Checkout in a composite action is sparse (despite not specifying sparse) if calling workflow had checkout with sparse

[FFdhorkin]

There's a bug, either in documentation or in the checkout action, when you are using checkout in both a workflow and a composite action called by the workflow.

The behavior I was seeing does not appear to be documented anywhere. I believe either the readme should call out this behavior, or better, a warning should be emitted in the log. Or the behavior should change. Once I figured out what was happening, this was easy enough to work around, but this behavior seems to be undocumented.

One of the two things seems to be happening:

• if a parent workflow already has a checkout, it syncs the repo using the existing settings, regardless of what you provided (I believe this is what is happening)
• checkout performs a no-op if the destination folder already exists

Here's a simplified version of what I was doing (mostly was the result of converting a reusable workflow into a composite action):

Workflow file:

on:
    workflow_call:
        inputs:
            my_repo_name_tag:
                required: true
                type: string
jobs:
    my_job_name:
        name: Do stuff
        runs-on: my-runner-name
        steps:
        -   name: Checkout my_repo_name
            uses: actions/checkout@v4
            with:
                ref: ${{ inputs.my_repo_name_tag }}
                sparse-checkout: .github

        -   name: Call my composite action
            uses: ./.github/actions/my-composite-action
            with:
                my_repo_name_tag: ${{ inputs.my_repo_name_tag }}

Composite action:

inputs:
    my_repo_name_tag:
        required: true
            type: string
runs:
    using: "composite"
    steps:
    -   name: Checkout my_repo_name
        uses: actions/checkout@v4
        with:
            ref: ${{ inputs.my_repo_name_tag }}

    -   name: run ls (as test)
        shell: bash
        run: ls

The output of ls clearly was showing a sparse checkout, even though the call to the checkout action did not specify sparse.

The log from the composite action:

Run actions/checkout@v4
  with:
    ref: refs/pull/5/merge
    repository: my_repo_name
    token: ***
    ssh-strict: true
    persist-credentials: true
    clean: true
    sparse-checkout-cone-mode: true
    fetch-depth: 1
    fetch-tags: false
    show-progress: true
    lfs: false
    submodules: false
    set-safe-directory: true
Syncing repository: my_repo_name
Getting Git version info
  Working directory is '/runner/_work/my_repo_name/my_repo_name'
  /usr/bin/git version
  git version 2.42.0
Temporarily overriding HOME='/runner/_work/_temp/d46cee4c-cc0f-4254-9297-8aa1ca392ac3' before making global git config changes
Adding repository directory to the temporary git global config as a safe directory
/usr/bin/git config --global --add safe.directory /runner/_work/my_repo_name/my_repo_name
/usr/bin/git config --local --get remote.origin.url
https://github.com/myorg/my_repo_name
Removing previously created refs, to avoid conflicts
  /usr/bin/git rev-parse --symbolic-full-name --verify --quiet HEAD
  HEAD
/usr/bin/git submodule status
Cleaning the repository
  /usr/bin/git clean -ffdx
  /usr/bin/git reset --hard HEAD
  HEAD is now at 1003d24 Merge f47a4a64b131b70c2501785fe2ab9b36858b1c55 into 764f05bbfb30211ec106e95ae1d3405eda7e11ed
Disabling automatic garbage collection
  /usr/bin/git config --local gc.auto 0
Setting up auth
  /usr/bin/git config --local --name-only --get-regexp core\.sshCommand
  /usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
  /usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
  http.https://github.com/.extraheader
  /usr/bin/git config --local --unset-all http.https://github.com/.extraheader
  /usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
  /usr/bin/git config --local http.https://github.com/.extraheader AUTHORIZATION: basic ***
Fetching the repository
  /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +refs/pull/5/merge:refs/remotes/pull/5/merge
Determining the checkout info
Checking out the ref
  /usr/bin/git checkout --progress --force refs/remotes/pull/5/merge
  HEAD is now at 1003d24 Merge f47a4a64b131b70c2501785fe2ab9b36858b1c55 into 764f05bbfb30211ec106e95ae1d3405eda7e11ed
/usr/bin/git log -1 --format='%H'
'1003d24a5f12aa7326969b46dfa7f478d4b3a0c9'

The solution to fixing this was removing the 'sparse' from the parent workflow (and then optionally removing the checkout from the composite action).

[XavierGallart]

We have a similar scenario and would like to know if there is a way to solve this issue without removing the first 'sparse'.

[g13013]

Confirmed here. Any solution ?

[ablatner]

bump

[dkattan]

I'm also having this issue. I removed the initial sparse checkout and it worked as expected.

[adrien-barret]

same issue here too, would be cool to have a update on this one