwVle4N8ALosQs4z50N7XMXrSTUVOmVpaBC5kE3TRTT7qQdi3OaQV24mjGuJZsHUmhD+ZXw==",
       "requires": {
         "@actions/http-client": "^1.0.3",
         "@octokit/graphql": "^4.3.1",
-        "@octokit/rest": "^16.15.0"
+        "@octokit/rest": "^16.43.1"
       }
     },
     "@actions/http-client": {
-      "version": "1.0.3",
+      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-1.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-1.0.8.tgz",
-      "integrity": "sha512-wFwh1U4adB/Zsk4cc9kVqaBOHoknhp/pJQk+aWTocbAZWpIl4Zx/At83WFRLXvxB+5HVTWOACM6qjULMZfQSfw==",
+      "integrity": "sha512-G4JjJ6f9Hb3Zvejj+ewLLKLf99ZC+9v+yCxoYf9vSyH+WkzPLB2LuUtRMGNkooMqdugGBFStIKXOuvH1W+EctA==",
       "requires": {
         "tunnel": "0.0.6"
       },
@@ -622,13 +622,23 @@
       }
     },
     "@octokit/endpoint": {
-      "version": "5.5.1",
+      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-5.5.1.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-6.0.1.tgz",
-      "integrity": "sha512-nBFhRUb5YzVTCX/iAK1MgQ4uWo89Gu0TH00qQHoYRCsE12dWcG1OiLd7v2EIo2+tpUKPMOQ62QFy9hy9Vg2ULg==",
+      "integrity": "sha512-pOPHaSz57SFT/m3R5P8MUu4wLPszokn5pXcB/pzavLTQf2jbU+6iayTvzaY6/BiotuRS0qyEUkx3QglT4U958A==",
       "requires": {
-        "@octokit/types": "^2.0.0",
+        "@octokit/types": "^2.11.1",
         "is-plain-object": "^3.0.0",
-        "universal-user-agent": "^4.0.0"
+        "universal-user-agent": "^5.0.0"
+      },
+      "dependencies": {
+        "universal-user-agent": {
+          "version": "5.0.0",
+          "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-5.0.0.tgz",
+          "integrity": "sha512-B5TPtzZleXyPrUMKCpEHFmVhMN6EhmJYjG5PQna9s7mXeSqGTLap4OpqLl5FCEFUI3UBmllkETwKf/db66Y54Q==",
+          "requires": {
+            "os-name": "^3.1.0"
+          }
+        }
       }
     },
     "@octokit/graphql": {
@@ -641,25 +651,57 @@
         "universal-user-agent": "^4.0.0"
       }
     },
-    "@octokit/request": {
+    "@octokit/plugin-paginate-rest": {
-      "version": "5.3.1",
+      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-5.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-1.1.2.tgz",
-      "integrity": "sha512-5/X0AL1ZgoU32fAepTfEoggFinO3rxsMLtzhlUX+RctLrusn/CApJuGFCd0v7GMFhF+8UiCsTTfsu7Fh1HnEJg==",
+      "integrity": "sha512-jbsSoi5Q1pj63sC16XIUboklNw+8tL9VOnJsWycWYR78TKss5PVpIPb1TUUcMQ+bBh7cY579cVAWmf5qG+dw+Q==",
       "requires": {
-        "@octokit/endpoint": "^5.5.0",
+        "@octokit/types": "^2.0.1"
-        "@octokit/request-error": "^1.0.1",
+      }
-        "@octokit/types": "^2.0.0",
+    },
+    "@octokit/plugin-request-log": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-1.0.0.tgz",
+      "integrity": "sha512-ywoxP68aOT3zHCLgWZgwUJatiENeHE7xJzYjfz8WI0goynp96wETBF+d95b8g/uL4QmS6owPVlaxiz3wyMAzcw=="
+    },
+    "@octokit/plugin-rest-endpoint-methods": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-2.4.0.tgz",
+      "integrity": "sha512-EZi/AWhtkdfAYi01obpX0DF7U6b1VRr30QNQ5xSFPITMdLSfhcBqjamE3F+sKcxPbD7eZuMHu3Qkk2V+JGxBDQ==",
+      "requires": {
+        "@octokit/types": "^2.0.1",
+        "deprecation": "^2.3.1"
+      }
+    },
+    "@octokit/request": {
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-5.4.2.tgz",
+      "integrity": "sha512-zKdnGuQ2TQ2vFk9VU8awFT4+EYf92Z/v3OlzRaSh4RIP0H6cvW1BFPXq4XYvNez+TPQjqN+0uSkCYnMFFhcFrw==",
+      "requires": {
+        "@octokit/endpoint": "^6.0.1",
+        "@octokit/request-error": "^2.0.0",
+        "@octokit/types": "^2.11.1",
         "deprecation": "^2.0.0",
         "is-plain-object": "^3.0.0",
         "node-fetch": "^2.3.0",
         "once": "^1.4.0",
-        "universal-user-agent": "^4.0.0"
+        "universal-user-agent": "^5.0.0"
+      },
+      "dependencies": {
+        "universal-user-agent": {
+          "version": "5.0.0",
+          "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-5.0.0.tgz",
+          "integrity": "sha512-B5TPtzZleXyPrUMKCpEHFmVhMN6EhmJYjG5PQna9s7mXeSqGTLap4OpqLl5FCEFUI3UBmllkETwKf/db66Y54Q==",
+          "requires": {
+            "os-name": "^3.1.0"
+          }
+        }
       }
     },
     "@octokit/request-error": {
-      "version": "1.2.0",
+      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-1.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.0.0.tgz",
-      "integrity": "sha512-DNBhROBYjjV/I9n7A8kVkmQNkqFAMem90dSxqvPq57e2hBr7mNTX98y3R2zDpqMQHVRpBDjsvsfIGgBzy+4PAg==",
+      "integrity": "sha512-rtYicB4Absc60rUv74Rjpzek84UbVHGHJRu4fNVlZ1mCcyUPPuzFfG9Rn6sjHrd95DEsmjSt1Axlc699ZlbDkw==",
       "requires": {
         "@octokit/types": "^2.0.0",
         "deprecation": "^2.0.0",
@@ -667,11 +709,14 @@
       }
     },
     "@octokit/rest": {
-      "version": "16.38.1",
+      "version": "16.43.1",
-      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-16.38.1.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-16.43.1.tgz",
-      "integrity": "sha512-zyNFx+/Bd1EXt7LQjfrc6H4wryBQ/oDuZeZhGMBSFr1eMPFDmpEweFQR3R25zjKwBQpDY7L5GQO6A3XSaOfV1w==",
+      "integrity": "sha512-gfFKwRT/wFxq5qlNjnW2dh+qh74XgTQ2B179UX5K1HYCluioWj8Ndbgqw2PVqa1NnVJkGHp2ovMpVn/DImlmkw==",
       "requires": {
         "@octokit/auth-token": "^2.4.0",
+        "@octokit/plugin-paginate-rest": "^1.1.1",
+        "@octokit/plugin-request-log": "^1.0.0",
+        "@octokit/plugin-rest-endpoint-methods": "2.4.0",
         "@octokit/request": "^5.2.0",
         "@octokit/request-error": "^1.0.2",
         "atob-lite": "^2.0.0",
@@ -684,12 +729,24 @@
         "octokit-pagination-methods": "^1.1.0",
         "once": "^1.4.0",
         "universal-user-agent": "^4.0.0"
+      },
+      "dependencies": {
+        "@octokit/request-error": {
+          "version": "1.2.1",
+          "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-1.2.1.tgz",
+          "integrity": "sha512-+6yDyk1EES6WK+l3viRDElw96MvwfJxCt45GvmjDUKWjYIb3PJZQkq3i46TwGwoPD4h8NmTrENmtyA1FwbmhRA==",
+          "requires": {
+            "@octokit/types": "^2.0.0",
+            "deprecation": "^2.0.0",
+            "once": "^1.4.0"
+          }
+        }
       }
     },
     "@octokit/types": {
-      "version": "2.1.1",
+      "version": "2.14.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-2.1.1.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-2.14.0.tgz",
-      "integrity": "sha512-89LOYH+d/vsbDX785NOfLxTW88GjNd0lWRz1DVPVsZgg9Yett5O+3MOvwo7iHgvUwbFz0mf/yPIjBkUbs4kxoQ==",
+      "integrity": "sha512-1w2wxpN45rEXPDFeB7rGain7wcJ/aTRg8bdILITVnS0O7a4zEGELa3JmIe+jeLdekQjvZRbVfNPqS+mi5fKCKQ==",
       "requires": {
         "@types/node": ">= 8"
       }
@@ -6720,9 +6777,9 @@
       }
     },
     "universal-user-agent": {
-      "version": "4.0.0",
+      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-4.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-4.0.1.tgz",
-      "integrity": "sha512-eM8knLpev67iBDizr/YtqkJsF3GK8gzDc6st/WKzrTuPtcsOKW/0IdL4cnMBsU69pOx0otavLWBDGTwg+dB0aA==",
+      "integrity": "sha512-LnST3ebHwVL2aNe4mejI9IQh2HfZ1RLo8Io2HugSif8ekzD1TlWpHpColOB/eh8JHMLkGH3Akqf040I+4ylNxg==",
       "requires": {
         "os-name": "^3.1.0"
       }
@@ -6901,9 +6958,9 @@
       "dev": true
     },
     "windows-release": {
-      "version": "3.2.0",
+      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/windows-release/-/windows-release-3.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/windows-release/-/windows-release-3.3.0.tgz",
-      "integrity": "sha512-QTlz2hKLrdqukrsapKsINzqMgOUpQW268eJ0OaOpJN32h272waxR9fkB9VoWRtK7uKHG5EHJcTXQBD8XZVJkFA==",
+      "integrity": "sha512-2HetyTg1Y+R+rUgrKeUEhAG/ZuOmTrI1NBb3ZyAGQMYmOJjBBPe4MTodghRkmLJZHwkuPi02anbeGP+Zf401LQ==",
       "requires": {
         "execa": "^1.0.0"
       }

package.json

@@ -28,7 +28,7 @@
   "dependencies": {
     "@actions/core": "^1.1.3",
     "@actions/exec": "^1.0.1",
-    "@actions/github": "^2.0.2",
+    "@actions/github": "^2.2.0",
     "@actions/io": "^1.0.1",
     "@actions/tool-cache": "^1.1.2",
     "uuid": "^3.3.3"

src/git-auth-helper.ts

@@ -7,12 +7,12 @@ import * as os from 'os'
 import * as path from 'path'
 import * as regexpHelper from './regexp-helper'
 import * as stateHelper from './state-helper'
+import * as urlHelper from './url-helper'
 import {default as uuid} from 'uuid/v4'
 import {IGitCommandManager} from './git-command-manager'
 import {IGitSourceSettings} from './git-source-settings'
 
 const IS_WINDOWS = process.platform === 'win32'
-const HOSTNAME = 'github.com'
 const SSH_COMMAND_KEY = 'core.sshCommand'
 
 export interface IGitAuthHelper {
@@ -33,14 +33,15 @@ export function createAuthHelper(
 class GitAuthHelper {
   private readonly git: IGitCommandManager
   private readonly settings: IGitSourceSettings
-  private readonly tokenConfigKey: string = `http.https://${HOSTNAME}/.extraheader`
+  private readonly tokenConfigKey: string
+  private readonly tokenConfigValue: string
   private readonly tokenPlaceholderConfigValue: string
-  private readonly insteadOfKey: string = `url.https://${HOSTNAME}/.insteadOf`
+  private readonly insteadOfKey: string
-  private readonly insteadOfValue: string = `git@${HOSTNAME}:`
+  private readonly insteadOfValue: string
+  private sshCommand = ''
   private sshKeyPath = ''
   private sshKnownHostsPath = ''
   private temporaryHomePath = ''
-  private tokenConfigValue: string
 
   constructor(
     gitCommandManager: IGitCommandManager,
@@ -50,6 +51,8 @@ class GitAuthHelper {
     this.settings = gitSourceSettings || (({} as unknown) as IGitSourceSettings)
 
     // Token auth header
+    const serverUrl = urlHelper.getServerUrl()
+    this.tokenConfigKey = `http.${serverUrl.origin}/.extraheader` // "origin" is SCHEME://HOSTNAME[:PORT]
     const basicCredential = Buffer.from(
       `x-access-token:${this.settings.authToken}`,
       'utf8'
@@ -57,6 +60,10 @@ class GitAuthHelper {
     core.setSecret(basicCredential)
     this.tokenPlaceholderConfigValue = `AUTHORIZATION: basic ***`
     this.tokenConfigValue = `AUTHORIZATION: basic ${basicCredential}`
+
+    // Instead of SSH URL
+    this.insteadOfKey = `url.${serverUrl.origin}/.insteadOf` // "origin" is SCHEME://HOSTNAME[:PORT]
+    this.insteadOfValue = `git@${serverUrl.hostname}:`
   }
 
   async configureAuth(): Promise<void> {
@@ -144,8 +151,14 @@ class GitAuthHelper {
         this.replaceTokenPlaceholder(configPath)
       }
 
+      if (this.settings.sshKey) {
+        // Configure core.sshCommand
+        await this.git.submoduleForeach(
+          `git config --local '${SSH_COMMAND_KEY}' '${this.sshCommand}'`,
+          this.settings.nestedSubmodules
+        )
+      } else {
         // Configure HTTPS instead of SSH
-      if (!this.settings.sshKey) {
         await this.git.submoduleForeach(
           `git config --local '${this.insteadOfKey}' '${this.insteadOfValue}'`,
           this.settings.nestedSubmodules
@@ -160,7 +173,7 @@ class GitAuthHelper {
   }
 
   async removeGlobalAuth(): Promise<void> {
-    core.info(`Unsetting HOME override`)
+    core.debug(`Unsetting HOME override`)
     this.git.removeEnvironmentVariable('HOME')
     await io.rmRF(this.temporaryHomePath)
   }
@@ -218,21 +231,21 @@ class GitAuthHelper {
 
     // Configure GIT_SSH_COMMAND
     const sshPath = await io.which('ssh', true)
-    let sshCommand = `"${sshPath}" -i "$RUNNER_TEMP/${path.basename(
+    this.sshCommand = `"${sshPath}" -i "$RUNNER_TEMP/${path.basename(
       this.sshKeyPath
     )}"`
     if (this.settings.sshStrict) {
-      sshCommand += ' -o StrictHostKeyChecking=yes -o CheckHostIP=no'
+      this.sshCommand += ' -o StrictHostKeyChecking=yes -o CheckHostIP=no'
     }
-    sshCommand += ` -o "UserKnownHostsFile=$RUNNER_TEMP/${path.basename(
+    this.sshCommand += ` -o "UserKnownHostsFile=$RUNNER_TEMP/${path.basename(
       this.sshKnownHostsPath
     )}"`
-    core.info(`Temporarily overriding GIT_SSH_COMMAND=${sshCommand}`)
+    core.info(`Temporarily overriding GIT_SSH_COMMAND=${this.sshCommand}`)
-    this.git.setEnvironmentVariable('GIT_SSH_COMMAND', sshCommand)
+    this.git.setEnvironmentVariable('GIT_SSH_COMMAND', this.sshCommand)
 
     // Configure core.sshCommand
     if (this.settings.persistCredentials) {
-      await this.git.config(SSH_COMMAND_KEY, sshCommand)
+      await this.git.config(SSH_COMMAND_KEY, this.sshCommand)
     }
   }
 

src/git-directory-helper.ts

@@ -1,9 +1,11 @@
+import * as assert from 'assert'
 import * as core from '@actions/core'
 import * as fs from 'fs'
 import * as fsHelper from './fs-helper'
 import * as io from '@actions/io'
 import * as path from 'path'
 import {IGitCommandManager} from './git-command-manager'
+import {IGitSourceSettings} from './git-source-settings'
 
 export async function prepareExistingDirectory(
   git: IGitCommandManager | undefined,
@@ -11,6 +13,10 @@ export async function prepareExistingDirectory(
   repositoryUrl: string,
   clean: boolean
 ): Promise<void> {
+  assert.ok(repositoryPath, 'Expected repositoryPath to be defined')
+  assert.ok(repositoryUrl, 'Expected repositoryUrl to be defined')
+
+  // Indicates whether to delete the directory contents
   let remove = false
 
   // Check whether using git or REST API
@@ -38,6 +44,7 @@ export async function prepareExistingDirectory(
     }
 
     try {
+      core.startGroup('Removing previously created refs, to avoid conflicts')
       // Checkout detached HEAD
       if (!(await git.isDetached())) {
         await git.checkoutDetach()
@@ -54,9 +61,11 @@ export async function prepareExistingDirectory(
       for (const branch of branches) {
         await git.branchDelete(true, branch)
       }
+      core.endGroup()
 
       // Clean
       if (clean) {
+        core.startGroup('Cleaning the repository')
         if (!(await git.tryClean())) {
           core.debug(
             `The clean command failed. This might be caused by: 1) path too long, 2) permission issue, or 3) file in use. For futher investigation, manually run 'git clean -ffdx' on the directory '${repositoryPath}'.`
@@ -65,6 +74,7 @@ export async function prepareExistingDirectory(
         } else if (!(await git.tryReset())) {
           remove = true
         }
+        core.endGroup()
 
         if (remove) {
           core.warning(

src/git-source-provider.ts

@@ -8,23 +8,16 @@ import * as io from '@actions/io'
 import * as path from 'path'
 import * as refHelper from './ref-helper'
 import * as stateHelper from './state-helper'
+import * as urlHelper from './url-helper'
 import {IGitCommandManager} from './git-command-manager'
 import {IGitSourceSettings} from './git-source-settings'
 
-const hostname = 'github.com'
-
 export async function getSource(settings: IGitSourceSettings): Promise<void> {
   // Repository URL
   core.info(
     `Syncing repository: ${settings.repositoryOwner}/${settings.repositoryName}`
   )
-  const repositoryUrl = settings.sshKey
+  const repositoryUrl = urlHelper.getFetchUrl(settings)
-    ? `git@${hostname}:${encodeURIComponent(
-        settings.repositoryOwner
-      )}/${encodeURIComponent(settings.repositoryName)}.git`
-    : `https://${hostname}/${encodeURIComponent(
-        settings.repositoryOwner
-      )}/${encodeURIComponent(settings.repositoryName)}`
 
   // Remove conflicting file path
   if (fsHelper.fileExistsSync(settings.repositoryPath)) {
@@ -39,7 +32,9 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
   }
 
   // Git command manager
+  core.startGroup('Getting Git version info')
   const git = await getGitCommandManager(settings)
+  core.endGroup()
 
   // Prepare existing directory, otherwise recreate
   if (isExisting) {
@@ -57,6 +52,16 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
     core.info(
       `To create a local Git repository instead, add Git ${gitCommandManager.MinimumGitVersion} or higher to the PATH`
     )
+    if (settings.submodules) {
+      throw new Error(
+        `Input 'submodules' not supported when falling back to download using the GitHub REST API. To create a local Git repository instead, add Git ${gitCommandManager.MinimumGitVersion} or higher to the PATH.`
+      )
+    } else if (settings.sshKey) {
+      throw new Error(
+        `Input 'ssh-key' not supported when falling back to download using the GitHub REST API. To create a local Git repository instead, add Git ${gitCommandManager.MinimumGitVersion} or higher to the PATH.`
+      )
+    }
+
     await githubApiHelper.downloadRepository(
       settings.authToken,
       settings.repositoryOwner,
@@ -75,21 +80,27 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
   if (
     !fsHelper.directoryExistsSync(path.join(settings.repositoryPath, '.git'))
   ) {
+    core.startGroup('Initializing the repository')
     await git.init()
     await git.remoteAdd('origin', repositoryUrl)
+    core.endGroup()
   }
 
   // Disable automatic garbage collection
+  core.startGroup('Disabling automatic garbage collection')
   if (!(await git.tryDisableAutomaticGarbageCollection())) {
     core.warning(
       `Unable to turn off git automatic garbage collection. The git fetch operation may trigger garbage collection and cause a delay.`
     )
   }
+  core.endGroup()
 
   const authHelper = gitAuthHelper.createAuthHelper(git, settings)
   try {
     // Configure auth
+    core.startGroup('Setting up auth')
     await authHelper.configureAuth()
+    core.endGroup()
 
     // LFS install
     if (settings.lfs) {
@@ -97,33 +108,44 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
     }
 
     // Fetch
+    core.startGroup('Fetching the repository')
     const refSpec = refHelper.getRefSpec(settings.ref, settings.commit)
     await git.fetch(settings.fetchDepth, refSpec)
+    core.endGroup()
 
     // Checkout info
+    core.startGroup('Determining the checkout info')
     const checkoutInfo = await refHelper.getCheckoutInfo(
       git,
       settings.ref,
       settings.commit
     )
+    core.endGroup()
 
     // LFS fetch
     // Explicit lfs-fetch to avoid slow checkout (fetches one lfs object at a time).
     // Explicit lfs fetch will fetch lfs objects in parallel.
     if (settings.lfs) {
+      core.startGroup('Fetching LFS objects')
       await git.lfsFetch(checkoutInfo.startPoint || checkoutInfo.ref)
+      core.endGroup()
     }
 
     // Checkout
+    core.startGroup('Checking out the ref')
     await git.checkout(checkoutInfo.ref, checkoutInfo.startPoint)
+    core.endGroup()
 
     // Submodules
     if (settings.submodules) {
       try {
         // Temporarily override global config
+        core.startGroup('Setting up auth for fetching submodules')
         await authHelper.configureGlobalAuth()
+        core.endGroup()
 
         // Checkout submodules
+        core.startGroup('Fetching submodules')
         await git.submoduleSync(settings.nestedSubmodules)
         await git.submoduleUpdate(
           settings.fetchDepth,
@@ -133,10 +155,13 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
           'git config --local gc.auto 0',
           settings.nestedSubmodules
         )
+        core.endGroup()
 
         // Persist credentials
         if (settings.persistCredentials) {
+          core.startGroup('Persisting credentials for submodules')
           await authHelper.configureSubmoduleAuth()
+          core.endGroup()
         }
       } finally {
         // Remove temporary global config override
@@ -149,7 +174,9 @@ export async function getSource(settings: IGitSourceSettings): Promise<void> {
   } finally {
     // Remove auth
     if (!settings.persistCredentials) {
+      core.startGroup('Removing auth')
       await authHelper.removeAuth()
+      core.endGroup()
     }
   }
 }

src/git-source-settings.ts

@@ -1,17 +1,76 @@
 export interface IGitSourceSettings {
+  /**
+   * The location on disk where the repository will be placed
+   */
   repositoryPath: string
+
+  /**
+   * The repository owner
+   */
   repositoryOwner: string
+
+  /**
+   * The repository name
+   */
   repositoryName: string
+
+  /**
+   * The ref to fetch
+   */
   ref: string
+
+  /**
+   * The commit to checkout
+   */
   commit: string
+
+  /**
+   * Indicates whether to clean the repository
+   */
   clean: boolean
+
+  /**
+   * The depth when fetching
+   */
   fetchDepth: number
+
+  /**
+   * Indicates whether to fetch LFS objects
+   */
   lfs: boolean
+
+  /**
+   * Indicates whether to checkout submodules
+   */
   submodules: boolean
+
+  /**
+   * Indicates whether to recursively checkout submodules
+   */
   nestedSubmodules: boolean
+
+  /**
+   * The auth token to use when fetching the repository
+   */
   authToken: string
+
+  /**
+   * The SSH key to configure
+   */
   sshKey: string
+
+  /**
+   * Additional SSH known hosts
+   */
   sshKnownHosts: string
+
+  /**
+   * Indicates whether the server must be a known host
+   */
   sshStrict: boolean
+
+  /**
+   * Indicates whether to persist the credentials on disk to enable scripting authenticated git commands
+   */
   persistCredentials: boolean
 }

src/github-api-helper.ts

@@ -7,7 +7,7 @@ import * as path from 'path'
 import * as retryHelper from './retry-helper'
 import * as toolCache from '@actions/tool-cache'
 import {default as uuid} from 'uuid/v4'
-import {ReposGetArchiveLinkParams} from '@octokit/rest'
+import {Octokit} from '@octokit/rest'
 
 const IS_WINDOWS = process.platform === 'win32'
 
@@ -75,7 +75,7 @@ async function downloadArchive(
   commit: string
 ): Promise<Buffer> {
   const octokit = new github.GitHub(authToken)
-  const params: ReposGetArchiveLinkParams = {
+  const params: Octokit.ReposGetArchiveLinkParams = {
     owner: owner,
     repo: repo,
     archive_format: IS_WINDOWS ? 'zipball' : 'tarball',

src/url-helper.ts

@@ -0,0 +1,29 @@
+import * as assert from 'assert'
+import {IGitSourceSettings} from './git-source-settings'
+import {URL} from 'url'
+
+export function getFetchUrl(settings: IGitSourceSettings): string {
+  assert.ok(
+    settings.repositoryOwner,
+    'settings.repositoryOwner must be defined'
+  )
+  assert.ok(settings.repositoryName, 'settings.repositoryName must be defined')
+  const serviceUrl = getServerUrl()
+  const encodedOwner = encodeURIComponent(settings.repositoryOwner)
+  const encodedName = encodeURIComponent(settings.repositoryName)
+  if (settings.sshKey) {
+    return `git@${serviceUrl.hostname}:${encodedOwner}/${encodedName}.git`
+  }
+
+  // "origin" is SCHEME://HOSTNAME[:PORT]
+  return `${serviceUrl.origin}/${encodedOwner}/${encodedName}`
+}
+
+export function getServerUrl(): URL {
+  // todo: remove GITHUB_URL after support for GHES Alpha is no longer needed
+  return new URL(
+    process.env['GITHUB_SERVER_URL'] ||
+      process.env['GITHUB_URL'] ||
+      'https://github.com'
+  )
+}