* fix: reject glued quotes that string-argv would split into extra git flags
A balanced form like 'main'--force is still two argv tokens under string-argv, so refuse it before git push can see a standalone --force.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: describe glued-quote rejection as an argument-boundary check
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
core.info writes raw stdout, so inputs like message could inject
::stop-commands:: via a newline. Route info through safeInfo().
Co-authored-by: Cursor <cursoragent@cursor.com>
Git interpolates unmatched pathspecs into fatal errors, so these options can copy an arbitrary runner file into the action log.
Co-authored-by: Cursor <cursoragent@cursor.com>
YAML true was passed through as git pull arguments, so pull: true ran `git pull true` instead of a default pull.
Co-authored-by: Cursor <cursoragent@cursor.com>
matchGitArgs treated -u as always consuming the next token, so fetch/push
args like -u --upl=CMD bypassed the denylist. Validate remote-helper
options on every token and stop treating -u as a value option.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Allow concurrent workflows to recover from push races by re-pulling between attempts when pull is configured.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: neutralize bidi and control chars in action logs
Prevent Trojan Source-style filename spoofing when git status paths are printed via log(), and sanitize conflicted paths in pull errors.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: guard neutralizeForLog against circular references
Track visited arrays/objects with a WeakSet so log() returns a marker instead of overflowing on cyclic values.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: do not report committed=true for empty commit SHA
simple-git can resolve successfully with an empty commit hash when no
commit was actually created; keep the committed output accurate.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: stop tagging/pushing after empty commit SHA
Let empty-SHA failures reject so the outer catch stops the action instead of continuing after setFailed.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid dumping listConfig().all via core.debug so checkout extraheader tokens are never written to action logs.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: verify committed lib/ matches source in CI
Add a post-build diff check so the shipped action bundle cannot drift from src without failing CI, even when local hooks are bypassed.
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: rebuild lib/ against lockfile for CI integrity check
Co-authored-by: Cursor <cursoragent@cursor.com>
* ci: tighten lib integrity check and workflow permissions
Detect untracked lib/ artifacts, drop checkout credentials, and document Node 24 for local builds.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: prevent git option injection via new_branch
Validate new_branch as a branch name and pass it after -- so values like --force cannot force-checkout or force-push.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: tighten new_branch validation and simplify checkout
Reject Unicode whitespace/C1 controls in branch names, and drop the checkout -- separator after early validation.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: validate new_branch with git check-ref-format
Reject invalid ref forms via check-ref-format --branch, align docs, and clarify the remote-helper warning wording.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore(deps): bump @actions/core from 2.0.2 to 3.0.0
Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 2.0.2 to 3.0.0.
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core)
---
updated-dependencies:
- dependency-name: "@actions/core"
dependency-version: 3.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps): update build process for ESM-only @actions/core v3 (#717)
* Initial plan
* feat: update build process for ESM-only @actions/core v3
- Add "type": "module" to package.json for ESM support
- Update TypeScript config to output ES2022 modules with esModuleInterop
- Convert Jest config to ESM (.mjs) with proper ts-jest ESM preset
- Rename .prettierrc.js to .prettierrc.cjs for CommonJS compatibility
- Replace actions-toolkit with @actions/github for ESM compatibility
- Configure Jest to handle ESM modules from @actions packages
- Update test script to use NODE_OPTIONS for experimental VM modules
- Build now outputs ESM format successfully
Co-authored-by: EndBug <26386270+EndBug@users.noreply.github.com>
* fix: use getInput for github_token instead of process.env
Properly access github_token input using the getInput helper function
from io.ts instead of directly accessing process.env.
Co-authored-by: EndBug <26386270+EndBug@users.noreply.github.com>
* refactor: remove unnecessary moduleNameMappers from Jest config
The explicit moduleNameMappers for @actions/core and @actions/github were
not needed. The transformIgnorePatterns configuration is sufficient to
handle ESM modules from @actions packages. Only the relative import
mapper is required for TypeScript ESM compatibility.
Co-authored-by: EndBug <26386270+EndBug@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: EndBug <26386270+EndBug@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: EndBug <26386270+EndBug@users.noreply.github.com>
* cleanup: Removes JSON array parsing.
JSON is a subset of YAML, making it redundant.
* ci: add tests for parseInputArray.
Makes tools into a function to be able to mock it.
It does not need to be exported.
* Update runner version
---------
Co-authored-by: Federico Grandi <fgrandi30@gmail.com>
* fix: re-stage files after pulling
This should fix an issue that prevented changes from being committed
when `git pull --rebase --autostash` used.
Issue #406
* chore: mark pre-commit hook as executable
* fix: detect conflicts after pull
* add check to allow empty commits if arg is set
* fix: target only the desired argument
* fix: add debug message
* fix: fix debug message
Co-authored-by: Federico Grandi <fgrandi30@gmail.com>
Jonah LawrenceandGitHub
Federico GrandiandGitHub
