From 9713cd527d350e6e23fd522d36126c3b13a3a84b Mon Sep 17 00:00:00 2001
From: Antti Harju <antti@harju.io>
Date: Sat, 26 Sep 2026 21:29:10 +0300
Subject: [PATCH 1/4] Improve composability

---
 .github/workflows/example.yml             |  9 ++++++++-
 .github/workflows/plan.yml                | 15 ++++++++++++---
 .release/compare-changes-action/README.md |  6 +++++-
 .release/find-changes-action/README.md    | 19 +++++++++++++++++--
 .release/find-changes-action/action.yml   | 20 ++++++++++++++++++++
 5 files changed, 62 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/example.yml b/.github/workflows/example.yml
index c1a7492b..de5b23f8 100644
--- a/.github/workflows/example.yml
+++ b/.github/workflows/example.yml
@@ -13,14 +13,21 @@ jobs:
     permissions:
       contents: read
     steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
       - name: Find changes
         id: changes
-        uses: anttiharju/find-changes-action@v0 # handles checkout
+        uses: anttiharju/find-changes-action@v0
+
       - id: shellcheck
         uses: anttiharju/compare-changes-action@v0
         with:
           workflow: wildcard/shellcheck.yml
           changes: ${{ steps.changes.outputs.array }}
+
       - if: steps.shellcheck.outputs.changed == 'true'
         name: shellcheck
         run: git ls-files -z '*.sh' | xargs --null shellcheck --color=always
diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml
index cf6861f4..7e590275 100644
--- a/.github/workflows/plan.yml
+++ b/.github/workflows/plan.yml
@@ -26,9 +26,13 @@ jobs:
       contents: read
       packages: write
     steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Find changes
         id: changes
-        uses: anttiharju/find-changes-action@v0 # handles checkout
+        uses: anttiharju/find-changes-action@v0
       - name: Compare changes
         id: flake
         uses: anttiharju/compare-changes-action@v0
@@ -134,9 +138,15 @@ jobs:
         username: ${{ github.actor }}
         password: ${{ github.token }}
     steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+          fetch-tags: true
+
       - name: Find changes
         id: changes
-        uses: anttiharju/find-changes-action@v0 # handles checkout
+        uses: anttiharju/find-changes-action@v0
 
       - name: Detect changes
         id: changed
@@ -181,7 +191,6 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          git fetch origin 'refs/tags/*:refs/tags/*' # TODO: https://github.com/anttiharju/compare-changes/issues/258
           .release/render.sh compare-changes-action
 
       - if: always() && !cancelled() && steps.changed.outputs.compare-changes-action == 'true' && github.event_name != 'push' && steps.semantic.outputs.type != 'major'
diff --git a/.release/compare-changes-action/README.md b/.release/compare-changes-action/README.md
index f5cdaf2b..29bff88b 100644
--- a/.release/compare-changes-action/README.md
+++ b/.release/compare-changes-action/README.md
@@ -17,9 +17,13 @@ jobs:
     permissions:
       contents: read
     steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Find changes
         id: changes
-        uses: anttiharju/find-changes-action@v0 # handles checkout
+        uses: anttiharju/find-changes-action@v0
       - id: shellcheck
         uses: anttiharju/compare-changes-action@v0
         with:
diff --git a/.release/find-changes-action/README.md b/.release/find-changes-action/README.md
index bb40b1fb..a1b40584 100644
--- a/.release/find-changes-action/README.md
+++ b/.release/find-changes-action/README.md
@@ -33,9 +33,14 @@ jobs:
   example:
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
       - name: Find changes
         id: changes
-        uses: anttiharju/find-changes-action@v0 # handles checkout
+        uses: anttiharju/find-changes-action@v0
 
       - name: Echo changed files
         shell: sh
@@ -106,9 +111,13 @@ jobs:
     permissions:
       contents: read
     steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Find changes
         id: changes
-        uses: anttiharju/find-changes-action@v0 # handles checkout
+        uses: anttiharju/find-changes-action@v0
       - id: shellcheck
         uses: anttiharju/compare-changes-action@v0
         with:
@@ -119,6 +128,12 @@ jobs:
         run: git ls-files -z '*.sh' | xargs --null shellcheck --color=always
 ```
 
+## Checkout
+
+This action assumes that your repository does not have a directory named `.tmp-anttiharju-compare-changes` for how it uses `actions/checkout` internally. It does not replace your existing checkout. A `.gitignore` file with `*` in `.tmp-anttiharju-compare-changes` hides the temporary files from your Git status. The action also removes the temporary directory and its checkout credentials after use, including after a failed step.
+
+If you need repository files, use `actions/checkout` separately. This way composability of the steps is retained and this action does not need to pass through all inputs and outputs of `actions/checkout`.
+
 ## More information
 
 Refer to https://github.com/anttiharju/compare-changes
diff --git a/.release/find-changes-action/action.yml b/.release/find-changes-action/action.yml
index 119e5e34..06367fe8 100644
--- a/.release/find-changes-action/action.yml
+++ b/.release/find-changes-action/action.yml
@@ -48,24 +48,44 @@ runs:
         LINUX_X64_SHA: "$PKG_LINUX_X64_SHA"
       run: |
         "$$GITHUB_ACTION_PATH/scripts/verify.sh"
+    - name: Prepare checkout
+      shell: sh
+      run: |
+        mkdir .tmp-anttiharju-compare-changes # no -p on purpose: why would you have directory with this name in your repository?
+        printf '*\n' > .tmp-anttiharju-compare-changes/.gitignore
     - if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
       name: Checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
+        path: .tmp-anttiharju-compare-changes/${{ github.repository }}
         fetch-depth: 2
         persist-credentials: true
     - if: github.event_name == 'push'
       name: Checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
+        path: .tmp-anttiharju-compare-changes/${{ github.repository }}
         persist-credentials: true
     - name: Run
       id: run
+      working-directory: .tmp-anttiharju-compare-changes/${{ github.repository }}
       shell: sh
       env:
         BINARY: ${{ steps.check.outputs.directory }}/compare-changes
       run: |
         "$$BINARY" --find
+    - if: always()
+      name: Clean up checkout
+      shell: sh
+      run: |
+        directory=".tmp-anttiharju-compare-changes/$$GITHUB_REPOSITORY"
+        if [ -f "$$directory/.git/config" ]; then
+          credentials="$$(git config --file "$$directory/.git/config" --get "includeIf.gitdir:$$PWD/$$directory/.git.path" || true)"
+          case "$$credentials" in
+            "$$RUNNER_TEMP"/git-credentials-*.config) rm -f "$$credentials" ;;
+          esac
+        fi
+        rm -rf .tmp-anttiharju-compare-changes
 outputs:
   array:
     description: "JSON array of changed files."

From 9c3391baba01d623755056da55f24b9de7999d3e Mon Sep 17 00:00:00 2001
From: Antti Harju <antti@harju.io>
Date: Sat, 26 Sep 2026 21:33:15 +0300
Subject: [PATCH 2/4] Fix action releases

---
 .github/actions/release/action/action.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/actions/release/action/action.yml b/.github/actions/release/action/action.yml
index 66fb53a6..cc65c6fa 100644
--- a/.github/actions/release/action/action.yml
+++ b/.github/actions/release/action/action.yml
@@ -51,6 +51,7 @@ runs:
       shell: sh
       env:
         action: ${{ inputs.action }}
+        GH_TOKEN: ${{ github.token }}
       run: |
         .release/render.sh "$action-changes-action" --output "release-$action"
     - name: Commit changes

From 7c6887c9f838ee144cc1b359cbefcd4dd45b30c3 Mon Sep 17 00:00:00 2001
From: Antti Harju <antti@harju.io>
Date: Sat, 26 Sep 2026 21:31:21 +0300
Subject: [PATCH 3/4] Tmp lock to use a working version

---
 .github/actions/detect-changes/action.yml | 26 +++++++++++------------
 .github/workflows/example.yml             |  4 ++--
 .github/workflows/plan.yml                |  6 +++---
 .release/compare-changes-action/README.md |  6 +++---
 .release/find-changes-action/README.md    |  6 +++---
 5 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/.github/actions/detect-changes/action.yml b/.github/actions/detect-changes/action.yml
index 967e66c8..157c9aa5 100644
--- a/.github/actions/detect-changes/action.yml
+++ b/.github/actions/detect-changes/action.yml
@@ -8,7 +8,7 @@ runs:
   using: "composite"
   steps:
     - id: actionlint
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         paths: |
           .github/*/**.yml
@@ -16,7 +16,7 @@ runs:
           flake.nix
         changes: ${{ inputs.changes }}
     - id: prettier
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         paths: |
           **.md
@@ -25,7 +25,7 @@ runs:
           flake.nix
         changes: ${{ inputs.changes }}
     - id: compare-changes-action
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         paths: |
           .release/compare-changes-action/**
@@ -33,7 +33,7 @@ runs:
           flake.nix
         changes: ${{ inputs.changes }}
     - id: find-changes-action
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         paths: |
           .release/find-changes-action/**
@@ -41,7 +41,7 @@ runs:
           flake.nix
         changes: ${{ inputs.changes }}
     - id: homebrew-tap
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         paths: |
           .release/homebrew-tap/**
@@ -49,7 +49,7 @@ runs:
           flake.nix
         changes: ${{ inputs.changes }}
     - id: github
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         paths: |
           .release/archive.sh
@@ -57,7 +57,7 @@ runs:
           flake.nix
         changes: ${{ inputs.changes }}
     - id: nix
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         paths: |
           .release/nur-packages/**
@@ -65,7 +65,7 @@ runs:
           flake.nix
         changes: ${{ inputs.changes }}
     - id: rs
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         paths: |
           **.rs
@@ -75,7 +75,7 @@ runs:
           flake.nix
         changes: ${{ inputs.changes }}
     - id: rust
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         paths: |
           .cargo/**
@@ -87,12 +87,12 @@ runs:
           flake.nix
         changes: ${{ inputs.changes }}
     - id: shellcheck
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         workflow: wildcard/shellcheck.yml
         changes: ${{ inputs.changes }}
     - id: src
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         paths: |
           src/**
@@ -100,7 +100,7 @@ runs:
           flake.nix
         changes: ${{ inputs.changes }}
     - id: zensical
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         paths: |
           docs/**
@@ -109,7 +109,7 @@ runs:
           flake.nix
         changes: ${{ inputs.changes }}
     - id: zizmor
-      uses: anttiharju/compare-changes-action@v0
+      uses: anttiharju/compare-changes-action@v0.12.19
       with:
         paths: |
           **/action.yml
diff --git a/.github/workflows/example.yml b/.github/workflows/example.yml
index de5b23f8..1f3a9455 100644
--- a/.github/workflows/example.yml
+++ b/.github/workflows/example.yml
@@ -20,10 +20,10 @@ jobs:
 
       - name: Find changes
         id: changes
-        uses: anttiharju/find-changes-action@v0
+        uses: anttiharju/find-changes-action@v0.12.19
 
       - id: shellcheck
-        uses: anttiharju/compare-changes-action@v0
+        uses: anttiharju/compare-changes-action@v0.12.19
         with:
           workflow: wildcard/shellcheck.yml
           changes: ${{ steps.changes.outputs.array }}
diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml
index 7e590275..63824a90 100644
--- a/.github/workflows/plan.yml
+++ b/.github/workflows/plan.yml
@@ -32,10 +32,10 @@ jobs:
           persist-credentials: false
       - name: Find changes
         id: changes
-        uses: anttiharju/find-changes-action@v0
+        uses: anttiharju/find-changes-action@v0.12.19
       - name: Compare changes
         id: flake
-        uses: anttiharju/compare-changes-action@v0
+        uses: anttiharju/compare-changes-action@v0.12.19
         with:
           paths: |
             .cargo/zig/**
@@ -146,7 +146,7 @@ jobs:
 
       - name: Find changes
         id: changes
-        uses: anttiharju/find-changes-action@v0
+        uses: anttiharju/find-changes-action@v0.12.19
 
       - name: Detect changes
         id: changed
diff --git a/.release/compare-changes-action/README.md b/.release/compare-changes-action/README.md
index 29bff88b..0474d4f4 100644
--- a/.release/compare-changes-action/README.md
+++ b/.release/compare-changes-action/README.md
@@ -23,14 +23,14 @@ jobs:
           persist-credentials: false
       - name: Find changes
         id: changes
-        uses: anttiharju/find-changes-action@v0
+        uses: anttiharju/find-changes-action@v0.12.19
       - id: shellcheck
-        uses: anttiharju/compare-changes-action@v0
+        uses: anttiharju/compare-changes-action@v0.12.19
         with:
           workflow: wildcard/shellcheck.yml # see .github/workflows/wildcard/shellcheck.yml below
           changes: ${{ steps.changes.outputs.array }}
       - id: shellcheck
-        uses: anttiharju/compare-changes-action@v0
+        uses: anttiharju/compare-changes-action@v0.12.19
         with:
           paths: |
             **.sh
diff --git a/.release/find-changes-action/README.md b/.release/find-changes-action/README.md
index a1b40584..ea1d54b4 100644
--- a/.release/find-changes-action/README.md
+++ b/.release/find-changes-action/README.md
@@ -40,7 +40,7 @@ jobs:
 
       - name: Find changes
         id: changes
-        uses: anttiharju/find-changes-action@v0
+        uses: anttiharju/find-changes-action@v0.12.19
 
       - name: Echo changed files
         shell: sh
@@ -117,9 +117,9 @@ jobs:
           persist-credentials: false
       - name: Find changes
         id: changes
-        uses: anttiharju/find-changes-action@v0
+        uses: anttiharju/find-changes-action@v0.12.19
       - id: shellcheck
-        uses: anttiharju/compare-changes-action@v0
+        uses: anttiharju/compare-changes-action@v0.12.19
         with:
           workflow: wildcard/shellcheck.yml # storing the stub workflow under wildcard/ prevents it from polluting your repository's $url/actions UI!
           changes: ${{ steps.changes.outputs.array }}

From d22f14c4591a26849e6a2493c3ac1d257667ae0c Mon Sep 17 00:00:00 2001
From: "mergestorm-cyclone[bot]"
 <mergestorm-cyclone[bot]@users.noreply.github.com>
Date: Sat, 26 Sep 2026 19:10:29 +0000
Subject: [PATCH 4/4] [skip ci] Apply review fixes

Cyclone-Source: mergestorm-vortex[bot]
Cyclone-Batch: review-5327037552
---
 .github/workflows/plan.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml
index 63824a90..3581ab24 100644
--- a/.github/workflows/plan.yml
+++ b/.github/workflows/plan.yml
@@ -142,6 +142,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           persist-credentials: false
+          fetch-depth: 0
           fetch-tags: true
 
       - name: Find changes