Update actions/checkout action to v4.1.6

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v4.1.0 -> v4.1.6

---

Release Notes

actions/checkout (actions/checkout)

v4.1.6

Compare Source

• Check platform to set archive extension appropriately by @​cory-miller in https://github.com/actions/checkout/pull/1732

v4.1.5

Compare Source

What's Changed

• Update NPM dependencies by @​cory-miller in https://github.com/actions/checkout/pull/1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in https://github.com/actions/checkout/pull/1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in https://github.com/actions/checkout/pull/1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in https://github.com/actions/checkout/pull/1695
• README: Suggest user.email to be 41898282+github-actions[bot]@​users.noreply.github.com by @​cory-miller in https://github.com/actions/checkout/pull/1707

Full Changelog: actions/checkout@v4.1.4...v4.1.5

v4.1.4

Compare Source

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1692
• Add dependabot config by @​cory-miller in https://github.com/actions/checkout/pull/1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in https://github.com/actions/checkout/pull/1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in https://github.com/actions/checkout/pull/1643

v4.1.3

Compare Source

What's Changed

• Update actions/checkout version in update-main-version.yml by @​jww3 in https://github.com/actions/checkout/pull/1650
• Check git version before attempting to disable sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1656
• Add SSH user parameter by @​cory-miller in https://github.com/actions/checkout/pull/1685

Full Changelog: actions/checkout@v4.1.2...v4.1.3

v4.1.2

Compare Source

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in https://github.com/actions/checkout/pull/1598

v4.1.1

Compare Source

What's Changed

• Update CODEOWNERS to Launch team by @​joshmgross in https://github.com/actions/checkout/pull/1510
• Correct link to GitHub Docs by @​peterbe in https://github.com/actions/checkout/pull/1511
• Link to release page from what's new section by @​cory-miller in https://github.com/actions/checkout/pull/1514

New Contributors

• @​joshmgross made their first contribution in https://github.com/actions/checkout/pull/1510
• @​peterbe made their first contribution in https://github.com/actions/checkout/pull/1511

Full Changelog: actions/checkout@v4.1.0...v4.1.1

---

Configuration

📅 Schedule: Branch creation - "* 0-4 * * 3" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[github-actions]

[puLL-Merge] - actions/checkout@v4.1.0..v4.1.1

logError The patch is trivial, no need for a summarization

[github-actions]

[puLL-Merge] - actions/checkout@v4.1.0..v4.1.3

Description

This PR makes several changes to the actions/checkout codebase:

• Adds support for disabling sparse-checkout if the sparse-checkout input is not set
• Introduces a new test-ubuntu-git container image for testing actions/checkout in CI/CD workflows
• Updates minimum required Git version for sparse-checkout from 2.25 to 2.28
• Allows configuring the SSH user when using SSH authentication
• Bumps the version to 4.1.3

The main motivation seems to be improving the behavior and testing of the sparse-checkout functionality.

Changes

Changes

• .github/workflows/test.yml: Adds a new test case for disabling sparse-checkout, updates test container image to test-ubuntu-git
• .github/workflows/update-main-version.yml: Pins actions/checkout version used in the workflow to v4.1.1
• .github/workflows/update-test-ubuntu-git.yml: New workflow to build and optionally publish the test-ubuntu-git container image
• CHANGELOG.md: Adds entries for v4.1.1 and v4.1.2 releases
• CODEOWNERS: Updates code owner team name
• README.md: Minor documentation updates
• __test__/: Updates unit tests
• action.yml: Adds new ssh-user input
• dist/index.js: Compiled JavaScript code, reflects code changes
• images/: Adds Dockerfile and documentation for new test-ubuntu-git container image
• package.json: Bumps version to 4.1.3
• src/: TypeScript source code changes:
  • git-command-manager.ts:
    • Adds disableSparseCheckout() function
    • Updates minimum Git version for sparse-checkout to 2.28
    • Adds version() function to expose Git version
  • git-source-provider.ts: Disables sparse-checkout if not configured
  • git-source-settings.ts, input-helper.ts: Adds sshUser setting
  • url-helper.ts: Uses configured sshUser for SSH authentication

Security Hotspots

1. Using the test-ubuntu-git container image in CI/CD workflows could be a risk if the image is not properly secured and updated. Ensure the image is built from trusted sources and scanned for vulnerabilities.

2. The ssh-user input allows specifying the SSH user. Validate this input to prevent command injection or using an unauthorized user.

3. Changes to the compiled dist/index.js file should be carefully reviewed to ensure they match the TypeScript source and don't introduce any vulnerabilities.

Overall, the changes look reasonable and I didn't see any major security red flags. However, it's always a good idea to thoroughly test updates to critical actions like checkout. The new tests and test-ubuntu-git image should help with that.

[github-actions]

[puLL-Merge] - actions/checkout@v4.1.0..v4.1.4

Here is my review of the pull request:

Description

This PR makes several changes to the actions/checkout repository:

1. Adds a new dependabot.yml configuration file to enable automatic dependency updates via Dependabot.
2. Updates the container image used in the test-proxy job of the test.yml workflow to a custom actions/test-ubuntu-git image.
3. Bumps the pinned version of actions/checkout used in a few places.
4. Implements support for disabling sparse checkout in an existing checkout.
5. Adds a new ssh-user input parameter to specify the SSH user.
6. Updates the changelog and bumps the version to 4.1.4.

The main motivation seems to be enhancing the repository's testing and keeping its dependencies up-to-date. It also adds some new functionality around sparse checkouts and SSH configuration.

Changes

Changes

• .github/dependabot.yml: Added new Dependabot configuration file
• .github/workflows/test.yml: Updated container image for test-proxy job, bumped actions/checkout version in a few steps
• .github/workflows/update-main-version.yml: Bumped pinned actions/checkout version
• .github/workflows/update-test-ubuntu-git.yml: Added new workflow for publishing test-ubuntu-git container
• CHANGELOG.md: Added entries for v4.1.1 to v4.1.4
• README.md: Updated "What's new" section to point to releases page instead of listing changes
• __test__/verify-basic.sh: Added check for sparse checkout being disabled
• action.yml: Added new ssh-user input
• dist/index.js: Regenerated build output
• images/test-ubuntu-git.Dockerfile and images/test-ubuntu-git.md: Added new container image definition and docs
• package.json: Bumped version to 4.1.4
• src/git-command-manager.ts, src/git-source-provider.ts, src/git-source-settings.ts, src/input-helper.ts, src/url-helper.ts: Added support for disabling sparse checkout and specifying SSH user

Security Hotspots

1. The custom actions/test-ubuntu-git container image should be carefully reviewed to ensure it only contains expected/necessary software and its build process is secure. Using custom containers expands the attack surface.
2. The ssh-user input should be validated to prevent command injection if a shell command ends up being constructed with it. The current usage looks safe though.
3. Dependabot configuration should be reviewed to ensure the defined update schedules and target branches are appropriate. Automated dependency updates are great for staying up-to-date but can also introduce unintended changes.

Overall the changes look straightforward and beneficial, just need to double check the new container image and SSH input handling. The thorough testing gives confidence in the correctness of the sparse checkout behavior changes. Nice work!