Copilot · Sep 24, 2026 · Sep 24, 2026 · Sep 24, 2026 · Sep 24, 2026 · Sep 24, 2026
diff --git a/actions/setup/js/build_checkout_manifest.cjs b/actions/setup/js/build_checkout_manifest.cjs
@@ -122,7 +122,17 @@ function buildCheckoutManifest(entries, options = {}) {
     throw new Error(`Failed to create directory ${manifestDir}: ${getErrorMessage(err)}`, { cause: err });
   }
   const manifestPath = path.join(manifestDir, "checkout-manifest.json");
-  const manifest = {};
+  let manifest = {};
+  try {
+    if (fs.existsSync(manifestPath)) {
+      const existing = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+      if (existing && typeof existing === "object" && !Array.isArray(existing)) {
+        manifest = existing;
+      }
+    }
+  } catch (error) {
+    core.debug(`checkout-manifest: ignoring unreadable existing manifest: ${getErrorMessage(error)}`);
+  }
   core.info(`checkout-manifest: building manifest for ${entries.length} checkout entries`);
 
   for (const entry of entries) {

diff --git a/actions/setup/js/build_checkout_manifest.test.cjs b/actions/setup/js/build_checkout_manifest.test.cjs
@@ -157,4 +157,22 @@ describe("build_checkout_manifest.cjs", () => {
     const fileContents = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
     expect(fileContents).toEqual(manifest);
   });
+
+  it("preserves dynamic entries already written to the manifest", () => {
+    const workspace = createTempDir("checkout-manifest-workspace-");
+    const runnerTemp = createTempDir("checkout-manifest-runner-temp-");
+    tempDirs.push(workspace, runnerTemp);
+    const manifestDir = path.join(runnerTemp, "gh-aw", "safeoutputs");
+    fs.mkdirSync(manifestDir, { recursive: true });
+    fs.writeFileSync(path.join(manifestDir, "checkout-manifest.json"), JSON.stringify({ "owner/dynamic": { repository: "owner/dynamic", path: "dynamic", default_branch: "main" } }));
+
+    const { manifest } = buildCheckoutManifest([{ repository: "owner/static", path: "static" }], {
+      workspace,
+      runnerTemp,
+      runGH: () => "main\n",
+    });
+
+    expect(manifest).toHaveProperty("owner/dynamic");
+    expect(manifest).toHaveProperty("owner/static");
+  });
 });
diff --git a/actions/setup/js/dynamic_checkouts.cjs b/actions/setup/js/dynamic_checkouts.cjs
@@ -0,0 +1,251 @@
+// @ts-check
+/// <reference types="@actions/github-script" />
+
+require("./shim.cjs");
+
+const fs = require("fs");
+const path = require("path");
+const { getErrorMessage } = require("./error_helpers.cjs");
+
+const supportedFields = new Set(["repository", "ref", "path", "github-token", "token", "fetch-depth", "sparse-checkout", "submodules", "lfs", "wiki"]);
+
+function parseDynamicCheckouts(value = process.env.GH_AW_DYNAMIC_CHECKOUTS || "") {
+  if (!value.trim()) {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch (error) {
+    throw new Error(`checkout expression must resolve to a JSON object or array: ${getErrorMessage(error)}`, { cause: error });
+  }
+  const entries = Array.isArray(parsed) ? parsed : [parsed];
+  if (entries.some(entry => !entry || typeof entry !== "object" || Array.isArray(entry))) {
+    throw new Error("checkout expression must resolve to a checkout object or an array of checkout objects");
+  }
+  return entries;
+}
+
+function normalizeCheckout(entry, workspace) {
+  for (const field of Object.keys(entry)) {
+    if (!supportedFields.has(field)) {
+      throw new Error(`dynamic checkout field '${field}' is not supported`);
+    }
+  }
+
+  let repository = String(entry.repository || "").trim();
+  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository)) {
+    throw new Error(`dynamic checkout repository must use owner/repo format, got '${repository}'`);
+  }
+  if (entry.lfs !== undefined && typeof entry.lfs !== "boolean") {
+    throw new Error("dynamic checkout lfs must be a boolean");
+  }
+  if (entry.wiki !== undefined && typeof entry.wiki !== "boolean") {
+    throw new Error("dynamic checkout wiki must be a boolean");
+  }
+
+  let checkoutPath = entry.path === undefined ? repository.split("/")[1] : String(entry.path).trim();
+  checkoutPath = checkoutPath.replaceAll("\\", "/").replace(/^\.\//, "");
+  if (!checkoutPath || path.isAbsolute(checkoutPath) || checkoutPath.split("/").includes("..")) {
+    throw new Error(`dynamic checkout path must be a non-empty relative path under the workspace, got '${checkoutPath}'`);
+  }
+
+  const fetchDepth = entry["fetch-depth"] === undefined ? 1 : Number(entry["fetch-depth"]);
+  if (!Number.isInteger(fetchDepth) || fetchDepth < 0) {
+    throw new Error("dynamic checkout fetch-depth must be a non-negative integer");
+  }
+  if (entry.submodules !== undefined && !["true", "false", "recursive", true, false].includes(entry.submodules)) {
+    throw new Error("dynamic checkout submodules must be true, false, or recursive");
+  }
+
+  if (entry.wiki === true) {
+    repository += ".wiki";
+  }
+  return {
+    repository,
+    ref: String(entry.ref || "").trim(),
+    path: checkoutPath,
+    token: String(entry["github-token"] || entry.token || ""),
+    fetchDepth,
+    sparseCheckout: String(entry["sparse-checkout"] || ""),
+    submodules: entry.submodules,
+    lfs: entry.lfs === true,
+  };
+}
+
+async function defaultRunGit(args, options = {}) {
+  const result = await exec.getExecOutput("git", args, { silent: true, ...options });
+  if (result.exitCode !== 0) {
+    throw new Error("git command failed while preparing a dynamic checkout");
+  }
+  return result.stdout.trim();
+}
+
+function credentialArgs(serverURL, token, maskSecret = value => core.setSecret(value)) {
+  if (!token) {
+    return [];
+  }
+  maskSecret(token);
+  const encoded = Buffer.from(`x-access-token:${token}`).toString("base64");
+  maskSecret(encoded);
+  return ["-c", `http.${serverURL}/.extraheader=AUTHORIZATION: basic ${encoded}`];
+}
+
+async function checkoutRepository(checkout, options = {}) {
+  const workspace = options.workspace || process.env.GITHUB_WORKSPACE || "";
+  const serverURL = (options.serverURL || process.env.GITHUB_SERVER_URL || "https://github.com").replace(/\/+$/, "");
+  const token = checkout.token || options.overrideToken || process.env.GH_TOKEN || "";
+  const persistCredentials = options.persistCredentials === true;
+  const runGit = options.runGit || defaultRunGit;
+
+  let workspaceReal;
+  let checkoutTarget;
+  try {
+    workspaceReal = fs.realpathSync(workspace);
+    checkoutTarget = path.join(workspaceReal, checkout.path);
+    if (fs.existsSync(checkoutTarget)) {
+      throw new Error(`dynamic checkout path already exists: ${checkout.path}`);
+    }
+
+    let parent = workspaceReal;
+    const parentSegments = path
+      .dirname(checkout.path)
+      .split(path.sep)
+      .filter(segment => segment && segment !== ".");
+    for (const segment of parentSegments) {
+      const candidate = path.join(parent, segment);
+      if (fs.existsSync(candidate)) {
+        if (fs.lstatSync(candidate).isSymbolicLink()) {
+          throw new Error(`dynamic checkout path traverses a symbolic link: ${checkout.path}`);
+        }
+      } else {
+        fs.mkdirSync(candidate);
+      }
+      parent = fs.realpathSync(candidate);
+      if (parent !== workspaceReal && !parent.startsWith(workspaceReal + path.sep)) {
+        throw new Error(`dynamic checkout path escapes the workspace: ${checkout.path}`);
+      }
+    }
+  } catch (error) {
+    throw new Error(`failed to prepare dynamic checkout path '${checkout.path}': ${getErrorMessage(error)}`, { cause: error });
+  }
+
+  const authArgs = credentialArgs(serverURL, token, options.maskSecret);
+  const cloneArgs = [...authArgs, "clone", "--no-tags"];
+  if (checkout.fetchDepth > 0) {
+    cloneArgs.push("--depth", String(checkout.fetchDepth));
+  }
+  cloneArgs.push(`${serverURL}/${checkout.repository}.git`, checkoutTarget);
+
+  core.info(`Checking out ${checkout.repository} into ${checkout.path}`);
+  await runGit(cloneArgs);
+  if (checkout.ref) {
+    const fetchArgs = [...authArgs, "-C", checkoutTarget, "fetch", "--no-tags"];
+    if (checkout.fetchDepth > 0) {
+      fetchArgs.push("--depth", String(checkout.fetchDepth));
+    }
+    fetchArgs.push("origin", checkout.ref);
+    await runGit(fetchArgs);
+    await runGit(["-C", checkoutTarget, "checkout", "--force", "FETCH_HEAD"]);
+  }
+
+  if (checkout.sparseCheckout.trim()) {
+    const patterns = checkout.sparseCheckout
+      .split(/\r?\n/)
+      .map(pattern => pattern.trim())
+      .filter(Boolean);
+    await runGit(["-C", checkoutTarget, "sparse-checkout", "set", "--no-cone", ...patterns]);
+  }
+  if (checkout.submodules === true || checkout.submodules === "true" || checkout.submodules === "recursive") {
+    const args = [...authArgs, "-C", checkoutTarget, "submodule", "update", "--init"];
+    if (checkout.submodules === "recursive") {
+      args.push("--recursive");
+    }
+    await runGit(args);
+  }
+  if (checkout.lfs) {
+    await runGit([...authArgs, "-C", checkoutTarget, "lfs", "pull"]);
+  }
+
+  const credentialKey = `http.${serverURL}/.extraheader`;
+  if (persistCredentials && token) {
+    const encoded = Buffer.from(`x-access-token:${token}`).toString("base64");
+    await runGit(["-C", checkoutTarget, "config", credentialKey, `AUTHORIZATION: basic ${encoded}`]);
+  } else {
+    try {
+      await runGit(["-C", checkoutTarget, "config", "--unset-all", credentialKey]);
+    } catch (error) {
+      core.debug(`No persisted credential needed removal: ${getErrorMessage(error)}`);
+    }
+  }
+
+  let defaultBranch = "";
+  try {
+    defaultBranch = (await runGit(["-C", checkoutTarget, "symbolic-ref", "--short", "refs/remotes/origin/HEAD"])).replace(/^origin\//, "");
+  } catch (error) {
+    core.debug(`Could not resolve dynamic checkout default branch: ${getErrorMessage(error)}`);
+  }
+  return {
+    repository: checkout.repository,
+    path: checkout.path,
+    default_branch: defaultBranch,
+  };
+}
+
+function writeManifest(entries, runnerTemp = process.env.RUNNER_TEMP || "") {
+  if (!runnerTemp) {
+    throw new Error("RUNNER_TEMP is required for dynamic checkouts");
+  }
+  const manifestDir = path.join(runnerTemp, "gh-aw", "safeoutputs");
+  const manifestPath = path.join(manifestDir, "checkout-manifest.json");
+  let manifest = {};
+  try {
+    fs.mkdirSync(manifestDir, { recursive: true });
+    if (fs.existsSync(manifestPath)) {
+      manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+    }
+    for (const entry of entries) {
+      manifest[entry.repository.toLowerCase()] = entry;
+    }
+    fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf8");
+  } catch (error) {
+    throw new Error(`failed to write dynamic checkout manifest: ${getErrorMessage(error)}`, { cause: error });
+  }
+  return manifestPath;
+}
+
+async function main(options = {}) {
+  const workspace = options.workspace || process.env.GITHUB_WORKSPACE || "";
+  if (!workspace) {
+    throw new Error("GITHUB_WORKSPACE is required for dynamic checkouts");
+  }
+  const checkouts = parseDynamicCheckouts(options.value);
+  const normalized = checkouts.map(entry => normalizeCheckout(entry, workspace));
+  if (new Set(normalized.map(entry => entry.path.toLowerCase())).size !== normalized.length) {
+    throw new Error("dynamic checkout paths must be unique");
+  }
+
+  const persistCredentials = options.persistCredentials ?? process.env.GH_AW_DYNAMIC_CHECKOUT_PERSIST_CREDENTIALS === "true";
+  const overrideToken = options.overrideToken ?? process.env.GH_AW_DYNAMIC_CHECKOUT_TOKEN ?? "";
+  const manifestEntries = [];
+  for (const checkout of normalized) {
+    manifestEntries.push(
+      await checkoutRepository(checkout, {
+        ...options,
+        workspace,
+        persistCredentials,
+        overrideToken,
+      })
+    );
+  }
+  writeManifest(manifestEntries, options.runnerTemp);
+  return manifestEntries;
+}
+
+module.exports = {
+  checkoutRepository,
+  main,
+  normalizeCheckout,
+  parseDynamicCheckouts,
+  writeManifest,
+};
diff --git a/actions/setup/js/dynamic_checkouts.test.cjs b/actions/setup/js/dynamic_checkouts.test.cjs
@@ -0,0 +1,94 @@
+// @ts-check
+
+import { describe, expect, it } from "vitest";
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+const { checkoutRepository, normalizeCheckout, parseDynamicCheckouts, writeManifest } = require("./dynamic_checkouts.cjs");
+
+describe("parseDynamicCheckouts", () => {
+  it("accepts one object or an array", () => {
+    expect(parseDynamicCheckouts('{"repository":"owner/repo"}')).toHaveLength(1);
+    expect(parseDynamicCheckouts('[{"repository":"owner/a"},{"repository":"owner/b"}]')).toHaveLength(2);
+  });
+
+  it("rejects scalar results", () => {
+    expect(() => parseDynamicCheckouts('"owner/repo"')).toThrow("checkout object or an array");
+  });
+});
+
+describe("normalizeCheckout", () => {
+  it("derives a safe path and defaults to a shallow checkout", () => {
+    const checkout = normalizeCheckout({ repository: "owner/repo" }, "/workspace");
+    expect(checkout.path).toBe("repo");
+    expect(checkout.fetchDepth).toBe(1);
+  });
+
+  it("rejects traversal and unsupported fields", () => {
+    expect(() => normalizeCheckout({ repository: "owner/repo", path: "../repo" }, "/workspace")).toThrow("relative path");
+    expect(() => normalizeCheckout({ repository: "owner/repo", fetch: ["main"] }, "/workspace")).toThrow("field 'fetch' is not supported");
+    expect(() => normalizeCheckout({ repository: "owner/repo", current: true }, "/workspace")).toThrow("field 'current' is not supported");
+  });
+});
+
+describe("checkoutRepository", () => {
+  it("uses an ephemeral credential and leaves no credential when persistence is disabled", async () => {
+    const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "dynamic-checkout-"));
+    const "repo");
+    const calls = [];
+    const runGit = async args => {
+      calls.push(args);
+      if (args.includes("clone")) {
+        fs.mkdirSync(path.join(target, ".git"), { recursive: true });
+      }
+      if (args.includes("symbolic-ref")) {
+        return "origin/main";
+      }
+      return "";
+    };
+
+    const checkout = normalizeCheckout({ repository: "owner/repo", "github-token": "secret" }, workspace);
+    const result = await checkoutRepository(checkout, {
+      workspace,
+      runGit,
+      serverURL: "https://github.com",
+      overrideToken: "fallback-token",
+      maskSecret: () => {},
+    });
+
+    expect(result.default_branch).toBe("main");
+    expect(calls[0]).toContain("http.https://github.com/.extraheader=AUTHORIZATION: basic eC1hY2Nlc3MtdG9rZW46c2VjcmV0");
+    expect(calls.some(args => args.includes("--unset-all"))).toBe(true);
+  });
+
+  it("rejects a symlinked parent before creating directories outside the workspace", async () => {
+    const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "dynamic-checkout-workspace-"));
+    const outside = fs.mkdtempSync(path.join(os.tmpdir(), "dynamic-checkout-outside-"));
+    fs.symlinkSync(outside, path.join(workspace, "linked"));
+    const checkout = normalizeCheckout({ repository: "owner/repo", path: "linked/nested/repo" }, workspace);
+
+    await expect(
+      checkoutRepository(checkout, {
+        workspace,
+        runGit: async () => "",
+        maskSecret: () => {},
+      })
+    ).rejects.toThrow("traverses a symbolic link");
+    expect(fs.existsSync(path.join(outside, "nested"))).toBe(false);
+  });
+});
+
+describe("writeManifest", () => {
+  it("merges dynamic entries into an existing manifest", () => {
+    const runnerTemp = fs.mkdtempSync(path.join(os.tmpdir(), "dynamic-manifest-"));
+    const manifestDir = path.join(runnerTemp, "gh-aw", "safeoutputs");
+    fs.mkdirSync(manifestDir, { recursive: true });
+    fs.writeFileSync(path.join(manifestDir, "checkout-manifest.json"), JSON.stringify({ "owner/static": { repository: "owner/static", path: "static" } }));
+
+    const manifestPath = writeManifest([{ repository: "owner/dynamic", path: "dynamic", default_branch: "main" }], runnerTemp);
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+    expect(manifest).toHaveProperty("owner/static");
+    expect(manifest).toHaveProperty("owner/dynamic");
+  });
+});