From 3d845fe4f235ff173b125a991339a43eb8cf3cfd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 22 Jul 2025 12:43:02 +0000 Subject: [PATCH 1/8] Bump undici in the npm_and_yarn group across 1 directory --- updated-dependencies: - dependency-name: undici dependency-version: 5.29.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index bfbb0d3cb..28b228725 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5268,9 +5268,9 @@ } }, "node_modules/undici": { - "version": "5.28.5", - "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.5.tgz", - "integrity": "sha512-zICwjrDrcrUE0pyyJc1I2QzBkLM8FINsgOrt6WjA+BgajVq9Nxu2PbFFXUrAggLfDXlZGZBVZYw7WNV5KiBiBA==", + "version": "5.29.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz", + "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==", "license": "MIT", "dependencies": { "@fastify/busboy": "^2.0.0" From 451065f6feee481c71f43ba647fa27cfcb4ffbd2 Mon Sep 17 00:00:00 2001 From: Dylan Wharton <192547935+whartondylan@users.noreply.github.com> Date: Sun, 3 Aug 2025 11:17:11 -0400 Subject: [PATCH 2/8] Create npm-grunt.yml --- .github/workflows/npm-grunt.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 .github/workflows/npm-grunt.yml diff --git a/.github/workflows/npm-grunt.yml b/.github/workflows/npm-grunt.yml new file mode 100644 index 000000000..5ef7a9ae1 --- /dev/null +++ b/.github/workflows/npm-grunt.yml @@ -0,0 +1,28 @@ +name: NodeJS with Grunt + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + +jobs: + build: + runs-on: ubuntu-latest + + strategy: + matrix: + node-version: [18.x, 20.x, 22.x] + + steps: + - uses: actions/checkout@v4 + + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v4 + with: + node-version: ${{ matrix.node-version }} + + - name: Build + run: | + npm install + grunt From 12286cd2cb04600052fcf1966516674931c60a35 Mon Sep 17 00:00:00 2001 From: Dylan Wharton <192547935+whartondylan@users.noreply.github.com> Date: Sun, 3 Aug 2025 11:17:33 -0400 Subject: [PATCH 3/8] Create python-package-conda.yml --- .github/workflows/python-package-conda.yml | 34 ++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/workflows/python-package-conda.yml diff --git a/.github/workflows/python-package-conda.yml b/.github/workflows/python-package-conda.yml new file mode 100644 index 000000000..f3586044a --- /dev/null +++ b/.github/workflows/python-package-conda.yml @@ -0,0 +1,34 @@ +name: Python Package using Conda + +on: [push] + +jobs: + build-linux: + runs-on: ubuntu-latest + strategy: + max-parallel: 5 + + steps: + - uses: actions/checkout@v4 + - name: Set up Python 3.10 + uses: actions/setup-python@v3 + with: + python-version: '3.10' + - name: Add conda to system path + run: | + # $CONDA is an environment variable pointing to the root of the miniconda directory + echo $CONDA/bin >> $GITHUB_PATH + - name: Install dependencies + run: | + conda env update --file environment.yml --name base + - name: Lint with flake8 + run: | + conda install flake8 + # stop the build if there are Python syntax errors or undefined names + flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics + # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide + flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics + - name: Test with pytest + run: | + conda install pytest + pytest From be42b51395558a173309c8f2bf8cceae648f5934 Mon Sep 17 00:00:00 2001 From: Dylan Wharton <192547935+whartondylan@users.noreply.github.com> Date: Sun, 3 Aug 2025 11:17:54 -0400 Subject: [PATCH 4/8] Create npm-publish-github-packages.yml --- .../workflows/npm-publish-github-packages.yml | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 .github/workflows/npm-publish-github-packages.yml diff --git a/.github/workflows/npm-publish-github-packages.yml b/.github/workflows/npm-publish-github-packages.yml new file mode 100644 index 000000000..ea2d329fa --- /dev/null +++ b/.github/workflows/npm-publish-github-packages.yml @@ -0,0 +1,36 @@ +# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created +# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages + +name: Node.js Package + +on: + release: + types: [created] + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: 20 + - run: npm ci + - run: npm test + + publish-gpr: + needs: build + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: 20 + registry-url: https://npm.pkg.github.com/ + - run: npm ci + - run: npm publish + env: + NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}} From f74b64d528c18490145d1cb372f6a9b176d92f4e Mon Sep 17 00:00:00 2001 From: Dylan Wharton <192547935+whartondylan@users.noreply.github.com> Date: Sun, 3 Aug 2025 11:18:35 -0400 Subject: [PATCH 5/8] Create python-publish.yml --- .github/workflows/python-publish.yml | 70 ++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 .github/workflows/python-publish.yml diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml new file mode 100644 index 000000000..82f8dbd96 --- /dev/null +++ b/.github/workflows/python-publish.yml @@ -0,0 +1,70 @@ +# This workflow will upload a Python Package to PyPI when a release is created +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Upload Python Package + +on: + release: + types: [published] + +permissions: + contents: read + +jobs: + release-build: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-python@v5 + with: + python-version: "3.x" + + - name: Build release distributions + run: | + # NOTE: put your own distribution build steps here. + python -m pip install build + python -m build + + - name: Upload distributions + uses: actions/upload-artifact@v4 + with: + name: release-dists + path: dist/ + + pypi-publish: + runs-on: ubuntu-latest + needs: + - release-build + permissions: + # IMPORTANT: this permission is mandatory for trusted publishing + id-token: write + + # Dedicated environments with protections for publishing are strongly recommended. + # For more information, see: https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules + environment: + name: pypi + # OPTIONAL: uncomment and update to include your PyPI project URL in the deployment status: + # url: https://pypi.org/p/YOURPROJECT + # + # ALTERNATIVE: if your GitHub Release name is the PyPI project version string + # ALTERNATIVE: exactly, uncomment the following line instead: + # url: https://pypi.org/project/YOURPROJECT/${{ github.event.release.name }} + + steps: + - name: Retrieve release distributions + uses: actions/download-artifact@v4 + with: + name: release-dists + path: dist/ + + - name: Publish release distributions to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 + with: + packages-dir: dist/ From 4edaa7c1ad1190db416ab086d96aa92a08a23472 Mon Sep 17 00:00:00 2001 From: Dylan Wharton <192547935+whartondylan@users.noreply.github.com> Date: Sun, 3 Aug 2025 11:19:12 -0400 Subject: [PATCH 6/8] Create npm-publish.yml --- .github/workflows/npm-publish.yml | 33 +++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 .github/workflows/npm-publish.yml diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml new file mode 100644 index 000000000..2a4766d38 --- /dev/null +++ b/.github/workflows/npm-publish.yml @@ -0,0 +1,33 @@ +# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created +# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages + +name: Node.js Package + +on: + release: + types: [created] + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: 20 + - run: npm ci + - run: npm test + + publish-npm: + needs: build + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: 20 + registry-url: https://registry.npmjs.org/ + - run: npm ci + - run: npm publish + env: + NODE_AUTH_TOKEN: ${{secrets.npm_token}} From 89ed7131ee4dc04b7ec073c812417e5b565e3548 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 26 Aug 2025 15:43:28 +0000 Subject: [PATCH 7/8] Bump the pip group across 1 directory with 4 updates Bumps the pip group with 4 updates in the /__tests__/data directory: [certifi](https://github.com/certifi/python-certifi), [idna](https://github.com/kjd/idna), [requests](https://github.com/psf/requests) and [urllib3](https://github.com/urllib3/urllib3). Updates `certifi` from 2020.6.20 to 2024.7.4 - [Commits](https://github.com/certifi/python-certifi/compare/2020.06.20...2024.07.04) Updates `idna` from 2.9 to 3.7 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst) - [Commits](https://github.com/kjd/idna/compare/v2.9...v3.7) Updates `requests` from 2.32.2 to 2.32.4 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](https://github.com/psf/requests/compare/v2.32.2...v2.32.4) Updates `urllib3` from 1.26.19 to 2.5.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/1.26.19...2.5.0) --- updated-dependencies: - dependency-name: certifi dependency-version: 2024.7.4 dependency-type: direct:production dependency-group: pip - dependency-name: idna dependency-version: '3.7' dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.32.4 dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-version: 2.5.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] --- __tests__/data/requirements-linux.txt | 8 ++++---- __tests__/data/requirements.txt | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/__tests__/data/requirements-linux.txt b/__tests__/data/requirements-linux.txt index 0e93594b8..5f80a20ef 100644 --- a/__tests__/data/requirements-linux.txt +++ b/__tests__/data/requirements-linux.txt @@ -1,12 +1,12 @@ -certifi==2020.6.20 +certifi==2024.7.4 chardet==3.0.4 docutils==0.16 -idna==3.7 +idna==3.10 Kivy==2.0.0rc3 Kivy-Garden==0.1.4 packaging==20.7 pdf2image==1.12.1 Pygments==2.6.1 -requests==2.32.2 -urllib3==1.26.19 +requests==2.32.4 +urllib3==2.5.0 xlrd==1.2.0 \ No newline at end of file diff --git a/__tests__/data/requirements.txt b/__tests__/data/requirements.txt index cfe5ff8c1..e65df2894 100644 --- a/__tests__/data/requirements.txt +++ b/__tests__/data/requirements.txt @@ -1,6 +1,6 @@ altgraph==0.17.2 -certifi==2020.6.20 +certifi==2024.7.4 chardet==3.0.4 @@ -8,7 +8,7 @@ docutils==0.16 future==0.18.2; python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2' -idna==3.7 +idna==3.10 itsdangerous==1.1.0 @@ -40,8 +40,8 @@ pyparsing==2.4.7; python_version >= '2.6' and python_version not in '3.0, 3.1, 3 pywin32-ctypes==0.2.0 -requests==2.32.2 +requests==2.32.4 -urllib3==1.26.19 +urllib3==2.5.0 xlrd==1.2.0 \ No newline at end of file From 03078ca5528b696740a7efcecac6aa994a45f07e Mon Sep 17 00:00:00 2001 From: Dylan Wharton <192547935+whartondylan@users.noreply.github.com> Date: Tue, 26 Aug 2025 12:18:39 -0400 Subject: [PATCH 8/8] Add files via upload --- README.md | 391 +++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 312 insertions(+), 79 deletions(-) diff --git a/README.md b/README.md index c3f16cf62..9a32e9aa2 100644 --- a/README.md +++ b/README.md @@ -1,130 +1,363 @@ -# setup-python +[![Build and Test](https://github.com/actions/checkout/actions/workflows/test.yml/badge.svg)](https://github.com/actions/checkout/actions/workflows/test.yml) -[![Basic validation](https://github.com/actions/setup-python/actions/workflows/basic-validation.yml/badge.svg?branch=main)](https://github.com/actions/setup-python/actions/workflows/basic-validation.yml) -[![Validate Python e2e](https://github.com/actions/setup-python/actions/workflows/test-python.yml/badge.svg?branch=main)](https://github.com/actions/setup-python/actions/workflows/test-python.yml) -[![Validate PyPy e2e](https://github.com/actions/setup-python/actions/workflows/test-pypy.yml/badge.svg?branch=main)](https://github.com/actions/setup-python/actions/workflows/test-pypy.yml) -[![e2e-cache](https://github.com/actions/setup-python/actions/workflows/e2e-cache.yml/badge.svg?branch=main)](https://github.com/actions/setup-python/actions/workflows/e2e-cache.yml) +# Checkout V5 -This action provides the following functionality for GitHub Actions users: +## What's new -- Installing a version of Python or PyPy and (by default) adding it to the PATH -- Optionally caching dependencies for pip, pipenv and poetry -- Registering problem matchers for error output +- Updated to the node24 runtime + - This requires a minimum Actions Runner version of [v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) to run. -## Basic usage -See [action.yml](action.yml) +# Checkout V4 -**Python** +This action checks-out your repository under `$GITHUB_WORKSPACE`, so your workflow can access it. + +Only a single commit is fetched by default, for the ref/SHA that triggered the workflow. Set `fetch-depth: 0` to fetch all history for all branches and tags. Refer [here](https://docs.github.com/actions/using-workflows/events-that-trigger-workflows) to learn which commit `$GITHUB_SHA` points to for different events. + +The auth token is persisted in the local git config. This enables your scripts to run authenticated git commands. The token is removed during post-job cleanup. Set `persist-credentials: false` to opt-out. + +When Git 2.18 or higher is not in your PATH, falls back to the REST API to download the files. + +### Note + +Thank you for your interest in this GitHub action, however, right now we are not taking contributions. + +We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time. The GitHub public roadmap is the best place to follow along for any updates on features we’re working on and what stage they’re in. + +We are taking the following steps to better direct requests related to GitHub Actions, including: + +1. We will be directing questions and support requests to our [Community Discussions area](https://github.com/orgs/community/discussions/categories/actions) + +2. High Priority bugs can be reported through Community Discussions or you can report these to our support team https://support.github.com/contact/bug-report. + +3. Security Issues should be handled as per our [security.md](security.md) + +We will still provide security updates for this project and fix major breaking changes during this time. + +You are welcome to still raise bugs in this repo. + +# What's new + +Please refer to the [release page](https://github.com/actions/checkout/releases/latest) for the latest release notes. + +# Usage + + ```yaml -steps: -- uses: actions/checkout@v4 -- uses: actions/setup-python@v5 +- uses: actions/checkout@v5 with: - python-version: '3.13' -- run: python my_script.py + # Repository name with owner. For example, actions/checkout + # Default: ${{ github.repository }} + repository: '' + + # The branch, tag or SHA to checkout. When checking out the repository that + # triggered a workflow, this defaults to the reference or SHA for that event. + # Otherwise, uses the default branch. + ref: '' + + # Personal access token (PAT) used to fetch the repository. The PAT is configured + # with the local git config, which enables your scripts to run authenticated git + # commands. The post-job step removes the PAT. + # + # We recommend using a service account with the least permissions necessary. Also + # when generating a new PAT, select the least scopes necessary. + # + # [Learn more about creating and using encrypted secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets) + # + # Default: ${{ github.token }} + token: '' + + # SSH key used to fetch the repository. The SSH key is configured with the local + # git config, which enables your scripts to run authenticated git commands. The + # post-job step removes the SSH key. + # + # We recommend using a service account with the least permissions necessary. + # + # [Learn more about creating and using encrypted secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets) + ssh-key: '' + + # Known hosts in addition to the user and global host key database. The public SSH + # keys for a host may be obtained using the utility `ssh-keyscan`. For example, + # `ssh-keyscan github.com`. The public key for github.com is always implicitly + # added. + ssh-known-hosts: '' + + # Whether to perform strict host key checking. When true, adds the options + # `StrictHostKeyChecking=yes` and `CheckHostIP=no` to the SSH command line. Use + # the input `ssh-known-hosts` to configure additional hosts. + # Default: true + ssh-strict: '' + + # The user to use when connecting to the remote SSH host. By default 'git' is + # used. + # Default: git + ssh-user: '' + + # Whether to configure the token or SSH key with the local git config + # Default: true + persist-credentials: '' + + # Relative path under $GITHUB_WORKSPACE to place the repository + path: '' + + # Whether to execute `git clean -ffdx && git reset --hard HEAD` before fetching + # Default: true + clean: '' + + # Partially clone against a given filter. Overrides sparse-checkout if set. + # Default: null + filter: '' + + # Do a sparse checkout on given patterns. Each pattern should be separated with + # new lines. + # Default: null + sparse-checkout: '' + + # Specifies whether to use cone-mode when doing a sparse checkout. + # Default: true + sparse-checkout-cone-mode: '' + + # Number of commits to fetch. 0 indicates all history for all branches and tags. + # Default: 1 + fetch-depth: '' + + # Whether to fetch tags, even if fetch-depth > 0. + # Default: false + fetch-tags: '' + + # Whether to show progress status output when fetching. + # Default: true + show-progress: '' + + # Whether to download Git-LFS files + # Default: false + lfs: '' + + # Whether to checkout submodules: `true` to checkout submodules or `recursive` to + # recursively checkout submodules. + # + # When the `ssh-key` input is not provided, SSH URLs beginning with + # `git@github.com:` are converted to HTTPS. + # + # Default: false + submodules: '' + + # Add repository path as safe.directory for Git global config by running `git + # config --global --add safe.directory ` + # Default: true + set-safe-directory: '' + + # The base URL for the GitHub instance that you are trying to clone from, will use + # environment defaults to fetch from the same instance that the workflow is + # running from unless specified. Example URLs are https://github.com or + # https://my-ghes-server.example.com + github-server-url: '' ``` + + +# Scenarios + +- [Checkout V5](#checkout-v5) + - [What's new](#whats-new) +- [Checkout V4](#checkout-v4) + - [Note](#note) +- [What's new](#whats-new-1) +- [Usage](#usage) +- [Scenarios](#scenarios) + - [Fetch only the root files](#fetch-only-the-root-files) + - [Fetch only the root files and `.github` and `src` folder](#fetch-only-the-root-files-and-github-and-src-folder) + - [Fetch only a single file](#fetch-only-a-single-file) + - [Fetch all history for all tags and branches](#fetch-all-history-for-all-tags-and-branches) + - [Checkout a different branch](#checkout-a-different-branch) + - [Checkout HEAD^](#checkout-head) + - [Checkout multiple repos (side by side)](#checkout-multiple-repos-side-by-side) + - [Checkout multiple repos (nested)](#checkout-multiple-repos-nested) + - [Checkout multiple repos (private)](#checkout-multiple-repos-private) + - [Checkout pull request HEAD commit instead of merge commit](#checkout-pull-request-head-commit-instead-of-merge-commit) + - [Checkout pull request on closed event](#checkout-pull-request-on-closed-event) + - [Push a commit using the built-in token](#push-a-commit-using-the-built-in-token) + - [Push a commit to a PR using the built-in token](#push-a-commit-to-a-pr-using-the-built-in-token) +- [Recommended permissions](#recommended-permissions) +- [License](#license) + +## Fetch only the root files -**PyPy** ```yaml -steps: -- uses: actions/checkout@v4 -- uses: actions/setup-python@v5 +- uses: actions/checkout@v5 with: - python-version: 'pypy3.10' -- run: python my_script.py + sparse-checkout: . ``` -**GraalPy** +## Fetch only the root files and `.github` and `src` folder + ```yaml -steps: -- uses: actions/checkout@v4 -- uses: actions/setup-python@v5 +- uses: actions/checkout@v5 with: - python-version: 'graalpy-24.0' -- run: python my_script.py + sparse-checkout: | + .github + src ``` -**Free threaded Python** +## Fetch only a single file + ```yaml -steps: -- uses: actions/checkout@v4 -- uses: actions/setup-python@v5 +- uses: actions/checkout@v5 with: - python-version: '3.13t' -- run: python my_script.py + sparse-checkout: | + README.md + sparse-checkout-cone-mode: false ``` -The `python-version` input is optional. If not supplied, the action will try to resolve the version from the default `.python-version` file. If the `.python-version` file doesn't exist Python or PyPy version from the PATH will be used. The default version of Python or PyPy in PATH varies between runners and can be changed unexpectedly so we recommend always setting Python version explicitly using the `python-version` or `python-version-file` inputs. +## Fetch all history for all tags and branches -The action will first check the local [tool cache](docs/advanced-usage.md#hosted-tool-cache) for a [semver](https://github.com/npm/node-semver#versions) match. If unable to find a specific version in the tool cache, the action will attempt to download a version of Python from [GitHub Releases](https://github.com/actions/python-versions/releases) and for PyPy from the official [PyPy's dist](https://downloads.python.org/pypy/). +```yaml +- uses: actions/checkout@v5 + with: + fetch-depth: 0 +``` -For information regarding locally cached versions of Python or PyPy on GitHub hosted runners, check out [GitHub Actions Runner Images](https://github.com/actions/runner-images). +## Checkout a different branch -## Supported version syntax +```yaml +- uses: actions/checkout@v5 + with: + ref: my-branch +``` -The `python-version` input supports the [Semantic Versioning Specification](https://semver.org/) and some special version notations (e.g. `semver ranges`, `x.y-dev syntax`, etc.), for detailed examples please refer to the section: [Using python-version input](docs/advanced-usage.md#using-the-python-version-input) of the [Advanced usage](docs/advanced-usage.md) guide. +## Checkout HEAD^ -## Supported architectures +```yaml +- uses: actions/checkout@v5 + with: + fetch-depth: 2 +- run: git checkout HEAD^ +``` -Using the `architecture` input, it is possible to specify the required Python or PyPy interpreter architecture: `x86`, `x64`, or `arm64`. If the input is not specified, the architecture defaults to the host OS architecture. +## Checkout multiple repos (side by side) -## Caching packages dependencies +```yaml +- name: Checkout + uses: actions/checkout@v5 + with: + path: main -The action has built-in functionality for caching and restoring dependencies. It uses [toolkit/cache](https://github.com/actions/toolkit/tree/main/packages/cache) under the hood for caching dependencies but requires less configuration settings. Supported package managers are `pip`, `pipenv` and `poetry`. The `cache` input is optional, and caching is turned off by default. +- name: Checkout tools repo + uses: actions/checkout@v5 + with: + repository: my-org/my-tools + path: my-tools +``` +> - If your secondary repository is private or internal you will need to add the option noted in [Checkout multiple repos (private)](#Checkout-multiple-repos-private) -The action defaults to searching for a dependency file (`requirements.txt` or `pyproject.toml` for pip, `Pipfile.lock` for pipenv or `poetry.lock` for poetry) in the repository, and uses its hash as a part of the cache key. Input `cache-dependency-path` is used for cases when multiple dependency files are used, they are located in different subdirectories or different files for the hash that want to be used. +## Checkout multiple repos (nested) - - For `pip`, the action will cache the global cache directory - - For `pipenv`, the action will cache virtualenv directory - - For `poetry`, the action will cache virtualenv directories -- one for each poetry project found +```yaml +- name: Checkout + uses: actions/checkout@v5 -**Caching pip dependencies:** +- name: Checkout tools repo + uses: actions/checkout@v5 + with: + repository: my-org/my-tools + path: my-tools +``` +> - If your secondary repository is private or internal you will need to add the option noted in [Checkout multiple repos (private)](#Checkout-multiple-repos-private) + +## Checkout multiple repos (private) ```yaml -steps: -- uses: actions/checkout@v4 -- uses: actions/setup-python@v5 +- name: Checkout + uses: actions/checkout@v5 + with: + path: main + +- name: Checkout private tools + uses: actions/checkout@v5 with: - python-version: '3.13' - cache: 'pip' # caching pip dependencies -- run: pip install -r requirements.txt + repository: my-org/my-private-tools + token: ${{ secrets.GH_PAT }} # `GH_PAT` is a secret that contains your PAT + path: my-tools ``` ->**Note:** Restored cache will not be used if the requirements.txt file is not updated for a long time and a newer version of the dependency is available which can lead to an increase in total build time. ->The requirements file format allows for specifying dependency versions using logical operators (for example chardet>=3.0.4) or specifying dependencies without any versions. In this case the pip install -r requirements.txt command will always try to install the latest available package version. To be sure that the cache will be used, please stick to a specific dependency version and update it manually if necessary. +> - `${{ github.token }}` is scoped to the current repository, so if you want to checkout a different repository that is private you will need to provide your own [PAT](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line). + + +## Checkout pull request HEAD commit instead of merge commit + +```yaml +- uses: actions/checkout@v5 + with: + ref: ${{ github.event.pull_request.head.sha }} +``` ->The `setup-python` action does not handle authentication for pip when installing packages from private repositories. For help, refer [pip’s VCS support documentation](https://pip.pypa.io/en/stable/topics/vcs-support/) or visit the [pip repository](https://github.com/pypa/pip). +## Checkout pull request on closed event -See examples of using `cache` and `cache-dependency-path` for `pipenv` and `poetry` in the section: [Caching packages](docs/advanced-usage.md#caching-packages) of the [Advanced usage](docs/advanced-usage.md) guide. +```yaml +on: + pull_request: + branches: [main] + types: [opened, synchronize, closed] +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 +``` -## Advanced usage +## Push a commit using the built-in token -- [Using the python-version input](docs/advanced-usage.md#using-the-python-version-input) -- [Using the python-version-file input](docs/advanced-usage.md#using-the-python-version-file-input) -- [Check latest version](docs/advanced-usage.md#check-latest-version) -- [Caching packages](docs/advanced-usage.md#caching-packages) -- [Outputs and environment variables](docs/advanced-usage.md#outputs-and-environment-variables) -- [Available versions of Python, PyPy and GraalPy](docs/advanced-usage.md#available-versions-of-python-pypy-and-graalpy) -- [Hosted tool cache](docs/advanced-usage.md#hosted-tool-cache) -- [Using `setup-python` with a self-hosted runner](docs/advanced-usage.md#using-setup-python-with-a-self-hosted-runner) -- [Using `setup-python` on GHES](docs/advanced-usage.md#using-setup-python-on-ghes) -- [Allow pre-releases](docs/advanced-usage.md#allow-pre-releases) -- [Using the pip-version input](docs/advanced-usage.md#using-the-pip-version-input) +```yaml +on: push +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + - run: | + date > generated.txt + # Note: the following account information will not work on GHES + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add . + git commit -m "generated" + git push +``` +*NOTE:* The user email is `{user.id}+{user.login}@users.noreply.github.com`. See users API: https://api.github.com/users/github-actions%5Bbot%5D -## Recommended permissions +## Push a commit to a PR using the built-in token -When using the `setup-python` action in your GitHub Actions workflow, it is recommended to set the following permissions to ensure proper functionality: +In a pull request trigger, `ref` is required as GitHub Actions checks out in detached HEAD mode, meaning it doesn’t check out your branch by default. ```yaml -permissions: - contents: read # access to check out code and install dependencies +on: pull_request +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + with: + ref: ${{ github.head_ref }} + - run: | + date > generated.txt + # Note: the following account information will not work on GHES + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add . + git commit -m "generated" + git push ``` -## License +*NOTE:* The user email is `{user.id}+{user.login}@users.noreply.github.com`. See users API: https://api.github.com/users/github-actions%5Bbot%5D + +# Recommended permissions + +When using the `checkout` action in your GitHub Actions workflow, it is recommended to set the following `GITHUB_TOKEN` permissions to ensure proper functionality, unless alternative auth is provided via the `token` or `ssh-key` inputs: -The scripts and documentation in this project are released under the [MIT License](LICENSE). +```yaml +permissions: + contents: read +``` -## Contributions +# License -Contributions are welcome! See our [Contributor's Guide](docs/contributors.md). +The scripts and documentation in this project are released under the [MIT License](LICENSE)