mirror of
https://hub.psychoinformatics.de/actions/checkout-action.git
synced 2026-09-10 05:46:04 +00:00
106 lines
6 KiB
Markdown
106 lines
6 KiB
Markdown
# checkout-action
|
|
|
|
[](https://github.com/taiki-e/checkout-action/releases/latest)
|
|
[](https://github.com/taiki-e/checkout-action/actions)
|
|
|
|
GitHub Action for checking out a repository. (Simplified [actions/checkout] alternative that does not depend on Node.js.)
|
|
|
|
- [Usage](#usage)
|
|
- [Inputs](#inputs)
|
|
- [Why not actions/checkout?](#why-not-actionscheckout)
|
|
- [Security](#security)
|
|
- [Compatibility](#compatibility)
|
|
- [Related Projects](#related-projects)
|
|
- [License](#license)
|
|
|
|
## Usage
|
|
|
|
This action currently provides a minimal subset of the features provided by [actions/checkout].
|
|
|
|
The features supported as of v1.0.0 are purely based on my use cases within public repositories, but feel free to submit an issue if you see something missing in your use case. See [issues](https://github.com/taiki-e/checkout-action/issues) for known unsupported features.
|
|
|
|
```yaml
|
|
- uses: taiki-e/checkout-action@v1
|
|
```
|
|
|
|
Almost equivalent to:
|
|
|
|
```yaml
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
token: ''
|
|
```
|
|
|
|
To use this action in private repositories, explicitly set `token` input option:
|
|
|
|
```yaml
|
|
- uses: taiki-e/checkout-action@v1
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
```
|
|
|
|
Almost equivalent to:
|
|
|
|
```yaml
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
```
|
|
|
|
### Inputs
|
|
|
|
| Name | Required | Description | Type | Default |
|
|
| ---- | :------: | ----------- | ---- | ------- |
|
|
| token | | GitHub token for checking out a repository. | String | |
|
|
|
|
## Why not actions/checkout?
|
|
|
|
As of 2024-03-08, the latest version of [actions/checkout] that uses node20 [doesn't work on CentOS 7](https://github.com/actions/runner/issues/2906).
|
|
|
|
Also, in `actions/*` actions, each update of the Node.js used increments the major version (it is the correct behavior for compatibility although), so workflows that use it require maintenance on a regular basis. (Unless you have fully automated dependency updates.)
|
|
|
|
In addition to not using tokens by default, this action does not write credentials to disk even if `token` input option is set, but actions/checkout (as of 6.0.2) [writes credentials to disk as plaintext even when `persist-credentials` is set to `false`, when git is available](https://github.com/taiki-e/checkout-action/pull/16). Therefore, this action is considered more secure than actions/checkout not only by default but also when `persist-credentials` is set to `false`.
|
|
|
|
## Security
|
|
|
|
The `@v<major>` tags are updated with each release. If you want to enhance workflow stability and security against supply chain attacks, consider using the `@v<major>.<minor>.<patch>` tag or their hash to pin the version and regularly updating with dependency cooldown. Since all releases are immutable, pinning the version in either way should have the same effect.
|
|
|
|
## Compatibility
|
|
|
|
This action has been [tested](https://github.com/taiki-e/checkout-action/blob/HEAD/.github/workflows/ci.yml) for GitHub-hosted runners (Ubuntu, macOS, Windows) and containers (Debian, Ubuntu, Devuan, Kali, Fedora, Red Hat UBI, CentOS, Alma, Rocky, Oracle, Amazon, Azure, Mageia, OpenMandriva, ALT, Photon, Wind River, openEuler, openSUSE, Alpine, OpenWrt, Wolfi, Arch, Artix, CachyOS, Manjaro, Gentoo, Void, Vanilla, Nix).
|
|
|
|
On Linux, if any required tools are missing, this action will [attempt to install them from system package manager](https://github.com/taiki-e/checkout-action/blob/HEAD/src/install-required-tools.sh), so no pre-setup is usually required (except for CentOS or Debian 10 (or older) or very old distro described below, which was already EoL and needs to use vault/archive repos -- see "Install requirements" in [our CI config](https://github.com/taiki-e/checkout-action/blob/HEAD/.github/workflows/ci.yml) for example of setup).
|
|
|
|
On other platforms, at least the following tools are required:
|
|
|
|
- bash 3.2+
|
|
- git 1.8+ (when using `token` input option, it is recommended using git 2.0+ for security reasons)
|
|
|
|
Known environments affected by the above version requirements are CentOS 6 (EoL on 2020-11), Ubuntu 12.04 (EoL on 2017-04), and Debian 7 (EoL on 2016-04), using git 1.7 (see "Install requirements (CentOS)" in [our CI config](https://github.com/taiki-e/checkout-action/blob/HEAD/.github/workflows/ci.yml) for example of workaround on CentOS 6).
|
|
|
|
Note that what this action installs for its setup (such as above tools) is considered an implementation detail if they are installed by this action's side, and there is no guarantee that they will be available in subsequent steps, because this action is not an action for installing those tools.
|
|
|
|
## Related Projects
|
|
|
|
- [install-action]: GitHub Action for installing development tools (mainly from GitHub Releases).
|
|
- [create-gh-release-action]: GitHub Action for creating GitHub Releases based on changelog.
|
|
- [upload-rust-binary-action]: GitHub Action for building and uploading Rust binary to GitHub Releases.
|
|
- [setup-cross-toolchain-action]: GitHub Action for setup toolchains for cross compilation and cross testing for Rust.
|
|
- [cache-cargo-install-action]: GitHub Action for `cargo install` with cache.
|
|
|
|
[actions/checkout]: https://github.com/actions/checkout
|
|
[cache-cargo-install-action]: https://github.com/taiki-e/cache-cargo-install-action
|
|
[create-gh-release-action]: https://github.com/taiki-e/create-gh-release-action
|
|
[install-action]: https://github.com/taiki-e/install-action
|
|
[setup-cross-toolchain-action]: https://github.com/taiki-e/setup-cross-toolchain-action
|
|
[upload-rust-binary-action]: https://github.com/taiki-e/upload-rust-binary-action
|
|
|
|
## License
|
|
|
|
Licensed under either of [Apache License, Version 2.0](LICENSE-APACHE) or
|
|
[MIT license](LICENSE-MIT) at your option.
|
|
|
|
Unless you explicitly state otherwise, any contribution intentionally submitted
|
|
for inclusion in the work by you, as defined in the Apache-2.0 license, shall
|
|
be dual licensed as above, without any additional terms or conditions.
|