Skip to content

Persist creds to a separate file #2286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Persist creds to a separate file #2286

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -302,12 +302,15 @@ jobs:
# Clone this repo
Copy link
Contributor Author

@ericsciple ericsciple Oct 20, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In addition to the PR checks and unit tests, here is the workflow I used for testing 
on:
  workflow_dispatch:
  push:
    paths:
      - .github/workflows/test-checkout.yml
jobs:
  basic:
    if: false
    strategy:
      matrix:
        runs-on:
          - ubuntu-latest
          - macos-latest
          - windows-latest
    runs-on: ${{ matrix.runs-on }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: &checkout actions/checkout@users/ericsciple/25-10-cred
      - run: |
          cat .git/config
      - run: |
          git config list
      - run: |
          set -eo pipefail
          git ls-remote origin | head
 cleanup:
    runs-on: self-hosted
    # container: bitnami/git:latest
    steps:
      - uses: *checkout
        with:
          ref: submodule-test
          submodules: recursive
      - name: Find all files
        run: |
          find . -name .git -prune -o -print
      - name: Verify submodule files exist
        run: |
          test -f ./submodule-test.txt
          test -f ./submodule-test-nested/submodule-test-nested.txt
          test -f ./submodule-test-nested/submodule-test-nested-nested/submodule-test-nested-nested.txt
          echo "All submodule files verified successfully"
      - name: Root - cat .git/config
        run: |
          cat .git/config
      - name: Root - git config list
        run: |
          git config list
      - name: submodule-test-nested - cat .git/config
        run: |
          cat .git/modules/submodule-test-nested/config
      - name: submodule-test-nested - git config list
        run: |
          cd submodule-test-nested
          git config list
      - name: submodule-test-nested-nested - cat .git/config
        run: |
          cat .git/modules/submodule-test-nested/modules/submodule-test-nested-nested/config
      - name: submodule-test-nested-nested - git config list
        run: |
          cd submodule-test-nested/submodule-test-nested-nested
          git config list
      - name: Root - git ls-remote origin
        run: |
          git fetch
      - name: submodule-test-nested - git ls-remote origin
        run: |
          cd submodule-test-nested
          git config --global --add safe.directory /workspaces/runner/_layout/_work/ericsciple-test/ericsciple-test/submodule-test-nested
          git fetch
      - name: submodule-test-nested-nested - git ls-remote origin
        run: |
          cd submodule-test-nested/submodule-test-nested-nested
          git config --global --add safe.directory /workspaces/runner/_layout/_work/ericsciple-test/ericsciple-test/submodule-test-nested/submodule-test-nested-nested
          git fetch
  container:
    if: false
    runs-on: ubuntu-latest
    container: bitnami/git:latest
    steps:
      - uses: *checkout
      - run: |
          cat .git/config
      - run: |
          git config list
      - run: |
          git config --global --add safe.directory /__w/ericsciple-test/ericsciple-test
      - run: |
          git fetch
  container-step:
    if: false
    runs-on: ubuntu-latest
    steps:
      - uses: *checkout
      - name: Print working directory
        uses: ./my-container-action
        with:
          command: pwd
      - name: Printenv
        uses: ./my-container-action
        with:
          command: printenv
      - name: List files
        uses: ./my-container-action
        with:
          command: ls -la
      - name: Cat .git/config
        uses: ./my-container-action
        with:
          command: cat .git/config
      - name: Git config list
        uses: ./my-container-action
        with:
          command: git config --list
      - name: List files in /github
        uses: ./my-container-action
        with:
          command: ls -la /github
      - name: List files in /github/runner_temp
        uses: ./my-container-action
        with:
          command: ls -la /github/runner_temp
      - name: List files in RUNNER_TEMP
        uses: ./my-container-action
        with:
          command: ls -la $RUNNER_TEMP
      - name: Git fetch
        uses: ./my-container-action
        with:
          command: git config --global --add safe.directory /github/workspace && git fetch
  not-persisted:
    if: false
    strategy:
      matrix:
        runs-on:
          - ubuntu-latest
          - macos-latest
          - windows-latest
    runs-on: ${{ matrix.runs-on }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: *checkout
        with:
          persist-credentials: false
      - run: |
          cat .git/config
      - run: |
          git config list
      - run: |
          set +e
          set -o pipefail
          git ls-remote origin | head
          if [ $? -eq 0 ]; then
            echo 'Expected command to fail'
            exit 1
          fi

          echo 'Command correctly failed'
          exit 0
  submodules-true:
    if: false
    strategy:
      matrix:
        runs-on:
          - ubuntu-latest
          - macos-latest
          - windows-latest
    runs-on: ${{ matrix.runs-on }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: *checkout
        with:
          ref: submodule-test
          submodules: true
      - name: Find all files
        run: |
          find . -name .git -prune -o -print
      - name: Verify submodule files exist
        run: |
          test -f ./submodule-test.txt
          test -f ./submodule-test-nested/submodule-test-nested.txt
          echo "All submodule files verified successfully"
      - name: Verify nested-nested file does not exist
        run: |
          if [ -f ./submodule-test-nested/submodule-test-nested-nested/submodule-test-nested-nested.txt ]; then
            echo "Error: nested-nested file should not exist with submodules: true"
            exit 1
          fi
          echo "Verified nested-nested file does not exist"
      - name: Root - cat .git/config
        run: |
          cat .git/config
      - name: Root - git config list
        run: |
          git config list
      - name: submodule-test-nested - cat .git/config
        run: |
          cat .git/modules/submodule-test-nested/config
      - name: submodule-test-nested - git config list
        run: |
          cd submodule-test-nested
          git config list
      - name: Root - git ls-remote origin
        run: |
          set -eo pipefail
          git ls-remote origin | head
      - name: submodule-test-nested - git ls-remote origin
        run: |
          set -eo pipefail
          cd submodule-test-nested
          git ls-remote origin | head
  submodules-recursive:
    if: false
    strategy:
      matrix:
        runs-on:
          - ubuntu-latest
          - macos-latest
          - windows-latest
    runs-on: ${{ matrix.runs-on }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: *checkout
        with:
          ref: submodule-test
          submodules: recursive
      - name: Find all files
        run: |
          find . -name .git -prune -o -print
      - name: Verify submodule files exist
        run: |
          test -f ./submodule-test.txt
          test -f ./submodule-test-nested/submodule-test-nested.txt
          test -f ./submodule-test-nested/submodule-test-nested-nested/submodule-test-nested-nested.txt
          echo "All submodule files verified successfully"
      - name: Root - cat .git/config
        run: |
          cat .git/config
      - name: Root - git config list
        run: |
          git config list
      - name: submodule-test-nested - cat .git/config
        run: |
          cat .git/modules/submodule-test-nested/config
      - name: submodule-test-nested - git config list
        run: |
          cd submodule-test-nested
          git config list
      - name: submodule-test-nested-nested - cat .git/config
        run: |
          cat .git/modules/submodule-test-nested/modules/submodule-test-nested-nested/config
      - name: submodule-test-nested-nested - git config list
        run: |
          cd submodule-test-nested/submodule-test-nested-nested
          git config list
      - name: Root - git ls-remote origin
        run: |
          set -eo pipefail
          git ls-remote origin | head
      - name: submodule-test-nested - git ls-remote origin
        run: |
          set -eo pipefail
          cd submodule-test-nested
          git ls-remote origin | head
      - name: submodule-test-nested-nested - git ls-remote origin
        run: |
          set -eo pipefail
          cd submodule-test-nested/submodule-test-nested-nested
          git ls-remote origin | head
  not-persisted-submodules-recursive:
    if: false
    strategy:
      matrix:
        runs-on:
          - ubuntu-latest
          - macos-latest
          - windows-latest
    runs-on: ${{ matrix.runs-on }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: *checkout
        with:
          ref: submodule-test
          submodules: recursive
          persist-credentials: false
      - name: Find all files
        run: |
          find . -name .git -prune -o -print
      - name: Verify submodule files exist
        run: |
          test -f ./submodule-test.txt
          test -f ./submodule-test-nested/submodule-test-nested.txt
          test -f ./submodule-test-nested/submodule-test-nested-nested/submodule-test-nested-nested.txt
          echo "All submodule files verified successfully"
      - name: Root - cat .git/config
        run: |
          cat .git/config
      - name: Root - git config list
        run: |
          git config list
      - name: submodule-test-nested - cat .git/config
        run: |
          cat .git/modules/submodule-test-nested/config
      - name: submodule-test-nested - git config list
        run: |
          cd submodule-test-nested
          git config list
      - name: submodule-test-nested-nested - cat .git/config
        run: |
          cat .git/modules/submodule-test-nested/modules/submodule-test-nested-nested/config
      - name: submodule-test-nested-nested - git config list
        run: |
          cd submodule-test-nested/submodule-test-nested-nested
          git config list
      - name: Root - git ls-remote origin
        run: |
          set +e
          set -o pipefail
          git ls-remote origin | head
          if [ $? -eq 0 ]; then
            echo 'Expected command to fail'
            exit 1
          fi
          echo 'Command correctly failed'
      - name: submodule-test-nested - git ls-remote origin
        run: |
          set +e
          set -o pipefail
          cd submodule-test-nested
          git ls-remote origin | head
          if [ $? -eq 0 ]; then
            echo 'Expected command to fail'
            exit 1
          fi
          echo 'Command correctly failed'
      - name: submodule-test-nested-nested - git ls-remote origin
        run: |
          set +e
          set -o pipefail
          cd submodule-test-nested/submodule-test-nested-nested
          git ls-remote origin | head
          if [ $? -eq 0 ]; then
            echo 'Expected command to fail'
            exit 1
          fi
          echo 'Command correctly failed'
  container-submodules-recursive:
    if: false
    runs-on: ubuntu-latest
    container: bitnami/git:latest
    steps:
      - uses: *checkout
        with:
          ref: submodule-test
          submodules: recursive
      - name: Find all files
        run: |
          find . -name .git -prune -o -print
      - name: Verify submodule files exist
        run: |
          test -f ./submodule-test.txt
          test -f ./submodule-test-nested/submodule-test-nested.txt
          test -f ./submodule-test-nested/submodule-test-nested-nested/submodule-test-nested-nested.txt
          echo "All submodule files verified successfully"
      - name: Root - cat .git/config
        run: |
          cat .git/config
      - name: Root - git config list
        run: |
          git config list
      - name: submodule-test-nested - cat .git/config
        run: |
          cat .git/modules/submodule-test-nested/config
      - name: submodule-test-nested - git config list
        run: |
          cd submodule-test-nested
          git config list
      - name: submodule-test-nested-nested - cat .git/config
        run: |
          cat .git/modules/submodule-test-nested/modules/submodule-test-nested-nested/config
      - name: submodule-test-nested-nested - git config list
        run: |
          cd submodule-test-nested/submodule-test-nested-nested
          git config list
      - name: Add safe directories
        run: |
          git config --global --add safe.directory /__w/ericsciple-test/ericsciple-test
          git config --global --add safe.directory /__w/ericsciple-test/ericsciple-test/submodule-test-nested
          git config --global --add safe.directory /__w/ericsciple-test/ericsciple-test/submodule-test-nested/submodule-test-nested-nested
      - name: Root - git fetch
        run: |
          git fetch
      - name: submodule-test-nested - git fetch
        run: |
          cd submodule-test-nested
          git fetch
      - name: submodule-test-nested-nested - git fetch
        run: |
          cd submodule-test-nested/submodule-test-nested-nested
          git fetch
  container-step-submodules-recursive:
    if: false
    runs-on: ubuntu-latest
    steps:
      - uses: *checkout
        with:
          path: actions-checkout
      - uses: *checkout
        with:
          ref: submodule-test
          submodules: recursive
          path: test
      - name: Find all files
        uses: ./actions-checkout/my-container-action
        with:
          command: find test -name .git -prune -o -print
      - name: Verify submodule files exist
        run: |
          test -f test/submodule-test.txt
          test -f test/submodule-test-nested/submodule-test-nested.txt
          test -f test/submodule-test-nested/submodule-test-nested-nested/submodule-test-nested-nested.txt
          echo "All submodule files verified successfully"
      - name: Root - cat .git/config
        uses: ./actions-checkout/my-container-action
        with:
          command: cat test/.git/config
      - name: Root - git config list
        uses: ./actions-checkout/my-container-action
        with:
          command: cd test && git config --list
      - name: submodule-test-nested - cat .git/config
        uses: ./actions-checkout/my-container-action
        with:
          command: cat test/.git/modules/submodule-test-nested/config
      - name: submodule-test-nested - git config list
        uses: ./actions-checkout/my-container-action
        with:
          command: cd test/submodule-test-nested && git config --list
      - name: submodule-test-nested-nested - cat .git/config
        uses: ./actions-checkout/my-container-action
        with:
          command: cat test/.git/modules/submodule-test-nested/modules/submodule-test-nested-nested/config
      - name: submodule-test-nested-nested - git config list
        uses: ./actions-checkout/my-container-action
        with:
          command: cd test/submodule-test-nested/submodule-test-nested-nested && git config --list
      - name: Root - git fetch
        uses: ./actions-checkout/my-container-action
        with:
          command: cd test && git config --global --add safe.directory /github/workspace/test && git fetch
      - name: submodule-test-nested - git fetch
        uses: ./actions-checkout/my-container-action
        with:
          command: cd test/submodule-test-nested && git config --global --add safe.directory /github/workspace/test/submodule-test-nested && git fetch
      - name: submodule-test-nested-nested - git fetch
        uses: ./actions-checkout/my-container-action
        with:
          command: cd test/submodule-test-nested/submodule-test-nested-nested && git config --global --add safe.directory /github/workspace/test/submodule-test-nested/submodule-test-nested-nested && git fetch

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A couple more jobs testing ssh 
  ssh:
    if: false
    strategy:
      matrix:
        runs-on:
          - ubuntu-latest
          - macos-latest
          - windows-latest
    runs-on: ${{ matrix.runs-on }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@users/ericsciple/25-10-cred
        with:
          ssh-key: ${{ secrets.DEPLOY_KEY_OTHER_REPO }}
          repository: my-org/other-repo
      - run: |
          cat README.md
      - run: |
          git ls-remote origin | head
  ssh-not-persisted:
    strategy:
      matrix:
        runs-on:
          - ubuntu-latest
          - macos-latest
          - windows-latest
    runs-on: ${{ matrix.runs-on }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@users/ericsciple/25-10-cred
        with:
          ssh-key: ${{ secrets.DEPLOY_KEY_OTHER_REPO }}
          repository: my-org/other-repo
          persist-credentials: false
      - run: |
          cat README.md
      - run: |
          set +e
          git fetch
          if [ $? -eq 0 ]; then
            echo 'Expected command to fail'
            exit 1
          fi
          echo 'Command correctly failed'
          exit 0

- name: Checkout
uses: actions/checkout@v4.1.6
with:
path: actions-checkout

# Basic checkout using git
- name: Checkout basic
id: checkout
uses: ./
uses: ./actions-checkout
with:
path: cloned-using-local-action
ref: test-data/v2/basic

# Verify output
Expand All @@ -325,7 +328,3 @@ jobs:
echo "Expected commit to be 82f71901cf8c021332310dcc8cdba84c4193ff5d"
exit 1
fi
# needed to make checkout post cleanup succeed
- name: Fix Checkout
uses: actions/checkout@v4.1.6
Loading
Loading