diff --git a/.github/actions/detect-changes/action.yml b/.github/actions/detect-changes/action.yml index 967e66c8..157c9aa5 100644 --- a/.github/actions/detect-changes/action.yml +++ b/.github/actions/detect-changes/action.yml @@ -8,7 +8,7 @@ runs: using: "composite" steps: - id: actionlint - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | .github/*/**.yml @@ -16,7 +16,7 @@ runs: flake.nix changes: ${{ inputs.changes }} - id: prettier - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | **.md @@ -25,7 +25,7 @@ runs: flake.nix changes: ${{ inputs.changes }} - id: compare-changes-action - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | .release/compare-changes-action/** @@ -33,7 +33,7 @@ runs: flake.nix changes: ${{ inputs.changes }} - id: find-changes-action - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | .release/find-changes-action/** @@ -41,7 +41,7 @@ runs: flake.nix changes: ${{ inputs.changes }} - id: homebrew-tap - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | .release/homebrew-tap/** @@ -49,7 +49,7 @@ runs: flake.nix changes: ${{ inputs.changes }} - id: github - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | .release/archive.sh @@ -57,7 +57,7 @@ runs: flake.nix changes: ${{ inputs.changes }} - id: nix - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | .release/nur-packages/** @@ -65,7 +65,7 @@ runs: flake.nix changes: ${{ inputs.changes }} - id: rs - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | **.rs @@ -75,7 +75,7 @@ runs: flake.nix changes: ${{ inputs.changes }} - id: rust - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | .cargo/** @@ -87,12 +87,12 @@ runs: flake.nix changes: ${{ inputs.changes }} - id: shellcheck - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: workflow: wildcard/shellcheck.yml changes: ${{ inputs.changes }} - id: src - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | src/** @@ -100,7 +100,7 @@ runs: flake.nix changes: ${{ inputs.changes }} - id: zensical - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | docs/** @@ -109,7 +109,7 @@ runs: flake.nix changes: ${{ inputs.changes }} - id: zizmor - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | **/action.yml diff --git a/.github/actions/release/action/action.yml b/.github/actions/release/action/action.yml index 66fb53a6..cc65c6fa 100644 --- a/.github/actions/release/action/action.yml +++ b/.github/actions/release/action/action.yml @@ -51,6 +51,7 @@ runs: shell: sh env: action: ${{ inputs.action }} + GH_TOKEN: ${{ github.token }} run: | .release/render.sh "$action-changes-action" --output "release-$action" - name: Commit changes diff --git a/.github/workflows/example.yml b/.github/workflows/example.yml index c1a7492b..1f3a9455 100644 --- a/.github/workflows/example.yml +++ b/.github/workflows/example.yml @@ -13,14 +13,21 @@ jobs: permissions: contents: read steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Find changes id: changes - uses: anttiharju/find-changes-action@v0 # handles checkout + uses: anttiharju/find-changes-action@v0.12.19 + - id: shellcheck - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: workflow: wildcard/shellcheck.yml changes: ${{ steps.changes.outputs.array }} + - if: steps.shellcheck.outputs.changed == 'true' name: shellcheck run: git ls-files -z '*.sh' | xargs --null shellcheck --color=always diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml index cf6861f4..3581ab24 100644 --- a/.github/workflows/plan.yml +++ b/.github/workflows/plan.yml @@ -26,12 +26,16 @@ jobs: contents: read packages: write steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false - name: Find changes id: changes - uses: anttiharju/find-changes-action@v0 # handles checkout + uses: anttiharju/find-changes-action@v0.12.19 - name: Compare changes id: flake - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | .cargo/zig/** @@ -134,9 +138,16 @@ jobs: username: ${{ github.actor }} password: ${{ github.token }} steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + fetch-depth: 0 + fetch-tags: true + - name: Find changes id: changes - uses: anttiharju/find-changes-action@v0 # handles checkout + uses: anttiharju/find-changes-action@v0.12.19 - name: Detect changes id: changed @@ -181,7 +192,6 @@ jobs: env: GH_TOKEN: ${{ github.token }} run: | - git fetch origin 'refs/tags/*:refs/tags/*' # TODO: https://github.com/anttiharju/compare-changes/issues/258 .release/render.sh compare-changes-action - if: always() && !cancelled() && steps.changed.outputs.compare-changes-action == 'true' && github.event_name != 'push' && steps.semantic.outputs.type != 'major' diff --git a/.release/compare-changes-action/README.md b/.release/compare-changes-action/README.md index f5cdaf2b..0474d4f4 100644 --- a/.release/compare-changes-action/README.md +++ b/.release/compare-changes-action/README.md @@ -17,16 +17,20 @@ jobs: permissions: contents: read steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false - name: Find changes id: changes - uses: anttiharju/find-changes-action@v0 # handles checkout + uses: anttiharju/find-changes-action@v0.12.19 - id: shellcheck - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: workflow: wildcard/shellcheck.yml # see .github/workflows/wildcard/shellcheck.yml below changes: ${{ steps.changes.outputs.array }} - id: shellcheck - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: paths: | **.sh diff --git a/.release/find-changes-action/README.md b/.release/find-changes-action/README.md index bb40b1fb..ea1d54b4 100644 --- a/.release/find-changes-action/README.md +++ b/.release/find-changes-action/README.md @@ -33,9 +33,14 @@ jobs: example: runs-on: ubuntu-latest steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Find changes id: changes - uses: anttiharju/find-changes-action@v0 # handles checkout + uses: anttiharju/find-changes-action@v0.12.19 - name: Echo changed files shell: sh @@ -106,11 +111,15 @@ jobs: permissions: contents: read steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false - name: Find changes id: changes - uses: anttiharju/find-changes-action@v0 # handles checkout + uses: anttiharju/find-changes-action@v0.12.19 - id: shellcheck - uses: anttiharju/compare-changes-action@v0 + uses: anttiharju/compare-changes-action@v0.12.19 with: workflow: wildcard/shellcheck.yml # storing the stub workflow under wildcard/ prevents it from polluting your repository's $url/actions UI! changes: ${{ steps.changes.outputs.array }} @@ -119,6 +128,12 @@ jobs: run: git ls-files -z '*.sh' | xargs --null shellcheck --color=always ``` +## Checkout + +This action assumes that your repository does not have a directory named `.tmp-anttiharju-compare-changes` for how it uses `actions/checkout` internally. It does not replace your existing checkout. A `.gitignore` file with `*` in `.tmp-anttiharju-compare-changes` hides the temporary files from your Git status. The action also removes the temporary directory and its checkout credentials after use, including after a failed step. + +If you need repository files, use `actions/checkout` separately. This way composability of the steps is retained and this action does not need to pass through all inputs and outputs of `actions/checkout`. + ## More information Refer to https://github.com/anttiharju/compare-changes diff --git a/.release/find-changes-action/action.yml b/.release/find-changes-action/action.yml index 119e5e34..06367fe8 100644 --- a/.release/find-changes-action/action.yml +++ b/.release/find-changes-action/action.yml @@ -48,24 +48,44 @@ runs: LINUX_X64_SHA: "$PKG_LINUX_X64_SHA" run: | "$$GITHUB_ACTION_PATH/scripts/verify.sh" + - name: Prepare checkout + shell: sh + run: | + mkdir .tmp-anttiharju-compare-changes # no -p on purpose: why would you have directory with this name in your repository? + printf '*\n' > .tmp-anttiharju-compare-changes/.gitignore - if: github.event_name == 'pull_request' || github.event_name == 'merge_group' name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + path: .tmp-anttiharju-compare-changes/${{ github.repository }} fetch-depth: 2 persist-credentials: true - if: github.event_name == 'push' name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + path: .tmp-anttiharju-compare-changes/${{ github.repository }} persist-credentials: true - name: Run id: run + working-directory: .tmp-anttiharju-compare-changes/${{ github.repository }} shell: sh env: BINARY: ${{ steps.check.outputs.directory }}/compare-changes run: | "$$BINARY" --find + - if: always() + name: Clean up checkout + shell: sh + run: | + directory=".tmp-anttiharju-compare-changes/$$GITHUB_REPOSITORY" + if [ -f "$$directory/.git/config" ]; then + credentials="$$(git config --file "$$directory/.git/config" --get "includeIf.gitdir:$$PWD/$$directory/.git.path" || true)" + case "$$credentials" in + "$$RUNNER_TEMP"/git-credentials-*.config) rm -f "$$credentials" ;; + esac + fi + rm -rf .tmp-anttiharju-compare-changes outputs: array: description: "JSON array of changed files."