fix: bump GitHub actions/checkout to v6.03

Signed-off-by: Emilien Escalle <emilien.escalle@escemi.com>

Author: neilime

.github/workflows/__shared-ci.yml

@@ -26,6 +26,13 @@ jobs:
       contents: read
     uses: ./.github/workflows/__test-action-checkout.yml
 
+  test-action-checkout-issue-comment:
+    needs: linter
+    permissions:
+      contents: read
+      pull-requests: read
+    uses: ./.github/workflows/__test-action-checkout-issue-comment.yml
+
   test-action-get-github-actions-bot-user:
     needs: linter
     permissions:

.github/workflows/__test-action-checkout-issue-comment.yml

@@ -1,40 +1,49 @@
-name: Internal - Tests for checkout action (issue_comment trigger)
+name: Internal - Tests for checkout action (issue_comment simulation)
 
 on:
-  issue_comment:
-    types: [created, edited]
+  workflow_call:
 
 permissions:
   contents: read
   pull-requests: read
-  issues: read
 
 jobs:
   test-checkout-issue-comment:
-    # Only run on pull request comments
-    if: github.event.issue.pull_request != null
-    name: Test checkout action on issue_comment trigger
+    name: Checkout action on simulated issue_comment
     runs-on: ubuntu-latest
     steps:
-      - name: Arrange - Get PR information
+      - name: Arrange - Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Arrange - Get PR information for simulation
         id: pr-info
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
+            const assert = require('node:assert/strict');
+            const prNumber = 1;
+            assert.ok(prNumber, 'Could not determine PR number from static test configuration');
+
             const pr = await github.rest.pulls.get({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              pull_number: context.issue.number,
+              pull_number: prNumber,
             });
+
             core.setOutput('head-sha', pr.data.head.sha);
             core.setOutput('head-ref', pr.data.head.ref);
-            console.log(`PR Head SHA: ${pr.data.head.sha}`);
-            console.log(`PR Head Ref: ${pr.data.head.ref}`);
+            core.setOutput('pr-number', prNumber);
+
+            core.info(`PR #${prNumber} Head SHA: ${pr.data.head.sha}`);
+            core.info(`PR #${prNumber} Head Ref: ${pr.data.head.ref}`);
 
-      - name: Act - Checkout using custom checkout action (issue_comment case)
+      - name: Act - Simulate issue_comment event context and checkout
         id: checkout
         uses: ./actions/checkout
         with:
+          ref: refs/pull/${{ steps.pr-info.outputs.pr-number }}/head
           persist-credentials: true
 
       - name: Assert - Verify correct PR SHA was checked out
@@ -43,59 +52,55 @@ jobs:
           EXPECTED_SHA: ${{ steps.pr-info.outputs.head-sha }}
         with:
           script: |
+            const assert = require('node:assert/strict');
             const { execSync } = require('child_process');
             const currentSha = execSync('git rev-parse HEAD').toString().trim();
             const expectedSha = process.env.EXPECTED_SHA;
 
-            console.log(`Current SHA: ${currentSha}`);
-            console.log(`Expected PR Head SHA: ${expectedSha}`);
+            core.info(`Current SHA: ${currentSha}`);
+            core.info(`Expected PR Head SHA: ${expectedSha}`);
 
-            if (currentSha !== expectedSha) {
-              throw new Error(`Checked out SHA (${currentSha}) does not match PR head SHA (${expectedSha})`);
+            try {
+              assert.strictEqual(
+                currentSha,
+                expectedSha,
+                `Checked out SHA (${currentSha}) does not match PR head SHA (${expectedSha})`
+              );
+            } catch (error) {
+              core.setFailed(error.message);
+              return;
             }
 
-            console.log('✓ Verified: Checked out correct PR head SHA');
+            core.info('Verified: Checked out correct PR head SHA');
 
       - name: Assert - Verify not on main branch
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           EXPECTED_BRANCH: ${{ steps.pr-info.outputs.head-ref }}
         with:
           script: |
+            const assert = require('node:assert/strict');
             const { execSync } = require('child_process');
             const currentBranch = execSync('git rev-parse --abbrev-ref HEAD').toString().trim();
             const expectedBranch = process.env.EXPECTED_BRANCH;
 
-            console.log(`Current branch/ref: ${currentBranch}`);
-            console.log(`Expected branch: ${expectedBranch}`);
-
-            if (['HEAD', 'main', 'master'].includes(currentBranch)) {
-              throw new Error(`Checked out main/master branch instead of PR branch`);
-            }
-
-            console.log('✓ Verified: Not on main/master branch');
+            core.info(`Current branch/ref: ${currentBranch}`);
+            core.info(`Expected branch: ${expectedBranch}`);
 
-      - name: Assert - Verify credentials are persisted
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { execSync } = require('child_process');
             try {
-              execSync('git config --local --get-regexp "^url\\.https://.*\\.insteadOf"', { stdio: 'pipe' });
-              console.log('✓ Verified: Credentials are persisted');
+              assert.notStrictEqual(currentBranch, 'main', 'Checked out main branch instead of PR branch');
+              assert.notStrictEqual(currentBranch, 'master', 'Checked out master branch instead of PR branch');
+              assert.ok(
+                currentBranch === 'HEAD' || currentBranch === expectedBranch,
+                `Checked out unexpected ref ${currentBranch}; expected HEAD or ${expectedBranch}`
+              );
             } catch (error) {
-              console.log('WARNING: Token credentials appear not to be persisted');
-              console.log('This may be expected depending on GitHub token availability in issue_comment context');
+              core.setFailed(error.message);
+              return;
             }
 
-      - name: Info - Display checkout details
-        if: always()
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { execSync } = require('child_process');
-            console.log('=== Git Status ===');
-            console.log(execSync('git status').toString());
-            console.log('');
-            console.log('=== Git Log (last 3 commits) ===');
-            console.log(execSync('git log --oneline -3').toString());
+            if (currentBranch === 'HEAD') {
+              core.warning('Repository is in detached HEAD state; this is expected when checking out refs/pull/<n>/head.');
+            }
+
+            core.info('Verified: Not on main/master branch');

.github/workflows/__test-action-checkout.yml

@@ -22,16 +22,13 @@ jobs:
         uses: ./actions/checkout
 
       - name: Assert - Verify repository is checked out
-        run: |
-          if [ ! -d ".git" ]; then
-            echo "Repository .git directory is missing"
-            exit 1
-          fi
-
-          if [ ! -f "README.md" ]; then
-            echo "README.md is missing"
-            exit 1
-          fi
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const assert = require('node:assert/strict');
+            const { existsSync } = require('node:fs');
+            assert.ok(existsSync('.git'), 'Repository .git directory is missing');
+            assert.ok(existsSync('README.md'), 'README.md is missing');
 
       - name: Act - Run custom checkout action with fetch-depth 0
         id: custom-checkout-full-history
@@ -40,13 +37,13 @@ jobs:
           fetch-depth: "0"
 
       - name: Assert - Verify full history is fetched
-        run: |
-          # Check that we have commits by counting them
-          commit_count=$(git rev-list --count HEAD)
-          if [ "$commit_count" -lt 1 ]; then
-            echo "No commits found in repository"
-            exit 1
-          fi
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const assert = require('node:assert/strict');
+            const { execSync } = require('child_process');
+            const commitCount = Number.parseInt(execSync('git rev-list --count HEAD').toString().trim(), 10);
+            assert.ok(commitCount >= 1, 'No commits found in repository');
 
       - name: Act - Run custom checkout action with LFS disabled (default)
         id: custom-checkout-no-lfs
@@ -55,16 +52,26 @@ jobs:
           lfs: "false"
 
       - name: Assert - Verify checkout succeeded
-        run: |
-          if [ ! -f "action.yml" ]; then
-            echo "action.yml is missing after checkout"
-            exit 1
-          fi
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const assert = require('node:assert/strict');
+            const { existsSync } = require('node:fs');
+            assert.ok(existsSync('action.yml'), 'action.yml is missing after checkout');
 
       - name: Assert - Verify token is not persisted by default
-        run: |
-          # When persist-credentials is false, the git config should not have insteadOf
-          if git config --local --get url.https://github.com/.insteadOf 2>/dev/null; then
-            echo "Token credentials were persisted when they should not have been"
-            exit 1
-          fi
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const assert = require('node:assert/strict');
+            const { execSync } = require('child_process');
+
+            let persisted = false;
+            try {
+              execSync('git config --local --get url.https://github.com/.insteadOf', { stdio: 'pipe' });
+              persisted = true;
+            } catch {
+              persisted = false;
+            }
+
+            assert.equal(persisted, false, 'Token credentials were persisted when they should not have been');

.github/workflows/__test-action-get-github-actions-bot-user.yml

@@ -21,16 +21,27 @@ jobs:
         uses: ./actions/get-github-actions-bot-user
 
       - name: Assert - Check get-github-actions-bot-user outputs
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           STEPS_GET_GITHUB_ACTIONS_BOT_USER_OUTPUTS_NAME: ${{ steps.get-github-actions-bot-user.outputs.name }}
           STEPS_GET_GITHUB_ACTIONS_BOT_USER_OUTPUTS_EMAIL: ${{ steps.get-github-actions-bot-user.outputs.email }}
-        run: |
-          if [ "${STEPS_GET_GITHUB_ACTIONS_BOT_USER_OUTPUTS_NAME}" != 'github-actions[bot]' ]; then
-            echo "get-github-actions-bot-user output name is not valid"
-            exit 1
-          fi
+        with:
+          script: |
+            const assert = require('node:assert/strict');
+            const outputName = process.env.STEPS_GET_GITHUB_ACTIONS_BOT_USER_OUTPUTS_NAME;
+            const outputEmail = process.env.STEPS_GET_GITHUB_ACTIONS_BOT_USER_OUTPUTS_EMAIL;
+
+            core.info(`Output name: ${outputName}`);
+            core.info(`Output email: ${outputEmail}`);
 
-          if [ "${STEPS_GET_GITHUB_ACTIONS_BOT_USER_OUTPUTS_EMAIL}" != '41898282+github-actions[bot]@users.noreply.github.com' ]; then
-            echo "get-github-actions-bot-user output email is not valid"
-            exit 1
-          fi
+            try {
+              assert.strictEqual(outputName, 'github-actions[bot]', 'get-github-actions-bot-user output name is not valid');
+              assert.strictEqual(
+                outputEmail,
+                '41898282+github-actions[bot]@users.noreply.github.com',
+                'get-github-actions-bot-user output email is not valid'
+              );
+            } catch (error) {
+              core.setFailed(error.message);
+              return;
+            }

.github/workflows/__test-action-get-issue-number.yml

@@ -22,22 +22,35 @@ jobs:
         uses: ./actions/get-issue-number
 
       - name: Assert - Check get-issue-number behavior by event type
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
+          EVENT_NAME: ${{ github.event_name }}
           STEPS_GET_ISSUE_NUMBER_OUTCOME: ${{ steps.get-issue-number.outcome }}
           STEPS_GET_ISSUE_NUMBER_OUTPUTS_ISSUE_NUMBER: ${{ steps.get-issue-number.outputs.issue-number }}
           EXPECTED_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          if [ "${GITHUB_EVENT_NAME}" = 'pull_request' ]; then
-            if [ "${STEPS_GET_ISSUE_NUMBER_OUTCOME}" != 'success' ]; then
-              echo "get-issue-number should succeed for pull_request events"
-              exit 1
-            fi
+        with:
+          script: |
+            const assert = require('node:assert/strict');
+            const eventName = process.env.EVENT_NAME;
+            const outcome = process.env.STEPS_GET_ISSUE_NUMBER_OUTCOME;
+            const issueNumber = process.env.STEPS_GET_ISSUE_NUMBER_OUTPUTS_ISSUE_NUMBER;
+            const expectedPrNumber = process.env.EXPECTED_PULL_REQUEST_NUMBER;
+
+            core.info(`Event name: ${eventName}`);
+            core.info(`Action outcome: ${outcome}`);
 
-            if [ "${STEPS_GET_ISSUE_NUMBER_OUTPUTS_ISSUE_NUMBER}" != "${EXPECTED_PULL_REQUEST_NUMBER}" ]; then
-              echo "get-issue-number output is not valid for pull_request events"
-              exit 1
-            fi
-          elif [ "${STEPS_GET_ISSUE_NUMBER_OUTCOME}" != 'failure' ]; then
-            echo "get-issue-number should fail when event is not pull_request"
-            exit 1
-          fi
+            try {
+              if (eventName === 'pull_request') {
+                assert.strictEqual(outcome, 'success', 'get-issue-number should succeed for pull_request events');
+                assert.strictEqual(
+                  issueNumber,
+                  expectedPrNumber,
+                  'get-issue-number output is not valid for pull_request events'
+                );
+              } else {
+                assert.strictEqual(outcome, 'failure', 'get-issue-number should fail when event is not pull_request');
+              }
+            } catch (error) {
+              core.setFailed(error.message);
+              return;
+            }