feat: add allow-override-on-pr input

.github/workflows/pull-request-verification.yml

@@ -74,63 +74,6 @@ jobs:
       if: steps.filter.outputs.any != 'true' || steps.filter.outputs.error == 'true'
       run: exit 1
 
-  test-container-without-token:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        # bullseye: git 2.30 + Debian CVE-2022-24765 backport, old "unsafe repository" wording,
-        #           pre-2.32 -> ignores GIT_CONFIG_GLOBAL -> exercises the HOME-only path
-        # bookworm: git 2.39, "dubious ownership" wording, honors GIT_CONFIG_GLOBAL
-        container: ['node:24-bullseye', 'node:24-bookworm']
-        locale: ['']
-        include:
-          # zh_CN: git translates the dubious-ownership message via gettext - proves
-          # detection works on non-English stderr regardless of the container's locale.
-          # A CJK locale is the most adversarial probe (multibyte, non-Latin) whose
-          # catalog actually translates this message (ja does not exist, ko lacks it)
-          - container: 'node:24-bookworm'
-            locale: 'zh_CN.UTF-8'
-    container: ${{ matrix.container }}
-    steps:
-    - uses: actions/checkout@v6
-    - name: Generate locale
-      if: matrix.locale != ''
-      run: |
-        apt-get update
-        apt-get install -y locales
-        echo '${{ matrix.locale }} UTF-8' >> /etc/locale.gen
-        locale-gen
-    - name: Verify dubious ownership is reproduced
-      run: |
-        if git status; then
-          echo "::error::git succeeded - environment no longer reproduces dubious ownership"
-          exit 1
-        fi
-    - name: Verify git message is localized
-      if: matrix.locale != ''
-      env:
-        LC_ALL: ${{ matrix.locale }}
-      run: |
-        if stderr=$(git status 2>&1 >/dev/null); then
-          echo "::error::git succeeded - environment no longer reproduces dubious ownership"
-          exit 1
-        fi
-        echo "$stderr"
-        if echo "$stderr" | grep -qE 'dubious ownership|unsafe repository'; then
-          echo "::error::git message is not translated - the locale variant would not test anything"
-          exit 1
-        fi
-    - uses: ./
-      id: filter
-      env:
-        LC_ALL: ${{ matrix.locale }}
-      with:
-        token: ''
-        filters: '.github/filters.yml'
-    - name: filter-test
-      if: steps.filter.outputs.any != 'true' || steps.filter.outputs.error == 'true'
-      run: exit 1
-
   test-wd-without-token:
     runs-on: ubuntu-latest
     steps:

CHANGELOG.md

@@ -1,12 +1,7 @@
 # Changelog
 
-## v4.0.2
-- [Work around git dubious ownership errors in container jobs](https://github.com/dorny/paths-filter/pull/317)
-- [Use rev-parse instead of branch --show-current for older git compat](https://github.com/dorny/paths-filter/pull/303)
-- [Fix warning message](https://github.com/dorny/paths-filter/pull/282)
-
-## v4.0.1
-- [Support merge queue](https://github.com/dorny/paths-filter/pull/255)
+## v4.1.0
+- [Allow base/ref override on pull_request events](https://github.com/dorny/paths-filter/pull/NNN)
 
 ## v4.0.0
 - [Update action runtime to node24](https://github.com/dorny/paths-filter/pull/294)

README.md

@@ -74,14 +74,9 @@ For more scenarios see [examples](#examples) section.
 - It's recommended to quote your path expressions with `'` or `"`. Otherwise, you will get an error if it starts with `*`.
 - Local execution with [act](https://github.com/nektos/act) works only with alternative runner image. Default runner doesn't have `git` binary.
   - Use: `act -P ubuntu-latest=nektos/act-environments-ubuntu:18.04`
-- Git `dubious ownership` errors in [container jobs](https://docs.github.com/en/actions/using-containerized-services/running-jobs-in-a-container) are handled automatically -
-  the action retries with a temporary `HOME` containing a `safe.directory` entry, the same technique used by [actions/checkout](https://github.com/actions/checkout).
-  Only if fetching relies on credentials stored in `HOME`-relative files (e.g. `~/.git-credentials` or `~/.netrc`),
-  mark the repository as safe yourself in a step before this action: `git config --global --add safe.directory "$GITHUB_WORKSPACE"`
 
 ## What's New
 
-- Automatic workaround for git `dubious ownership` errors in container jobs
 - New major release `v4` after update to Node 24 [Breaking change]
 - Add `ref` input parameter
 - Add `list-files: csv` format
@@ -122,8 +117,7 @@ For more information, see [CHANGELOG](https://github.com/dorny/paths-filter/blob
     # introduced by the current branch are considered.
     # All files are considered as added if there is no common ancestor with
     # base branch or no previous commit.
-    # This option is ignored if action is triggered by pull_request event,
-    # unless 'token' is set to an empty string (see the 'token' input below).
+    # This option is ignored if action is triggered by pull_request event, unless 'allow-override-on-pr' is set to true.
     # Default: repository default branch (e.g. master)
     base: ''
 
@@ -132,7 +126,7 @@ For more information, see [CHANGELOG](https://github.com/dorny/paths-filter/blob
     # but you want to get changes on a different branch.
     # If this is empty and action is triggered by merge_group event,
     # the head commit in the event will be used.
-    # This option is ignored if action is triggered by pull_request event.
+    # This option is ignored if action is triggered by pull_request event, unless 'allow-override-on-pr' is set to true.
     # default: ${{ github.ref }}
     ref:
 
@@ -165,9 +159,7 @@ For more information, see [CHANGELOG](https://github.com/dorny/paths-filter/blob
     # It's only used if action is triggered by a pull request event.
     # GitHub token from workflow context is used as default value.
     # If an empty string is provided, the action falls back to detect
-    # changes using git commands. In that case, on pull request events
-    # the 'base' input overrides the pull request base - e.g. set
-    # base: ${{ github.event.before }} to detect changes since the last push.
+    # changes using git commands.
     # Default: ${{ github.token }}
     token: ''
 
@@ -186,18 +178,22 @@ For more information, see [CHANGELOG](https://github.com/dorny/paths-filter/blob
     #  - '!**/*.jpeg'
     #  - '!**/*.md'
     predicate-quantifier: 'some'
+
+    # When true, the user-provided `base` and/or `ref` inputs are honored even if
+    # the action is triggered by a pull_request, pull_request_review,
+    # pull_request_review_comment, or pull_request_target event. In that case the
+    # action skips the GitHub API path and uses git diff against the provided
+    # base/ref. Has no effect if `base` and `ref` are both empty.
+    # Default: false
+    allow-override-on-pr: 'false'
 ```
 
 ## Outputs
 
-- Each filter sets an output variable, named after the filter, whose text value depends on the `predicate-quantifier` setting:
-  - With `predicate-quantifier: 'some'` (default):
-    - `'true'` - if **any** changed file matches **at least one** of the filter's rules
-    - `'false'` - if **no** changed file matches **at least one** of the filter's rules
-  - With `predicate-quantifier: 'every'`:
-    - `'true'` - if **any** changed file matches **all** of the filter's rules
-    - `'false'` - if **no** changed file matches **all** of the filter's rules
-- Each filter sets an output variable with the name `${FILTER_NAME}_count` to the count of matching files.
+- For each filter, it sets output variable named by the filter to the text:
+  - `'true'` - if **any** of changed files matches any of filter rules
+  - `'false'` - if **none** of changed files matches any of filter rules
+- For each filter, it sets an output variable with the name `${FILTER_NAME}_count` to the count of matching files.
 - If enabled, for each filter it sets an output variable with the name `${FILTER_NAME}_files`. It will contain a list of all files matching the filter.
 - `changes` - JSON array with names of all filters matching any of the changed files.
 
@@ -349,8 +345,7 @@ jobs:
     runs-on: ubuntu-latest
     # Required permissions
     permissions:
-      contents: read      # required by actions/checkout
-      pull-requests: read # required by dorny/paths-filter
+      pull-requests: read
     steps:
     - uses: actions/checkout@v6
     - uses: dorny/paths-filter@v4

__tests__/git-exec.test.ts

@@ -1,113 +0,0 @@
-import {getExecOutput, ExecOutput} from '@actions/exec'
-import {gitExec} from '../src/git'
-import {ensureSafeDirectory, getGitEnv} from '../src/safe-directory'
-
-jest.mock('@actions/exec')
-jest.mock('../src/safe-directory', () => ({
-  ...jest.requireActual('../src/safe-directory'),
-  ensureSafeDirectory: jest.fn(),
-  getGitEnv: jest.fn()
-}))
-
-const getExecOutputMock = getExecOutput as jest.MockedFunction<typeof getExecOutput>
-const ensureSafeDirectoryMock = ensureSafeDirectory as jest.MockedFunction<typeof ensureSafeDirectory>
-const getGitEnvMock = getGitEnv as jest.MockedFunction<typeof getGitEnv>
-
-const SUCCESS_OUTPUT: ExecOutput = {exitCode: 0, stdout: 'ok', stderr: ''}
-const DUBIOUS_OUTPUT: ExecOutput = {
-  exitCode: 128,
-  stdout: '',
-  stderr: "fatal: detected dubious ownership in repository at '/github/workspace'"
-}
-
-// clearMocks in jest.config.js does not remove queued mockResolvedValueOnce values or implementations
-beforeEach(() => {
-  getExecOutputMock.mockReset()
-  ensureSafeDirectoryMock.mockReset()
-  getGitEnvMock.mockReset()
-})
-
-describe('gitExec', () => {
-  test('returns result of successful command without invoking the workaround', async () => {
-    getExecOutputMock.mockResolvedValueOnce(SUCCESS_OUTPUT)
-
-    const result = await gitExec(['status'])
-
-    expect(result).toBe(SUCCESS_OUTPUT)
-    expect(getExecOutputMock).toHaveBeenCalledTimes(1)
-    expect(getExecOutputMock).toHaveBeenCalledWith('git', ['status'], expect.objectContaining({ignoreReturnCode: true}))
-    expect(ensureSafeDirectoryMock).not.toHaveBeenCalled()
-  })
-
-  test('passes environment from getGitEnv to git', async () => {
-    const env = {HOME: '/temp/home'}
-    getGitEnvMock.mockReturnValue(env)
-    getExecOutputMock.mockResolvedValueOnce(SUCCESS_OUTPUT)
-
-    await gitExec(['status'])
-
-    expect(getExecOutputMock).toHaveBeenCalledWith('git', ['status'], expect.objectContaining({env}))
-  })
-
-  test('retries once after dubious ownership error is worked around', async () => {
-    getExecOutputMock.mockResolvedValueOnce(DUBIOUS_OUTPUT).mockResolvedValueOnce(SUCCESS_OUTPUT)
-    ensureSafeDirectoryMock.mockResolvedValueOnce(true)
-
-    const result = await gitExec(['status'])
-
-    expect(result).toBe(SUCCESS_OUTPUT)
-    expect(ensureSafeDirectoryMock).toHaveBeenCalledWith(DUBIOUS_OUTPUT.stderr)
-    expect(getExecOutputMock).toHaveBeenCalledTimes(2)
-    for (const call of getExecOutputMock.mock.calls) {
-      expect(call[2]).toEqual(expect.objectContaining({ignoreReturnCode: true}))
-    }
-  })
-
-  test('throws actionable error when retry still fails with dubious ownership', async () => {
-    getExecOutputMock.mockResolvedValueOnce(DUBIOUS_OUTPUT).mockResolvedValueOnce(DUBIOUS_OUTPUT)
-    ensureSafeDirectoryMock.mockResolvedValueOnce(true)
-
-    const promise = gitExec(['status'])
-
-    await expect(promise).rejects.toThrow(/detected dubious ownership/)
-    await expect(promise).rejects.toThrow(/safe\.directory/)
-    await expect(promise).rejects.toThrow(/--user/)
-    expect(getExecOutputMock).toHaveBeenCalledTimes(2)
-  })
-
-  test('throws without retry when workaround adds nothing new', async () => {
-    getExecOutputMock.mockResolvedValueOnce(DUBIOUS_OUTPUT)
-    ensureSafeDirectoryMock.mockResolvedValueOnce(false)
-
-    await expect(gitExec(['status'])).rejects.toThrow(/safe\.directory/)
-    expect(getExecOutputMock).toHaveBeenCalledTimes(1)
-  })
-
-  test('returns non-dubious failure when ignoreReturnCode is set', async () => {
-    const failure: ExecOutput = {exitCode: 1, stdout: '', stderr: 'some error'}
-    getExecOutputMock.mockResolvedValueOnce(failure)
-
-    const result = await gitExec(['show-ref', 'master'], {ignoreReturnCode: true})
-
-    expect(result).toBe(failure)
-    expect(ensureSafeDirectoryMock).not.toHaveBeenCalled()
-  })
-
-  test('retries dubious ownership error even when ignoreReturnCode is set', async () => {
-    getExecOutputMock.mockResolvedValueOnce(DUBIOUS_OUTPUT).mockResolvedValueOnce(SUCCESS_OUTPUT)
-    ensureSafeDirectoryMock.mockResolvedValueOnce(true)
-
-    const result = await gitExec(['show-ref', 'master'], {ignoreReturnCode: true})
-
-    expect(result).toBe(SUCCESS_OUTPUT)
-    expect(getExecOutputMock).toHaveBeenCalledTimes(2)
-  })
-
-  test('throws on non-dubious failure when ignoreReturnCode is not set', async () => {
-    getExecOutputMock.mockResolvedValueOnce({exitCode: 1, stdout: '', stderr: 'some error'})
-
-    await expect(gitExec(['fetch'])).rejects.toThrow("The process 'git fetch' failed with exit code 1")
-    expect(getExecOutputMock).toHaveBeenCalledTimes(1)
-    expect(ensureSafeDirectoryMock).not.toHaveBeenCalled()
-  })
-})

__tests__/safe-directory.test.ts

@@ -1,256 +0,0 @@
-import * as fs from 'fs'
-import * as os from 'os'
-import * as path from 'path'
-import {exec} from '@actions/exec'
-import {
-  buildGitEnv,
-  cleanup,
-  createTempGitHome,
-  ensureSafeDirectory,
-  getGitEnv,
-  isDubiousOwnershipError,
-  parseRepositoryPath,
-  resolveTempBaseDir
-} from '../src/safe-directory'
-
-jest.mock('@actions/exec')
-
-const execMock = exec as jest.MockedFunction<typeof exec>
-
-const DUBIOUS_STDERR = "fatal: detected dubious ownership in repository at '/github/workspace'"
-const UNSAFE_STDERR = "fatal: unsafe repository ('/github/workspace' is owned by someone else)"
-
-describe('detection of dubious ownership errors', () => {
-  test('detects "detected dubious ownership" wording at exit code 128', () => {
-    expect(isDubiousOwnershipError(128, DUBIOUS_STDERR)).toBe(true)
-  })
-
-  test('detects older "unsafe repository" wording at exit code 128', () => {
-    expect(isDubiousOwnershipError(128, UNSAFE_STDERR)).toBe(true)
-  })
-
-  test('does not match other git errors at exit code 128', () => {
-    expect(isDubiousOwnershipError(128, 'fatal: not a git repository')).toBe(false)
-  })
-
-  test('does not match dubious ownership text at other exit codes', () => {
-    expect(isDubiousOwnershipError(1, DUBIOUS_STDERR)).toBe(false)
-    expect(isDubiousOwnershipError(0, DUBIOUS_STDERR)).toBe(false)
-  })
-
-  test('parseRepositoryPath extracts path from both wordings', () => {
-    expect(parseRepositoryPath(DUBIOUS_STDERR)).toBe('/github/workspace')
-    expect(parseRepositoryPath(UNSAFE_STDERR)).toBe('/github/workspace')
-    expect(parseRepositoryPath('fatal: not a git repository')).toBeUndefined()
-  })
-})
-
-describe('createTempGitHome', () => {
-  const scratchDirs: string[] = []
-
-  async function makeScratchDir(): Promise<string> {
-    const dir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'safe-directory-test-'))
-    scratchDirs.push(dir)
-    return dir
-  }
-
-  afterEach(async () => {
-    for (const dir of scratchDirs.splice(0)) {
-      await fs.promises.rm(dir, {recursive: true, force: true})
-    }
-  })
-
-  test('copies file referenced by GIT_CONFIG_GLOBAL and skips XDG fallback', async () => {
-    const base = await makeScratchDir()
-    const home = await makeScratchDir()
-    const configFile = path.join(home, 'custom-gitconfig')
-    await fs.promises.writeFile(configFile, 'custom')
-    await fs.promises.mkdir(path.join(home, '.config', 'git'), {recursive: true})
-    await fs.promises.writeFile(path.join(home, '.config', 'git', 'config'), 'xdg')
-
-    const tempHome = await createTempGitHome(base, {GIT_CONFIG_GLOBAL: configFile, HOME: home})
-    scratchDirs.push(tempHome)
-
-    expect(await fs.promises.readFile(path.join(tempHome, '.gitconfig'), 'utf8')).toBe('custom')
-    expect(fs.existsSync(path.join(tempHome, '.config', 'git', 'config'))).toBe(false)
-  })
-
-  test('does not throw when GIT_CONFIG_GLOBAL references missing file', async () => {
-    const base = await makeScratchDir()
-
-    const tempHome = await createTempGitHome(base, {GIT_CONFIG_GLOBAL: path.join(base, 'missing-gitconfig')})
-    scratchDirs.push(tempHome)
-
-    expect(await fs.promises.readFile(path.join(tempHome, '.gitconfig'), 'utf8')).toBe('')
-  })
-
-  test('copies $HOME/.gitconfig', async () => {
-    const base = await makeScratchDir()
-    const home = await makeScratchDir()
-    await fs.promises.writeFile(path.join(home, '.gitconfig'), 'home config')
-
-    const tempHome = await createTempGitHome(base, {HOME: home})
-    scratchDirs.push(tempHome)
-
-    expect(await fs.promises.readFile(path.join(tempHome, '.gitconfig'), 'utf8')).toBe('home config')
-  })
-
-  test('copies XDG fallback config only when XDG_CONFIG_HOME is unset', async () => {
-    const base = await makeScratchDir()
-    const home = await makeScratchDir()
-    await fs.promises.mkdir(path.join(home, '.config', 'git'), {recursive: true})
-    await fs.promises.writeFile(path.join(home, '.config', 'git', 'config'), 'xdg config')
-
-    const tempHome = await createTempGitHome(base, {HOME: home})
-    scratchDirs.push(tempHome)
-    expect(await fs.promises.readFile(path.join(tempHome, '.config', 'git', 'config'), 'utf8')).toBe('xdg config')
-
-    const tempHomeWithXdg = await createTempGitHome(base, {HOME: home, XDG_CONFIG_HOME: path.join(home, '.config')})
-    scratchDirs.push(tempHomeWithXdg)
-    expect(fs.existsSync(path.join(tempHomeWithXdg, '.config', 'git', 'config'))).toBe(false)
-  })
-
-  test('creates an empty .gitconfig even when there is no config to copy', async () => {
-    const base = await makeScratchDir()
-
-    const tempHome = await createTempGitHome(base, {})
-    scratchDirs.push(tempHome)
-
-    expect(await fs.promises.readdir(tempHome)).toEqual(['.gitconfig'])
-    expect(await fs.promises.readFile(path.join(tempHome, '.gitconfig'), 'utf8')).toBe('')
-  })
-})
-
-describe('buildGitEnv', () => {
-  test('overrides HOME and GIT_CONFIG_GLOBAL, preserves other variables, drops undefined values', () => {
-    const env = buildGitEnv('/temp/home', {
-      HOME: '/root',
-      GIT_CONFIG_GLOBAL: '/root/.gitconfig',
-      PATH: '/usr/bin',
-      UNDEFINED_VALUE: undefined
-    })
-
-    expect(env['HOME']).toBe('/temp/home')
-    expect(env['GIT_CONFIG_GLOBAL']).toBe(path.join('/temp/home', '.gitconfig'))
-    expect(env['PATH']).toBe('/usr/bin')
-    expect('UNDEFINED_VALUE' in env).toBe(false)
-  })
-
-  test('leaves GIT_CONFIG_GLOBAL unset when not present in the original environment', () => {
-    const env = buildGitEnv('/temp/home', {HOME: '/root', PATH: '/usr/bin'})
-
-    expect(env['HOME']).toBe('/temp/home')
-    expect('GIT_CONFIG_GLOBAL' in env).toBe(false)
-  })
-})
-
-describe('resolveTempBaseDir', () => {
-  test('prefers RUNNER_TEMP and falls back to os.tmpdir()', () => {
-    expect(resolveTempBaseDir({RUNNER_TEMP: '/runner/temp'})).toBe('/runner/temp')
-    expect(resolveTempBaseDir({RUNNER_TEMP: ''})).toBe(os.tmpdir())
-    expect(resolveTempBaseDir({})).toBe(os.tmpdir())
-  })
-})
-
-describe('ensureSafeDirectory', () => {
-  const envBackup = process.env
-  let runnerTemp: string
-
-  beforeEach(async () => {
-    runnerTemp = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'safe-directory-test-runner-'))
-    process.env = {...envBackup}
-    process.env['RUNNER_TEMP'] = runnerTemp
-    process.env['HOME'] = runnerTemp
-    process.env['GITHUB_WORKSPACE'] = process.cwd()
-    delete process.env['GIT_CONFIG_GLOBAL']
-    delete process.env['XDG_CONFIG_HOME']
-  })
-
-  afterEach(async () => {
-    await cleanup()
-    await fs.promises.rm(runnerTemp, {recursive: true, force: true})
-    process.env = envBackup
-  })
-
-  test('activates temporary HOME and adds reported directories on first call', async () => {
-    expect(getGitEnv()['HOME']).not.toContain('paths-filter-git-home-')
-
-    const added = await ensureSafeDirectory(DUBIOUS_STDERR)
-
-    expect(added).toBe(true)
-    expect(getGitEnv()).toEqual(
-      expect.objectContaining({
-        HOME: expect.stringContaining('paths-filter-git-home-')
-      })
-    )
-    // GIT_CONFIG_GLOBAL was not set in the original environment, so it must stay unset
-    expect(getGitEnv()).not.toHaveProperty('GIT_CONFIG_GLOBAL')
-    expect(execMock).toHaveBeenCalledWith(
-      'git',
-      ['config', '--global', '--add', 'safe.directory', '/github/workspace'],
-      expect.objectContaining({
-        env: expect.objectContaining({HOME: expect.stringContaining('paths-filter-git-home-')})
-      })
-    )
-    expect(execMock).toHaveBeenCalledWith(
-      'git',
-      ['config', '--global', '--add', 'safe.directory', process.cwd()],
-      expect.anything()
-    )
-  })
-
-  test('returns false when repeated stderr adds no new directory', async () => {
-    await ensureSafeDirectory(DUBIOUS_STDERR)
-    const callCount = execMock.mock.calls.length
-
-    const added = await ensureSafeDirectory(DUBIOUS_STDERR)
-
-    expect(added).toBe(false)
-    expect(execMock.mock.calls.length).toBe(callCount)
-  })
-
-  test('adds directory reported by a later error for a different path', async () => {
-    await ensureSafeDirectory(DUBIOUS_STDERR)
-
-    const added = await ensureSafeDirectory("fatal: detected dubious ownership in repository at '/other/repo'")
-
-    expect(added).toBe(true)
-    expect(execMock).toHaveBeenCalledWith(
-      'git',
-      ['config', '--global', '--add', 'safe.directory', '/other/repo'],
-      expect.anything()
-    )
-  })
-
-  test('cleanup removes the temporary HOME and resets state', async () => {
-    await ensureSafeDirectory(DUBIOUS_STDERR)
-    const tempHome = getGitEnv()['HOME']
-    expect(tempHome).toContain('paths-filter-git-home-')
-
-    await cleanup()
-
-    expect(getGitEnv()['HOME']).not.toContain('paths-filter-git-home-')
-    expect(fs.existsSync(tempHome)).toBe(false)
-  })
-
-  test('getGitEnv mirrors process.env and forces LC_ALL=C before activation', () => {
-    process.env['SOME_PRESERVED_VARIABLE'] = 'preserved'
-    process.env['LC_ALL'] = 'de_DE.UTF-8'
-
-    const env = getGitEnv()
-
-    expect(env['SOME_PRESERVED_VARIABLE']).toBe('preserved')
-    expect(env['HOME']).toBe(runnerTemp)
-    expect(env['LC_ALL']).toBe('C')
-  })
-
-  test('getGitEnv contains the temporary HOME and forces LC_ALL=C after activation', async () => {
-    process.env['LC_ALL'] = 'de_DE.UTF-8'
-
-    await ensureSafeDirectory(DUBIOUS_STDERR)
-
-    const env = getGitEnv()
-    expect(env['HOME']).toContain('paths-filter-git-home-')
-    expect(env['LC_ALL']).toBe('C')
-  })
-})

action.yml

@@ -49,6 +49,14 @@ inputs:
       allows to override the "at least one pattern" behavior to make it so that all of the patterns have to match or otherwise the file is excluded.
     required: false
     default: 'some'
+  allow-override-on-pr:
+    description: |
+      When true, the user-provided `base` and/or `ref` inputs are honored even if the action
+      is triggered by a pull_request, pull_request_review, pull_request_review_comment, or
+      pull_request_target event. In that case the action skips the GitHub API path and uses
+      git diff against the provided base/ref. Has no effect if `base` and `ref` are both empty.
+    required: false
+    default: 'false'
 outputs:
   changes:
     description: JSON array with names of all filters matching any of changed files

package-lock.json

@@ -12,7 +12,6 @@
         "@actions/core": "^1.10.0",
         "@actions/exec": "^1.1.1",
         "@actions/github": "6.0.0",
-        "@octokit/plugin-retry": "^6.1.0",
         "picomatch": "^2.3.1"
       },
       "devDependencies": {
@@ -200,6 +199,7 @@
       "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.23.7.tgz",
       "integrity": "sha512-+UpDgowcmqe36d4NwqvKsyPMlOLNGMsfMmQ5WGCu+siCe3t3dfe9njrzGfdN4qq+bcNUt0+Vw6haRxBOycs4dw==",
       "dev": true,
+      "peer": true,
       "dependencies": {
         "@ampproject/remapping": "^2.2.0",
         "@babel/code-frame": "^7.23.5",
@@ -1391,6 +1391,7 @@
       "version": "5.1.0",
       "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.1.0.tgz",
       "integrity": "sha512-BDa2VAMLSh3otEiaMJ/3Y36GU4qf6GI+VivQ/P41NC6GHcdxpKlqV0ikSZ5gdQsmS3ojXeRx5vasgNTinF0Q4g==",
+      "peer": true,
       "dependencies": {
         "@octokit/auth-token": "^4.0.0",
         "@octokit/graphql": "^7.0.0",
@@ -1462,38 +1463,6 @@
         "@octokit/core": ">=5"
       }
     },
-    "node_modules/@octokit/plugin-retry": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-6.1.0.tgz",
-      "integrity": "sha512-WrO3bvq4E1Xh1r2mT9w6SDFg01gFmP81nIG77+p/MqW1JeXXgL++6umim3t6x0Zj5pZm3rXAN+0HEjmmdhIRig==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^13.0.0",
-        "bottleneck": "^2.15.3"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "peerDependencies": {
-        "@octokit/core": "5"
-      }
-    },
-    "node_modules/@octokit/plugin-retry/node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/plugin-retry/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
-      }
-    },
     "node_modules/@octokit/request": {
       "version": "8.1.6",
       "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.1.6.tgz",
@@ -1926,6 +1895,7 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.11.3.tgz",
       "integrity": "sha512-Y9rRfJG5jcKOE0CLisYbojUjIrIEE7AGMzA/Sm4BslANhbS+cDMpgBdcPT91oJ7OuJ9hYJBx59RjbhxVnrF8Xg==",
       "dev": true,
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -2326,12 +2296,6 @@
       "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
       "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ=="
     },
-    "node_modules/bottleneck": {
-      "version": "2.19.5",
-      "resolved": "https://registry.npmjs.org/bottleneck/-/bottleneck-2.19.5.tgz",
-      "integrity": "sha512-VHiNCbI1lKdl44tGrhNfU3lup0Tj/ZBMJB5/2ZbNXRCPuRCO7ed2mgcK4r17y+KB2EfuYuRaVlwNbAeaWGSpbw==",
-      "license": "MIT"
-    },
     "node_modules/brace-expansion": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
@@ -2372,6 +2336,7 @@
           "url": "https://github.com/sponsors/ai"
         }
       ],
+      "peer": true,
       "dependencies": {
         "caniuse-lite": "^1.0.30001565",
         "electron-to-chromium": "^1.4.601",
@@ -2918,6 +2883,7 @@
       "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.56.0.tgz",
       "integrity": "sha512-Go19xM6T9puCOWntie1/P997aXxFsOi37JIHRWI514Hc6ZnaHGKY9xFhrU65RT6CcBEzZoGG1e6Nq+DT04ZtZQ==",
       "dev": true,
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.6.1",
@@ -2973,6 +2939,7 @@
       "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-9.1.0.tgz",
       "integrity": "sha512-NSWl5BFQWEPi1j4TjVNItzYV7dZXZ+wP6I6ZhrBGpChQhZRUaElihE9uRRkcbRnNb76UMKDF3r+WTmNcGPKsqw==",
       "dev": true,
+      "peer": true,
       "bin": {
         "eslint-config-prettier": "bin/cli.js"
       },
@@ -3147,6 +3114,7 @@
       "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.2.4.tgz",
       "integrity": "sha512-FWu1oLHKCrtpO1ypU6J0SbK2d9Ckwysq6bHj/uaCP26DxrPpppCLQRGVuqAxSTvhF00AcvDRyYrLNW7ocBhFFQ==",
       "dev": true,
+      "peer": true,
       "bin": {
         "prettier": "bin/prettier.cjs"
       },
@@ -4654,6 +4622,7 @@
       "resolved": "https://registry.npmjs.org/jest/-/jest-29.7.0.tgz",
       "integrity": "sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==",
       "dev": true,
+      "peer": true,
       "dependencies": {
         "@jest/core": "^29.7.0",
         "@jest/types": "^29.6.3",
@@ -6829,6 +6798,7 @@
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.3.3.tgz",
       "integrity": "sha512-pXWcraxM0uxAS+tN0AG/BF2TyqmHO014Z070UsJ+pFvYuRSq8KH8DmWpnbXe0pEPDHXZV3FcAbJkijJ5oNEnWw==",
       "dev": true,
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"

package.json

@@ -31,7 +31,6 @@
     "@actions/core": "^1.10.0",
     "@actions/exec": "^1.1.1",
     "@actions/github": "6.0.0",
-    "@octokit/plugin-retry": "^6.1.0",
     "picomatch": "^2.3.1"
   },
   "devDependencies": {

src/git.ts

@@ -1,50 +1,15 @@
-import {getExecOutput, ExecOutput} from '@actions/exec'
+import {getExecOutput} from '@actions/exec'
 import * as core from '@actions/core'
 import {File, ChangeStatus} from './file'
-import {ensureSafeDirectory, getGitEnv, isDubiousOwnershipError} from './safe-directory'
 
 export const NULL_SHA = '0000000000000000000000000000000000000000'
 export const HEAD = 'HEAD'
 
-export async function gitExec(args: string[], options?: {ignoreReturnCode?: boolean}): Promise<ExecOutput> {
-  // ignoreReturnCode is always set so exitCode and stderr stay inspectable - failures are re-thrown below
-  const execute = async (): Promise<ExecOutput> =>
-    getExecOutput('git', args, {...options, ignoreReturnCode: true, env: getGitEnv()})
-
-  let result = await execute()
-  if (isDubiousOwnershipError(result.exitCode, result.stderr)) {
-    if (await ensureSafeDirectory(result.stderr)) {
-      result = await execute()
-    }
-    if (isDubiousOwnershipError(result.exitCode, result.stderr)) {
-      const firstLine = result.stderr
-        .split(/\r?\n/)
-        .find(line => line.trim().length > 0)
-        ?.trim()
-      throw new Error(
-        `${firstLine ?? 'Git failed due to dubious repository ownership'}\n` +
-          'The automatic safe.directory workaround was not sufficient. ' +
-          'Either run the container with the same user as the runner:\n' +
-          '  container:\n' +
-          '    options: --user 1001\n' +
-          'or mark the repository as safe in a step before this action:\n' +
-          '  - run: git config --global --add safe.directory "$GITHUB_WORKSPACE"'
-      )
-    }
-  }
-
-  if (result.exitCode !== 0 && !options?.ignoreReturnCode) {
-    throw new Error(`The process 'git ${args.join(' ')}' failed with exit code ${result.exitCode}`)
-  }
-
-  return result
-}
-
 export async function getChangesInLastCommit(): Promise<File[]> {
   core.startGroup(`Change detection in last commit`)
   let output = ''
   try {
-    output = (await gitExec(['log', '--format=', '--no-renames', '--name-status', '-z', '-n', '1'])).stdout
+    output = (await getExecOutput('git', ['log', '--format=', '--no-renames', '--name-status', '-z', '-n', '1'])).stdout
   } finally {
     fixStdOutNullTermination()
     core.endGroup()
@@ -62,7 +27,8 @@ export async function getChanges(base: string, head: string): Promise<File[]> {
   let output = ''
   try {
     // Two dots '..' change detection - directly compares two versions
-    output = (await gitExec(['diff', '--no-renames', '--name-status', '-z', `${baseRef}..${headRef}`])).stdout
+    output = (await getExecOutput('git', ['diff', '--no-renames', '--name-status', '-z', `${baseRef}..${headRef}`]))
+      .stdout
   } finally {
     fixStdOutNullTermination()
     core.endGroup()
@@ -76,7 +42,7 @@ export async function getChangesOnHead(): Promise<File[]> {
   core.startGroup(`Change detection on HEAD`)
   let output = ''
   try {
-    output = (await gitExec(['diff', '--no-renames', '--name-status', '-z', 'HEAD'])).stdout
+    output = (await getExecOutput('git', ['diff', '--no-renames', '--name-status', '-z', 'HEAD'])).stdout
   } finally {
     fixStdOutNullTermination()
     core.endGroup()
@@ -92,7 +58,7 @@ export async function getChangesSinceMergeBase(base: string, head: string, initi
     if (baseRef === undefined || headRef === undefined) {
       return false
     }
-    return (await gitExec(['merge-base', baseRef, headRef], {ignoreReturnCode: true})).exitCode === 0
+    return (await getExecOutput('git', ['merge-base', baseRef, headRef], {ignoreReturnCode: true})).exitCode === 0
   }
 
   let noMergeBase = false
@@ -101,12 +67,12 @@ export async function getChangesSinceMergeBase(base: string, head: string, initi
     baseRef = await getLocalRef(base)
     headRef = await getLocalRef(head)
     if (!(await hasMergeBase())) {
-      await gitExec(['fetch', '--no-tags', `--depth=${initialFetchDepth}`, 'origin', base, head])
+      await getExecOutput('git', ['fetch', '--no-tags', `--depth=${initialFetchDepth}`, 'origin', base, head])
       if (baseRef === undefined || headRef === undefined) {
         baseRef = baseRef ?? (await getLocalRef(base))
         headRef = headRef ?? (await getLocalRef(head))
         if (baseRef === undefined || headRef === undefined) {
-          await gitExec(['fetch', '--tags', '--depth=1', 'origin', base, head], {
+          await getExecOutput('git', ['fetch', '--tags', '--depth=1', 'origin', base, head], {
             ignoreReturnCode: true // returns exit code 1 if tags on remote were updated - we can safely ignore it
           })
           baseRef = baseRef ?? (await getLocalRef(base))
@@ -128,12 +94,12 @@ export async function getChangesSinceMergeBase(base: string, head: string, initi
       let lastCommitCount = await getCommitCount()
       while (!(await hasMergeBase())) {
         depth = Math.min(depth * 2, Number.MAX_SAFE_INTEGER)
-        await gitExec(['fetch', `--deepen=${depth}`, 'origin', base, head])
+        await getExecOutput('git', ['fetch', `--deepen=${depth}`, 'origin', base, head])
         const commitCount = await getCommitCount()
         if (commitCount === lastCommitCount) {
           core.info('No more commits were fetched')
           core.info('Last attempt will be to fetch full history')
-          await gitExec(['fetch'])
+          await getExecOutput('git', ['fetch'])
           if (!(await hasMergeBase())) {
             noMergeBase = true
           }
@@ -157,7 +123,7 @@ export async function getChangesSinceMergeBase(base: string, head: string, initi
   core.startGroup(`Change detection ${diffArg}`)
   let output = ''
   try {
-    output = (await gitExec(['diff', '--no-renames', '--name-status', '-z', diffArg])).stdout
+    output = (await getExecOutput('git', ['diff', '--no-renames', '--name-status', '-z', diffArg])).stdout
   } finally {
     fixStdOutNullTermination()
     core.endGroup()
@@ -182,7 +148,7 @@ export async function listAllFilesAsAdded(): Promise<File[]> {
   core.startGroup('Listing all files tracked by git')
   let output = ''
   try {
-    output = (await gitExec(['ls-files', '-z'])).stdout
+    output = (await getExecOutput('git', ['ls-files', '-z'])).stdout
   } finally {
     fixStdOutNullTermination()
     core.endGroup()
@@ -200,17 +166,17 @@ export async function listAllFilesAsAdded(): Promise<File[]> {
 export async function getCurrentRef(): Promise<string> {
   core.startGroup(`Get current git ref`)
   try {
-    const branch = (await gitExec(['rev-parse', '--abbrev-ref', 'HEAD'])).stdout.trim()
+    const branch = (await getExecOutput('git', ['rev-parse', '--abbrev-ref', 'HEAD'])).stdout.trim()
     if (branch && branch !== 'HEAD') {
       return branch
     }
 
-    const describe = await gitExec(['describe', '--tags', '--exact-match'], {ignoreReturnCode: true})
+    const describe = await getExecOutput('git', ['describe', '--tags', '--exact-match'], {ignoreReturnCode: true})
     if (describe.exitCode === 0) {
       return describe.stdout.trim()
     }
 
-    return (await gitExec(['rev-parse', HEAD])).stdout.trim()
+    return (await getExecOutput('git', ['rev-parse', HEAD])).stdout.trim()
   } finally {
     core.endGroup()
   }
@@ -233,11 +199,11 @@ export function isGitSha(ref: string): boolean {
 }
 
 async function hasCommit(ref: string): Promise<boolean> {
-  return (await gitExec(['cat-file', '-e', `${ref}^{commit}`], {ignoreReturnCode: true})).exitCode === 0
+  return (await getExecOutput('git', ['cat-file', '-e', `${ref}^{commit}`], {ignoreReturnCode: true})).exitCode === 0
 }
 
 async function getCommitCount(): Promise<number> {
-  const output = (await gitExec(['rev-list', '--count', '--all'])).stdout
+  const output = (await getExecOutput('git', ['rev-list', '--count', '--all'])).stdout
   const count = parseInt(output)
   return isNaN(count) ? 0 : count
 }
@@ -247,7 +213,7 @@ async function getLocalRef(shortName: string): Promise<string | undefined> {
     return (await hasCommit(shortName)) ? shortName : undefined
   }
 
-  const output = (await gitExec(['show-ref', shortName], {ignoreReturnCode: true})).stdout
+  const output = (await getExecOutput('git', ['show-ref', shortName], {ignoreReturnCode: true})).stdout
   const refs = output
     .split(/\r?\n/g)
     .map(l => l.match(/refs\/(?:(?:heads)|(?:tags)|(?:remotes\/origin))\/(.*)$/))
@@ -271,10 +237,10 @@ async function ensureRefAvailable(name: string): Promise<string> {
   try {
     let ref = await getLocalRef(name)
     if (ref === undefined) {
-      await gitExec(['fetch', '--depth=1', '--no-tags', 'origin', name])
+      await getExecOutput('git', ['fetch', '--depth=1', '--no-tags', 'origin', name])
       ref = await getLocalRef(name)
       if (ref === undefined) {
-        await gitExec(['fetch', '--depth=1', '--tags', 'origin', name])
+        await getExecOutput('git', ['fetch', '--depth=1', '--tags', 'origin', name])
         ref = await getLocalRef(name)
         if (ref === undefined) {
           throw new Error(`Could not determine what is ${name} - fetch works but it's not a branch, tag or commit SHA`)

src/main.ts

@@ -1,7 +1,6 @@
 import * as fs from 'fs'
 import * as core from '@actions/core'
 import * as github from '@actions/github'
-import {retry} from '@octokit/plugin-retry'
 import {GetResponseDataTypeFromEndpointMethod} from '@octokit/types'
 import {MergeGroupEvent, PullRequest, PushEvent} from '@octokit/webhooks-types'
 
@@ -15,7 +14,6 @@ import {
 } from './filter'
 import {File, ChangeStatus} from './file'
 import * as git from './git'
-import {cleanup as cleanupSafeDirectory} from './safe-directory'
 import {backslashEscape, shellEscape} from './list-format/shell-escape'
 import {csvEscape} from './list-format/csv-escape'
 
@@ -36,6 +34,7 @@ async function run(): Promise<void> {
     const listFiles = core.getInput('list-files', {required: false}).toLowerCase() || 'none'
     const initialFetchDepth = parseInt(core.getInput('initial-fetch-depth', {required: false})) || 10
     const predicateQuantifier = core.getInput('predicate-quantifier', {required: false}) || PredicateQuantifier.SOME
+    const allowOverrideOnPr = core.getBooleanInput('allow-override-on-pr', {required: false})
 
     if (!isExportFormat(listFiles)) {
       core.setFailed(`Input parameter 'list-files' is set to invalid value '${listFiles}'`)
@@ -51,14 +50,12 @@ async function run(): Promise<void> {
     const filterConfig: FilterConfig = {predicateQuantifier}
 
     const filter = new Filter(filtersYaml, filterConfig)
-    const files = await getChangedFiles(token, base, ref, initialFetchDepth)
+    const files = await getChangedFiles(token, base, ref, initialFetchDepth, allowOverrideOnPr)
     core.info(`Detected ${files.length} changed files`)
     const results = filter.match(files)
     exportResults(results, listFiles)
   } catch (error) {
     core.setFailed(getErrorMessage(error))
-  } finally {
-    await cleanupSafeDirectory()
   }
 }
 
@@ -78,7 +75,13 @@ function getConfigFileContent(configPath: string): string {
   return fs.readFileSync(configPath, {encoding: 'utf8'})
 }
 
-async function getChangedFiles(token: string, base: string, ref: string, initialFetchDepth: number): Promise<File[]> {
+async function getChangedFiles(
+  token: string,
+  base: string,
+  ref: string,
+  initialFetchDepth: number,
+  allowOverrideOnPr: boolean
+): Promise<File[]> {
   // if base is 'HEAD' only local uncommitted changes will be detected
   // This is the simplest case as we don't need to fetch more commits or evaluate current/before refs
   if (base === git.HEAD) {
@@ -95,16 +98,18 @@ async function getChangedFiles(token: string, base: string, ref: string, initial
     case 'pull_request_review':
     case 'pull_request_review_comment':
     case 'pull_request_target': {
+      if (allowOverrideOnPr && (base || ref)) {
+        core.info(`'allow-override-on-pr' is enabled and base/ref were provided — skipping PR API and using git diff`)
+        return getChangedFilesFromGit(base, ref, initialFetchDepth)
+      }
       if (ref) {
         core.warning(`'ref' input parameter is ignored when action is triggered by pull request event`)
       }
+      if (base) {
+        core.warning(`'base' input parameter is ignored when action is triggered by pull request event`)
+      }
       const pr = github.context.payload.pull_request as PullRequest
       if (token) {
-        if (base) {
-          core.warning(
-            `'base' input parameter is ignored when action is triggered by pull request event and 'token' is provided - set token: '' to detect changes using git diff against 'base'`
-          )
-        }
         return await getChangedFilesFromApi(token, pr)
       }
       if (github.context.eventName === 'pull_request_target') {
@@ -114,9 +119,6 @@ async function getChangedFiles(token: string, base: string, ref: string, initial
         throw new Error(`'token' input parameter is required if action is triggered by 'pull_request_target' event`)
       }
       core.info('GitHub token is not available - changes will be detected using git diff')
-      if (base) {
-        core.info(`Using base '${base}' instead of the pull request base`)
-      }
       const baseSha = github.context.payload.pull_request?.base.sha
       const defaultBranch = github.context.payload.repository?.default_branch
       const currentRef = await git.getCurrentRef()
@@ -205,7 +207,7 @@ async function getChangedFilesFromGit(base: string, head: string, initialFetchDe
 async function getChangedFilesFromApi(token: string, pullRequest: PullRequest): Promise<File[]> {
   core.startGroup(`Fetching list of changed files for PR#${pullRequest.number} from GitHub API`)
   try {
-    const client = github.getOctokit(token, undefined, retry)
+    const client = github.getOctokit(token)
     const per_page = 100
     const files: File[] = []
 

src/safe-directory.ts

@@ -1,135 +0,0 @@
-import * as fs from 'fs'
-import * as os from 'os'
-import * as path from 'path'
-import * as core from '@actions/core'
-import {exec} from '@actions/exec'
-
-// Git >= 2.35.2 and distro backports of CVE-2022-24765 fail with exit code 128 when
-// the repository is owned by a different user - typical for container jobs where the
-// workspace is bind-mounted from the host. Older backports use the "unsafe repository" wording.
-const DUBIOUS_OWNERSHIP_PATTERN = /detected dubious ownership|unsafe repository/
-const REPOSITORY_PATH_PATTERN = /(?:repository at|unsafe repository \()\s*'([^']+)'/
-
-let tempHomeDir: string | undefined
-let gitEnv: {[key: string]: string} | undefined
-const safeDirectories = new Set<string>()
-
-export function isDubiousOwnershipError(exitCode: number, stderr: string): boolean {
-  return exitCode === 128 && DUBIOUS_OWNERSHIP_PATTERN.test(stderr)
-}
-
-export function parseRepositoryPath(stderr: string): string | undefined {
-  return stderr.match(REPOSITORY_PATH_PATTERN)?.[1]
-}
-
-// Until the workaround is activated this mirrors process.env; afterwards it applies the
-// temporary HOME redirect. In both cases LC_ALL=C is forced so git emits untranslated
-// messages and isDubiousOwnershipError / parseRepositoryPath match regardless of the
-// container's locale.
-export function getGitEnv(): {[key: string]: string} {
-  return {...(gitEnv ?? cloneDefinedEnv(process.env)), LC_ALL: 'C'}
-}
-
-// Marks directories reported by git as safe, using a temporary HOME so no configuration
-// outside this action is modified - same technique as actions/checkout.
-// Returns false if there was no new directory to add.
-export async function ensureSafeDirectory(stderr: string): Promise<boolean> {
-  if (tempHomeDir === undefined) {
-    tempHomeDir = await createTempGitHome(resolveTempBaseDir(process.env), process.env)
-    gitEnv = buildGitEnv(tempHomeDir, process.env)
-    core.info(
-      'Git reported dubious ownership of the repository - this is typical for container jobs ' +
-        'where the workspace is owned by a different user. A temporary HOME with a copy of the global ' +
-        'git config and a safe.directory exception will be used for git commands executed by this action.'
-    )
-  }
-
-  let added = false
-  for (const dir of [parseRepositoryPath(stderr), process.env.GITHUB_WORKSPACE, process.cwd()]) {
-    if (dir && !safeDirectories.has(dir)) {
-      await exec('git', ['config', '--global', '--add', 'safe.directory', dir], {env: getGitEnv()})
-      safeDirectories.add(dir)
-      added = true
-    }
-  }
-  return added
-}
-
-export async function cleanup(): Promise<void> {
-  if (tempHomeDir !== undefined) {
-    try {
-      await fs.promises.rm(tempHomeDir, {recursive: true, force: true})
-    } catch (error) {
-      // Cleanup failure is not fatal - RUNNER_TEMP is wiped when the job ends
-    }
-  }
-  tempHomeDir = undefined
-  gitEnv = undefined
-  safeDirectories.clear()
-}
-
-// Exported for tests
-export async function createTempGitHome(
-  baseTempDir: string,
-  env: {[key: string]: string | undefined}
-): Promise<string> {
-  const tempHome = await fs.promises.mkdtemp(path.join(baseTempDir, 'paths-filter-git-home-'))
-  const tempConfigPath = path.join(tempHome, '.gitconfig')
-  // The file must exist even when there is no config to copy - when $HOME/.gitconfig is missing,
-  // `git config --global` writes to an existing $XDG_CONFIG_HOME/git/config instead
-  await fs.promises.writeFile(tempConfigPath, '')
-
-  if (env.GIT_CONFIG_GLOBAL) {
-    await copyFileIfExists(env.GIT_CONFIG_GLOBAL, tempConfigPath)
-  } else if (env.HOME) {
-    await copyFileIfExists(path.join(env.HOME, '.gitconfig'), tempConfigPath)
-    if (!env.XDG_CONFIG_HOME) {
-      // When XDG_CONFIG_HOME is unset, git falls back to $HOME/.config/git/config,
-      // which would become unreadable under the new HOME
-      await copyFileIfExists(
-        path.join(env.HOME, '.config', 'git', 'config'),
-        path.join(tempHome, '.config', 'git', 'config')
-      )
-    }
-  }
-
-  return tempHome
-}
-
-// Exported for tests
-export function buildGitEnv(tempHome: string, env: {[key: string]: string | undefined}): {[key: string]: string} {
-  const newEnv = cloneDefinedEnv(env)
-  // A changed HOME redirects git of any version to the temp config. GIT_CONFIG_GLOBAL is redirected
-  // only when already set - on git >= 2.32 it replaces both global config files, so setting it
-  // unconditionally would hide an existing $XDG_CONFIG_HOME/git/config from git
-  newEnv['HOME'] = tempHome
-  if (env.GIT_CONFIG_GLOBAL) {
-    newEnv['GIT_CONFIG_GLOBAL'] = path.join(tempHome, '.gitconfig')
-  }
-  return newEnv
-}
-
-// Exported for tests
-export function resolveTempBaseDir(env: {[key: string]: string | undefined}): string {
-  return env.RUNNER_TEMP || os.tmpdir()
-}
-
-function cloneDefinedEnv(env: {[key: string]: string | undefined}): {[key: string]: string} {
-  const newEnv: {[key: string]: string} = {}
-  for (const [key, value] of Object.entries(env)) {
-    if (value !== undefined) {
-      newEnv[key] = value
-    }
-  }
-  return newEnv
-}
-
-async function copyFileIfExists(source: string, destination: string): Promise<void> {
-  try {
-    await fs.promises.access(source, fs.constants.R_OK)
-  } catch (error) {
-    return
-  }
-  await fs.promises.mkdir(path.dirname(destination), {recursive: true})
-  await fs.promises.copyFile(source, destination)
-}