chore(deps): update actions/checkout action to v4

[renovate[bot]]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v3.6.0 -> v4.1.7

---

Release Notes

actions/checkout (actions/checkout)

v4.1.7

Compare Source

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in https://github.com/actions/checkout/pull/1739
• Bump actions/checkout from 3 to 4 by @​dependabot in https://github.com/actions/checkout/pull/1697
• Check out other refs/* by commit by @​orhantoy in https://github.com/actions/checkout/pull/1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in https://github.com/actions/checkout/pull/1776

v4.1.6

Compare Source

• Check platform to set archive extension appropriately by @​cory-miller in https://github.com/actions/checkout/pull/1732

v4.1.5

Compare Source

What's Changed

• Update NPM dependencies by @​cory-miller in https://github.com/actions/checkout/pull/1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in https://github.com/actions/checkout/pull/1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in https://github.com/actions/checkout/pull/1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in https://github.com/actions/checkout/pull/1695
• README: Suggest user.email to be 41898282+github-actions[bot]@​users.noreply.github.com by @​cory-miller in https://github.com/actions/checkout/pull/1707

Full Changelog: https://github.com/actions/checkout/compare/v4.1.4...v4.1.5

v4.1.4

Compare Source

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1692
• Add dependabot config by @​cory-miller in https://github.com/actions/checkout/pull/1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in https://github.com/actions/checkout/pull/1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in https://github.com/actions/checkout/pull/1643

v4.1.3

Compare Source

What's Changed

• Update actions/checkout version in update-main-version.yml by @​jww3 in https://github.com/actions/checkout/pull/1650
• Check git version before attempting to disable sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1656
• Add SSH user parameter by @​cory-miller in https://github.com/actions/checkout/pull/1685

Full Changelog: https://github.com/actions/checkout/compare/v4.1.2...v4.1.3

v4.1.2

Compare Source

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in https://github.com/actions/checkout/pull/1598

v4.1.1

Compare Source

What's Changed

• Update CODEOWNERS to Launch team by @​joshmgross in https://github.com/actions/checkout/pull/1510
• Correct link to GitHub Docs by @​peterbe in https://github.com/actions/checkout/pull/1511
• Link to release page from what's new section by @​cory-miller in https://github.com/actions/checkout/pull/1514

New Contributors

• @​joshmgross made their first contribution in https://github.com/actions/checkout/pull/1510
• @​peterbe made their first contribution in https://github.com/actions/checkout/pull/1511

Full Changelog: https://github.com/actions/checkout/compare/v4.1.0...v4.1.1

v4.1.0

Compare Source

• Add support for partial checkout filters

v4.0.0

Compare Source

• Support fetching without the --progress option
• Update to node20

---

Configuration

📅 Schedule: Branch creation - "* 0-4 * * 3" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• [ ] If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions[bot]]

[puLL-Merge] - actions/[email protected]

Here is my review of the PR:

Description

This PR makes several updates and improvements to the actions/checkout action:

• Bumps the major version to v4
• Updates to using node20 runtime
• Adds support for git partial clone filters
• Adds an option to specify the SSH user
• Allows disabling progress status output when fetching
• Fixes an issue with disabling sparse checkout
• Adds a new test container image and associated workflows
• Updates workflows, tests, docs and other minor changes

The motivation seems to be adding some new features, fixing bugs, and updating the runtime and dependencies.

Changes

Changes

• .github/dependabot.yml - Adds dependabot config for npm and GitHub Actions dependencies
• .github/workflows/check-dist.yml - Updates Node.js version to 20.x for the build job
• .github/workflows/test.yml - Updates Node.js to 20.x, bumps actions/checkout to v4.1.1, adds new test cases for fetch filter and disabled sparse checkout, updates test container image
• .github/workflows/update-main-version.yml - Adds v4 option for updating main version, pins to actions/[email protected]
• .github/workflows/update-test-ubuntu-git.yml - New workflow to publish test container image
• CHANGELOG.md - Adds changelog entries for v4.1.4, v4.1.3, v4.1.2, v4.1.1, v4.1.0, v4.0.0
• CODEOWNERS - Updates codeowners
• README.md - Updates to v4, adds docs for new options
• __test__/* - Updates tests for new functionality
• action.yml - Bumps to node20, adds new action inputs
• dist/index.js - Updates compiled JavaScript
• images/test-ubuntu-git.Dockerfile - New Dockerfile for test container
• images/test-ubuntu-git.md - Documentation for test container
• package.json - Bumps version to 4.1.4, updates @types/node
• src/* - TypeScript source changes for new features and fixes

Security Hotspots

1. Medium - The new ssh-user input allows specifying an arbitrary SSH username. Need to ensure this doesn't enable command injection or other misuse. Input should be validated.

2. Low - Several dependencies were bumped which could introduce new vulnerabilities. The diff doesn't show the exact versions bumped to so can't assess further. Dependabot should help keep things patched.

3. Low - New test container image and workflow has write permission to packages. Ensure the access token used has least privilege.

Overall the changes look good with useful additions and fixes. I would suggest a careful review of the new ssh-user handling and some more details on the dependency updates before merging. The test coverage also looks solid which is great to see for a new major version. Nice work!

Let me know if you have any other questions!