-
Notifications
You must be signed in to change notification settings - Fork 2.4k
Fix tag handling: preserve annotations and explicit fetch-tags #2356
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
f12cf15 to
a70240b
Compare
a70240b to
849c4d7
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This pull request fixes multiple tag handling issues in the checkout action by changing how tags are fetched and verified.
- Tags are now fetched by reference (not commit hash) to preserve annotations
- The
fetch-tagsoption now properly controls tag fetching via explicit refspecs - Added validation to detect when tags have been moved after workflow trigger (for shallow fetches)
Reviewed changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/ref-helper.ts | Modified getRefSpec to accept fetchTags parameter and fetch tags by ref instead of commit; updated testRef to use ^{commit} for annotated tag dereferencing |
| src/git-source-provider.ts | Removed fetchTags from fetch options (now in refspec); added tag movement validation for shallow fetches |
| src/git-command-manager.ts | Removed fetchTags option from fetch method; always use --no-tags with explicit tag control via refspecs |
| test/ref-helper.test.ts | Added comprehensive tests for new fetchTags parameter behavior |
| test/git-command-manager.test.ts | Updated tests to reflect new fetch behavior with --no-tags always present |
| test/verify-fetch-tags.sh | New script to verify tags are properly fetched in E2E tests |
| .github/workflows/test.yml | Added E2E test for fetch-tags: true functionality |
| dist/index.js | Compiled changes matching source modifications |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This PR fixes several issues with tag handling in the checkout action: 1. fetch-tags: true now works (fixes #1471) - Tags refspec is now included in getRefSpec() when fetchTags=true - Previously tags were only fetched during a separate fetch that was overwritten by the main fetch 2. Tag checkout preserves annotations (fixes #290) - Tags are fetched via refspec (+refs/tags/*:refs/tags/*) instead of --tags flag - This fetches the actual tag objects, preserving annotations 3. Tag checkout with fetch-tags: true no longer fails (fixes #1467) - When checking out a tag with fetchTags=true, only the wildcard refspec is used (specific tag refspec is redundant) Changes: - src/ref-helper.ts: getRefSpec() now accepts fetchTags parameter and prepends tags refspec when true - src/git-command-manager.ts: fetch() simplified to always use --no-tags, tags are fetched explicitly via refspec - src/git-source-provider.ts: passes fetchTags to getRefSpec() - Added E2E test for fetch-tags option Related #1471, #1467, #290
849c4d7 to
dc12339
Compare
|
@ericsciple This is fixed in v6.0.2 but that is marked as a pre-release. Was that a mistake and, if not, why not mark it as -beta? This is causing action updates tools to skip/flag it, so I wanted to make sure you were aware of that release marker. |
|
@ben-manes thanks! I just now removed the pre-release flag (I had originally planned to remove it sooner). I will watch for issues, then bump the |
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | patch | `v6.0.1` → `v6.0.2` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@​ericsciple](https://github.com/ericsciple) in [#​2356](actions/checkout#2356) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi44OS4yIiwidXBkYXRlZEluVmVyIjoiNDIuODkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9kZXBlbmRlbmNpZXMiXX0=--> Reviewed-on: https://git.tainton.uk/luke/instant-msg-api/pulls/238 Reviewed-by: Luke Tainton <[email protected]> Co-authored-by: renovate[bot] <[email protected]> Co-committed-by: renovate[bot] <[email protected]>
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | patch | `v6.0.1` → `v6.0.2` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](actions/checkout@v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@​ericsciple](https://github.com/ericsciple) in [#​2356](actions/checkout#2356) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi44OS4yIiwidXBkYXRlZEluVmVyIjoiNDIuODkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9kZXBlbmRlbmNpZXMiXX0=--> Reviewed-on: https://git.tainton.uk/actions/gha-workflows/pulls/58 Co-authored-by: renovate[bot] <[email protected]> Co-committed-by: renovate[bot] <[email protected]>
| datasource | package | from | to | | ----------- | ---------------- | ------ | ------ | | github-tags | actions/checkout | v4.1.7 | v6.0.2 | ## [vv6.0.2](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356) ## [vv6.0.1](actions/checkout@v6.0.0...v6.0.1) ## [vv6.0.0](actions/checkout@v5.0.1...v6.0.0) ## [vv5.0.1](https://github.com/actions/checkout/releases/tag/v5.0.1) ##### What's Changed - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](actions/checkout#2301) **Full Changelog**: <actions/checkout@v5...v5.0.1> ## [vv5.0.0](https://github.com/actions/checkout/releases/tag/v5.0.0) ##### What's Changed - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](actions/checkout#2226) - Prepare v5.0.0 release by [@salmanmkc](https://github.com/salmanmkc) in [#2238](actions/checkout#2238) #####⚠️ Minimum Compatible Runner Version **v2.327.1**\ [Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1) Make sure your runner is updated to this version or newer to use this release. **Full Changelog**: <actions/checkout@v4...v5.0.0> ## [vv4.3.1](https://github.com/actions/checkout/releases/tag/v4.3.1) ##### What's Changed - Port v6 cleanup to v4 by [@ericsciple](https://github.com/ericsciple) in [#2305](actions/checkout#2305) **Full Changelog**: <actions/checkout@v4...v4.3.1> ## [vv4.3.0](https://github.com/actions/checkout/releases/tag/v4.3.0) ##### What's Changed - docs: update README.md by [@motss](https://github.com/motss) in [#1971](actions/checkout#1971) - Add internal repos for checking out multiple repositories by [@mouismail](https://github.com/mouismail) in [#1977](actions/checkout#1977) - Documentation update - add recommended permissions to Readme by [@benwells](https://github.com/benwells) in [#2043](actions/checkout#2043) - Adjust positioning of user email note and permissions heading by [@joshmgross](https://github.com/joshmgross) in [#2044](actions/checkout#2044) - Update README.md by [@nebuk89](https://github.com/nebuk89) in [#2194](actions/checkout#2194) - Update CODEOWNERS for actions by [@TingluoHuang](https://github.com/TingluoHuang) in [#2224](actions/checkout#2224) - Update package dependencies by [@salmanmkc](https://github.com/salmanmkc) in [#2236](actions/checkout#2236) - Prepare release v4.3.0 by [@salmanmkc](https://github.com/salmanmkc) in [#2237](actions/checkout#2237) ##### New Contributors - [@motss](https://github.com/motss) made their first contribution in [#1971](actions/checkout#1971) - [@mouismail](https://github.com/mouismail) made their first contribution in [#1977](actions/checkout#1977) - [@benwells](https://github.com/benwells) made their first contribution in [#2043](actions/checkout#2043) - [@nebuk89](https://github.com/nebuk89) made their first contribution in [#2194](actions/checkout#2194) - [@salmanmkc](https://github.com/salmanmkc) made their first contribution in [#2236](actions/checkout#2236) **Full Changelog**: <actions/checkout@v4...v4.3.0> ## [vv4.2.2](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v422) - `url-helper.ts` now leverages well-known environment variables by [@jww3](https://github.com/jww3) in [#1941](actions/checkout#1941) - Expand unit test coverage for `isGhes` by [@jww3](https://github.com/jww3) in [#1946](actions/checkout#1946) ## [vv4.2.1](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v421) - Check out other refs/\* by commit if provided, fall back to ref by [@orhantoy](https://github.com/orhantoy) in [#1924](actions/checkout#1924) ## [vv4.2.0](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v420) - Add Ref and Commit outputs by [@lucacome](https://github.com/lucacome) in [#1180](actions/checkout#1180) - Dependency updates by [@dependabot-](https://github.com/dependabot-) [#1777](actions/checkout#1777), [#1872](actions/checkout#1872)
##### [\`v6.0.2\`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](actions/checkout#2356)
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.1 to 6.0.2. Release notes *Sourced from [actions/checkout's releases](https://github.com/actions/checkout/releases).* > v6.0.2 > ------ > > What's Changed > -------------- > > * Add orchestration\_id to git user-agent when ACTIONS\_ORCHESTRATION\_ID is set by [`@TingluoHuang`](https://github.com/TingluoHuang) in [actions/checkout#2355](https://redirect.github.com/actions/checkout/pull/2355) > * Fix tag handling: preserve annotations and explicit fetch-tags by [`@ericsciple`](https://github.com/ericsciple) in [actions/checkout#2356](https://redirect.github.com/actions/checkout/pull/2356) > > **Full Changelog**: <actions/checkout@v6.0.1...v6.0.2> Changelog *Sourced from [actions/checkout's changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md).* > Changelog > ========= > > v6.0.2 > ------ > > * Fix tag handling: preserve annotations and explicit fetch-tags by [`@ericsciple`](https://github.com/ericsciple) in [actions/checkout#2356](https://redirect.github.com/actions/checkout/pull/2356) > > v6.0.1 > ------ > > * Add worktree support for persist-credentials includeIf by [`@ericsciple`](https://github.com/ericsciple) in [actions/checkout#2327](https://redirect.github.com/actions/checkout/pull/2327) > > v6.0.0 > ------ > > * Persist creds to a separate file by [`@ericsciple`](https://github.com/ericsciple) in [actions/checkout#2286](https://redirect.github.com/actions/checkout/pull/2286) > * Update README to include Node.js 24 support details and requirements by [`@salmanmkc`](https://github.com/salmanmkc) in [actions/checkout#2248](https://redirect.github.com/actions/checkout/pull/2248) > > v5.0.1 > ------ > > * Port v6 cleanup to v5 by [`@ericsciple`](https://github.com/ericsciple) in [actions/checkout#2301](https://redirect.github.com/actions/checkout/pull/2301) > > v5.0.0 > ------ > > * Update actions checkout to use node 24 by [`@salmanmkc`](https://github.com/salmanmkc) in [actions/checkout#2226](https://redirect.github.com/actions/checkout/pull/2226) > > v4.3.1 > ------ > > * Port v6 cleanup to v4 by [`@ericsciple`](https://github.com/ericsciple) in [actions/checkout#2305](https://redirect.github.com/actions/checkout/pull/2305) > > v4.3.0 > ------ > > * docs: update README.md by [`@motss`](https://github.com/motss) in [actions/checkout#1971](https://redirect.github.com/actions/checkout/pull/1971) > * Add internal repos for checking out multiple repositories by [`@mouismail`](https://github.com/mouismail) in [actions/checkout#1977](https://redirect.github.com/actions/checkout/pull/1977) > * Documentation update - add recommended permissions to Readme by [`@benwells`](https://github.com/benwells) in [actions/checkout#2043](https://redirect.github.com/actions/checkout/pull/2043) > * Adjust positioning of user email note and permissions heading by [`@joshmgross`](https://github.com/joshmgross) in [actions/checkout#2044](https://redirect.github.com/actions/checkout/pull/2044) > * Update README.md by [`@nebuk89`](https://github.com/nebuk89) in [actions/checkout#2194](https://redirect.github.com/actions/checkout/pull/2194) > * Update CODEOWNERS for actions by [`@TingluoHuang`](https://github.com/TingluoHuang) in [actions/checkout#2224](https://redirect.github.com/actions/checkout/pull/2224) > * Update package dependencies by [`@salmanmkc`](https://github.com/salmanmkc) in [actions/checkout#2236](https://redirect.github.com/actions/checkout/pull/2236) > > v4.2.2 > ------ > > * `url-helper.ts` now leverages well-known environment variables by [`@jww3`](https://github.com/jww3) in [actions/checkout#1941](https://redirect.github.com/actions/checkout/pull/1941) > * Expand unit test coverage for `isGhes` by [`@jww3`](https://github.com/jww3) in [actions/checkout#1946](https://redirect.github.com/actions/checkout/pull/1946) > > v4.2.1 > ------ > > * Check out other refs/\* by commit if provided, fall back to ref by [`@orhantoy`](https://github.com/orhantoy) in [actions/checkout#1924](https://redirect.github.com/actions/checkout/pull/1924) > > v4.2.0 > ------ > > * Add Ref and Commit outputs by [`@lucacome`](https://github.com/lucacome) in [actions/checkout#1180](https://redirect.github.com/actions/checkout/pull/1180) > * Dependency updates by [`@dependabot`](https://github.com/dependabot)- [actions/checkout#1777](https://redirect.github.com/actions/checkout/pull/1777), [actions/checkout#1872](https://redirect.github.com/actions/checkout/pull/1872) > > v4.1.7 > ------ > > * Bump the minor-npm-dependencies group across 1 directory with 4 updates by [`@dependabot`](https://github.com/dependabot) in [actions/checkout#1739](https://redirect.github.com/actions/checkout/pull/1739) > * Bump actions/checkout from 3 to 4 by [`@dependabot`](https://github.com/dependabot) in [actions/checkout#1697](https://redirect.github.com/actions/checkout/pull/1697) > * Check out other refs/\* by commit by [`@orhantoy`](https://github.com/orhantoy) in [actions/checkout#1774](https://redirect.github.com/actions/checkout/pull/1774) > * Pin actions/checkout's own workflows to a known, good, stable version. by [`@jww3`](https://github.com/jww3) in [actions/checkout#1776](https://redirect.github.com/actions/checkout/pull/1776) > > v4.1.6 > ------ > > * Check platform to set archive extension appropriately by [`@cory-miller`](https://github.com/cory-miller) in [actions/checkout#1732](https://redirect.github.com/actions/checkout/pull/1732) ... (truncated) Commits * [`de0fac2`](actions/checkout@de0fac2) Fix tag handling: preserve annotations and explicit fetch-tags ([#2356](https://redirect.github.com/actions/checkout/issues/2356)) * [`064fe7f`](actions/checkout@064fe7f) Add orchestration\_id to git user-agent when ACTIONS\_ORCHESTRATION\_ID is set (... * See full diff in [compare view](actions/checkout@8e8c483...de0fac2) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Bumps actions/checkout from 5.0.0 to 6.0.2. ## Release notes Sourced from actions/checkout's releases. v6.0.2 What's Changed Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355 Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356 Full Changelog: actions/checkout@v6.0.1...v6.0.2 v6.0.1 What's Changed Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314 Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327 Clarify v6 README by @ericsciple in actions/checkout#2328 Full Changelog: actions/checkout@v6...v6.0.1 v6.0.0 What's Changed Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248 Persist creds to a separate file by @ericsciple in actions/checkout#2286 v6-beta by @ericsciple in actions/checkout#2298 update readme/changelog for v6 by @ericsciple in actions/checkout#2311 Full Changelog: actions/checkout@v5.0.0...v6.0.0 v6-beta What's Changed Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config. This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios. v5.0.1 What's Changed Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301 Full Changelog: actions/checkout@v5...v5.0.1 ## Changelog Sourced from actions/checkout's changelog. Changelog v6.0.2 Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356 v6.0.1 Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327 v6.0.0 Persist creds to a separate file by @ericsciple in actions/checkout#2286 Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248 v5.0.1 Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301 v5.0.0 Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226 v4.3.1 Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305 v4.3.0 docs: update README.md by @motss in actions/checkout#1971 Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977 Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043 Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044 Update README.md by @nebuk89 in actions/checkout#2194 Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224 Update package dependencies by @salmanmkc in actions/checkout#2236 v4.2.2 url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941 Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946 v4.2.1 Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924 v4.2.0 Add Ref and Commit outputs by @lucacome in actions/checkout#1180 Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872 v4.1.7 Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739 Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697 Check out other refs/* by commit by @orhantoy in actions/checkout#1774 Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in actions/checkout#1776 v4.1.6 Check platform to set archive extension appropriately by @cory-miller in actions/checkout#1732 ... (truncated) ## Commits de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356) 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set ( 8e8c483 Clarify v6 README (#2328) 033fa0d Add worktree support for persist-credentials includeIf (#2327) c2d88d3 Update all references from v5 and v4 to v6 (#2314) 1af3b93 update readme/changelog for v6 (#2311) 71cf226 v6-beta (#2298) 069c695 Persist creds to a separate file (#2286) ff7abcd Update README to include Node.js 24 support details and requirements (#2248) See full diff in compare view  Issue-ID: CIMAN-33 Signed-off-by: dependabot[bot] <[email protected]> Change-Id: I2efc697cecfe2aa7bb222b00975003050af2e33d GitHub-PR: #69 GitHub-Hash: b97dabb355259666 Signed-off-by: onap.gh2gerrit <[email protected]>
Summary
Fixes multiple issues with tag handling in the checkout action.
Issues Fixed
1.
fetch-tags: truedoesn't fetch tags (#1471)Previously, when using
fetch-tags: trueon a branch checkout, tags were not actually fetched. Now tags are properly included in the fetch refspec.2. Annotated tags converted to lightweight (#290)
When checking out an annotated tag, the tag annotation was lost because the action fetched by commit hash rather than by tag reference. Now tags are fetched via explicit refspec (
+refs/tags/*:refs/tags/*), which fetches the actual tag objects and preserves annotations.3. Fatal error with tag +
fetch-tags: true(#1467)Checking out a tag with
fetch-tags: truecaused a fatal error due to duplicate refspecs. Now only the wildcard refspec is used (the specific tag is redundant when fetching all tags).Testing
Unit Tests
Added new unit tests.
E2E Tests