chore(deps): update actions/checkout action to v4.1.4

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v4.1.1 -> v4.1.4

---

Release Notes

actions/checkout (actions/checkout)

v4.1.4

Compare Source

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1692
• Add dependabot config by @​cory-miller in https://github.com/actions/checkout/pull/1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in https://github.com/actions/checkout/pull/1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in https://github.com/actions/checkout/pull/1643

v4.1.3

Compare Source

What's Changed

• Update actions/checkout version in update-main-version.yml by @​jww3 in https://github.com/actions/checkout/pull/1650
• Check git version before attempting to disable sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1656
• Add SSH user parameter by @​cory-miller in https://github.com/actions/checkout/pull/1685

Full Changelog: actions/checkout@v4.1.2...v4.1.3

v4.1.2

Compare Source

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in https://github.com/actions/checkout/pull/1598

---

Configuration

📅 Schedule: Branch creation - "* 0-4 * * 3" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[github-actions]

[puLL-Merge] - actions/checkout@v4.1.1..v4.1.3

Here is my review of the PR:

Description

This PR makes several changes and additions to the actions/checkout repository:

• Bumps the version to 4.1.3
• Adds support for disabling sparse checkout when the sparse-checkout input is not provided
• Introduces a new ssh-user input to specify the SSH user to use when fetching via SSH
• Adds a new test-ubuntu-git Docker image for testing actions/checkout in CI/CD
• Updates the minimum required Git version for sparse checkout to 2.28

The motivation seems to be to fix some bugs, add some new functionality, and improve the testing setup.

Changes

Changes

• .github/workflows/test.yml - Adds a new test for disabling sparse checkout, uses new test-ubuntu-git image for testing
• .github/workflows/update-main-version.yml - Pins actions/checkout to a stable version for the version update workflow
• .github/workflows/update-test-ubuntu-git.yml - New workflow to build and publish the test-ubuntu-git image
• CHANGELOG.md - Documents changes in 4.1.1 and 4.1.2
• README.md - Documents new ssh-user input
• __test__/* - Updates tests for sparse checkout version check and new mocks
• action.yml - Adds ssh-user input
• dist/index.js - Compiled JavaScript, not worth reviewing
• images/test-ubuntu-git.Dockerfile - New Dockerfile for test-ubuntu-git image
• images/test-ubuntu-git.md - Documentation for new test-ubuntu-git image
• package.json - Bumps version to 4.1.3
• src/git-command-manager.ts - Implements disableSparseCheckout, updates minimum version for sparse checkout
• src/git-source-provider.ts - Disables sparse checkout if not enabled
• src/git-source-settings.ts - Adds sshUser to settings interface
• src/input-helper.ts - Reads ssh-user input
• src/url-helper.ts - Uses ssh-user when building SSH URL

Security Hotspots

1. The new ssh-user input in action.yml could potentially allow specifying an arbitrary user for the SSH connection. This input should be validated to ensure only authorized users can be specified. Risk level - Medium
2. The test-ubuntu-git image build and publish process in .github/workflows/update-test-ubuntu-git.yml should ensure the base Ubuntu image is kept up-to-date and scanned for vulnerabilities before publishing. Risk level - Low

Overall this looks like a solid PR that fixes some issues and adds useful functionality. Just need to keep an eye on the security aspects of the SSH user input and test image publishing. Nice work!

[github-actions]

[puLL-Merge] - actions/checkout@v4.1.1..v4.1.4

Description

This PR makes several changes to the actions/checkout GitHub Action:

• Adds a dependabot configuration file to automate dependency updates
• Updates the actions/checkout version used in CI workflows
• Fixes an issue with disabling sparse checkouts
• Adds support for configuring the SSH user
• Updates documentation and CHANGELOG
• Adds a new container image for testing

Changes

Changes

• .github/dependabot.yml: Added new file to configure Dependabot for automated dependency updates
• .github/workflows/test.yml:
  • Updated actions/checkout version from v3 to v4.1.1
  • Added test for verifying sparse checkout is disabled correctly
  • Updated test container image to ghcr.io/actions/test-ubuntu-git:main
• .github/workflows/update-main-version.yml: Updated actions/checkout version to v4.1.1
• .github/workflows/update-test-ubuntu-git.yml: Added new workflow to publish test-ubuntu-git container image
• CHANGELOG.md: Added details for v4.1.1 to v4.1.4 releases
• README.md: Added documentation for new ssh-user input parameter
• action.yml: Added new ssh-user input
• src/git-command-manager.ts:
  • Added MinimumGitSparseCheckoutVersion constant
  • Added disableSparseCheckout() function
  • Store git version in gitVersion property
• src/git-source-provider.ts: Disable sparse checkout if not enabled
• src/git-source-settings.ts: Added sshUser property
• src/input-helper.ts: Read ssh-user input
• src/url-helper.ts: Use configured SSH user for fetch URL
• images/: Added Dockerfile and README for new test-ubuntu-git container image

Security Hotspots

1. ssh-user input allows specifying arbitrary SSH usernames which could enable impersonation if misused. However, this would require the attacker to already have credentials to the repo. Low risk.
2. test-ubuntu-git container runs as root by default which is not ideal from a security perspective. Consider using a non-root user. Low risk for a test/CI image.
3. Dependabot configuration automates dependency updates which could introduce vulnerabilities if the updates are not reviewed carefully. However, it is configured to only do patch/minor updates. Low risk.

In summary, the changes look reasonable from a security perspective. The main suggestions would be to review Dependabot PRs carefully and consider running the test container as a non-root user if practical. Nice work on the detailed tests, documentation and changelog!