fix: bug retrieving diff when persist credentials is false

.github/workflows/test.yml

@@ -343,6 +343,39 @@ jobs:
         shell:
           bash
 
+  test-pull-request-without-persist-credentials:
+    name: Test changed-files with pull request without persist credentials
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.event_name != 'push'
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        fetch-depth: [1, 2, 0]
+
+    steps:
+      - name: Checkout to branch
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: ${{ matrix.fetch-depth }}
+          persist-credentials: false
+
+      - name: Download build assets
+        uses: actions/download-artifact@v3
+        with:
+          name: build-assets
+
+      - name: Run changed-files
+        id: changed-files
+        uses: ./
+
+      - name: Show output
+        run: |
+          echo '${{ toJSON(steps.changed-files.outputs) }}'
+        shell:
+          bash
+
   test-non-existent-base-sha:
     name: Test changed-files non existent base sha
     runs-on: ubuntu-latest

src/commitSha.ts

@@ -7,10 +7,10 @@ import {
   getHeadSha,
   getParentSha,
   getPreviousGitTag,
+  getRemoteBranchHeadSha,
   gitFetch,
   gitFetchSubmodules,
   gitLog,
-  gitLsRemote,
   verifyCommitSha
 } from './utils'
 
@@ -261,7 +261,7 @@ export const getSHAForPullRequestEvent = async (
   if (isShallow) {
     core.info('Repository is shallow, fetching more history...')
 
-    const prFetchExitCode = await gitFetch({
+    let prFetchExitCode = await gitFetch({
       cwd: workingDirectory,
       args: [
         ...gitExtraArgs,
@@ -273,7 +273,7 @@ export const getSHAForPullRequestEvent = async (
     })
 
     if (prFetchExitCode !== 0) {
-      await gitFetch({
+      prFetchExitCode = await gitFetch({
         cwd: workingDirectory,
         args: [
           ...gitExtraArgs,
@@ -286,6 +286,12 @@ export const getSHAForPullRequestEvent = async (
       })
     }
 
+    if (prFetchExitCode !== 0) {
+      throw new Error(
+        'Failed to fetch pull request branch. Please ensure "persist-credentials" is set to "true" when checking out the repository. See: https://github.com/actions/checkout#usage'
+      )
+    }
+
     if (!inputs.sinceLastRemoteCommit) {
       core.debug('Fetching target branch...')
       await gitFetch({
@@ -354,9 +360,9 @@ export const getSHAForPullRequestEvent = async (
       previousSha = env.GITHUB_EVENT_BEFORE
 
       if (!previousSha) {
-        previousSha = await gitLsRemote({
+        previousSha = await getRemoteBranchHeadSha({
           cwd: workingDirectory,
-          args: [currentBranch]
+          branch: currentBranch
         })
       }
 
@@ -370,9 +376,9 @@ export const getSHAForPullRequestEvent = async (
         previousSha = env.GITHUB_EVENT_PULL_REQUEST_BASE_SHA
       }
     } else {
-      previousSha = await gitLsRemote({
+      previousSha = await getRemoteBranchHeadSha({
         cwd: workingDirectory,
-        args: [targetBranch]
+        branch: targetBranch
       })
 
       if (!previousSha) {

src/utils.ts

@@ -501,28 +501,23 @@ export const getHeadSha = async ({cwd}: {cwd: string}): Promise<string> => {
   return stdout.trim()
 }
 
-export const gitLsRemote = async ({
+export const getRemoteBranchHeadSha = async ({
   cwd,
-  args
+  branch
 }: {
   cwd: string
-  args: string[]
+  branch: string
 }): Promise<string> => {
   const {stdout} = await exec.getExecOutput(
     'git',
-    ['ls-remote', 'origin', ...args],
+    ['rev-parse', `refs/remotes/origin/${branch}`],
     {
       cwd,
       silent: process.env.RUNNER_DEBUG !== '1'
     }
   )
-  const output = stdout.trim().split('\t')
-
-  if (output.length === 0) {
-    throw new Error('No output returned from git ls-remote')
-  }
 
-  return output[0]
+  return stdout.trim()
 }
 
 export const getParentSha = async ({cwd}: {cwd: string}): Promise<string> => {