From 650ceb06a8831f9d8e668c6cc55e65cce5df1c7e Mon Sep 17 00:00:00 2001
From: James Bradlee <james.bradlee@telenor.no>
Date: Tue, 20 Aug 2024 10:43:19 +0200
Subject: [PATCH 1/9] added commit input in action.yaml

Signed-off-by: James Bradlee <james.bradlee@telenor.no>
---
 action.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/action.yml b/action.yml
index 75d5ae2d8..0ec5365db 100644
--- a/action.yml
+++ b/action.yml
@@ -9,6 +9,11 @@ inputs:
       The branch, tag or SHA to checkout. When checking out the repository that
       triggered a workflow, this defaults to the reference or SHA for that
       event.  Otherwise, uses the default branch.
+  commit:
+    description: >
+      The commit SHA to checkout. Used when ref is not specified or is ambiguous.
+      This can be used as a replacement for ref, or alongside it to checkout a
+      specific commit of the ref.
   token:
     description: >
       Personal access token (PAT) used to fetch the repository. The PAT is configured

From 67b5caa1094e97810cff8db0ba27aa118ce645df Mon Sep 17 00:00:00 2001
From: James Bradlee <james.bradlee@telenor.no>
Date: Tue, 20 Aug 2024 10:46:15 +0200
Subject: [PATCH 2/9] in input-helper, set commit = core.getInput('commit')

Signed-off-by: James Bradlee <james.bradlee@telenor.no>
---
 src/input-helper.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/input-helper.ts b/src/input-helper.ts
index 059232f5c..6146c9a04 100644
--- a/src/input-helper.ts
+++ b/src/input-helper.ts
@@ -57,6 +57,7 @@ export async function getInputs(): Promise<IGitSourceSettings> {
     `${github.context.repo.owner}/${github.context.repo.repo}`.toUpperCase()
 
   // Source branch, source version
+  result.commit = core.getInput('commit')
   result.ref = core.getInput('ref')
   if (!result.ref) {
     if (isWorkflowRepository) {

From 8a241b5b4d9f8cd0d8f75d29f235481aff4b404a Mon Sep 17 00:00:00 2001
From: James Bradlee <james.bradlee@telenor.no>
Date: Tue, 20 Aug 2024 10:46:49 +0200
Subject: [PATCH 3/9] in input-helper, make ref fallback to commit if the
 commit was provided but not ref

Signed-off-by: James Bradlee <james.bradlee@telenor.no>
---
 src/input-helper.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/input-helper.ts b/src/input-helper.ts
index 6146c9a04..bc9382f9e 100644
--- a/src/input-helper.ts
+++ b/src/input-helper.ts
@@ -58,7 +58,7 @@ export async function getInputs(): Promise<IGitSourceSettings> {
 
   // Source branch, source version
   result.commit = core.getInput('commit')
-  result.ref = core.getInput('ref')
+  result.ref = core.getInput('ref') ?? result.commit
   if (!result.ref) {
     if (isWorkflowRepository) {
       result.ref = github.context.ref

From 267ca9cee142ee19093ffc70c239c68e63e54ab2 Mon Sep 17 00:00:00 2001
From: James Bradlee <james.bradlee@telenor.no>
Date: Tue, 20 Aug 2024 10:49:44 +0200
Subject: [PATCH 4/9] in input-helper, add validation to commit input

Signed-off-by: James Bradlee <james.bradlee@telenor.no>
---
 src/input-helper.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/input-helper.ts b/src/input-helper.ts
index bc9382f9e..768ae62a3 100644
--- a/src/input-helper.ts
+++ b/src/input-helper.ts
@@ -58,6 +58,10 @@ export async function getInputs(): Promise<IGitSourceSettings> {
 
   // Source branch, source version
   result.commit = core.getInput('commit')
+  if (result.commit && !result.commit.match(/^[0-9a-fA-F]{40}$/)) {
+    throw new Error(`The commit SHA '${result.commit}' is not a valid SHA.`)
+  }
+
   result.ref = core.getInput('ref') ?? result.commit
   if (!result.ref) {
     if (isWorkflowRepository) {

From 3a6c8fb5e637bee74224379a9b0fff1ecfc688de Mon Sep 17 00:00:00 2001
From: James Bradlee <james.bradlee@telenor.no>
Date: Tue, 20 Aug 2024 10:54:17 +0200
Subject: [PATCH 5/9] added tests

Signed-off-by: James Bradlee <james.bradlee@telenor.no>
---
 __test__/input-helper.test.ts | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/__test__/input-helper.test.ts b/__test__/input-helper.test.ts
index 9514cb42d..214861894 100644
--- a/__test__/input-helper.test.ts
+++ b/__test__/input-helper.test.ts
@@ -144,4 +144,26 @@ describe('input-helper tests', () => {
     const settings: IGitSourceSettings = await inputHelper.getInputs()
     expect(settings.workflowOrganizationId).toBe(123456)
   })
+
+  it('accepts ref and commit', async () => {
+    inputs.ref = 'refs/pull/123/merge'
+    inputs.commit = '0123456789012345678901234567890123456789'
+    const settings: IGitSourceSettings = await inputHelper.getInputs()
+    expect(settings).toBeTruthy()
+    expect(settings.ref).toBeTruthy()
+    expect(settings.ref).toStrictEqual('refs/pull/123/merge')
+    expect(settings.commit).toBeTruthy()
+    expect(settings.commit).toStrictEqual('0123456789012345678901234567890123456789')
+  })
+
+  it('ref fallbacks to commit if ref is empty but commit is specified', async () => {
+    inputs.ref = ''
+    inputs.commit = '0123456789012345678901234567890123456789'
+    const settings: IGitSourceSettings = await inputHelper.getInputs()
+    expect(settings).toBeTruthy()
+    expect(settings.ref).toBeTruthy()
+    expect(settings.ref).toStrictEqual('0123456789012345678901234567890123456789')
+    expect(settings.commit).toBeTruthy()
+    expect(settings.commit).toStrictEqual('0123456789012345678901234567890123456789')
+  })
 })

From 491fae084d7f74ef16e3a7a58a0cdd16edbeb5bf Mon Sep 17 00:00:00 2001
From: James Bradlee <james.bradlee@telenor.no>
Date: Tue, 20 Aug 2024 10:58:15 +0200
Subject: [PATCH 6/9] format input-helper

Signed-off-by: James Bradlee <james.bradlee@telenor.no>
---
 __test__/input-helper.test.ts | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/__test__/input-helper.test.ts b/__test__/input-helper.test.ts
index 214861894..8fb4e219d 100644
--- a/__test__/input-helper.test.ts
+++ b/__test__/input-helper.test.ts
@@ -153,7 +153,9 @@ describe('input-helper tests', () => {
     expect(settings.ref).toBeTruthy()
     expect(settings.ref).toStrictEqual('refs/pull/123/merge')
     expect(settings.commit).toBeTruthy()
-    expect(settings.commit).toStrictEqual('0123456789012345678901234567890123456789')
+    expect(settings.commit).toStrictEqual(
+      '0123456789012345678901234567890123456789'
+    )
   })
 
   it('ref fallbacks to commit if ref is empty but commit is specified', async () => {
@@ -162,8 +164,12 @@ describe('input-helper tests', () => {
     const settings: IGitSourceSettings = await inputHelper.getInputs()
     expect(settings).toBeTruthy()
     expect(settings.ref).toBeTruthy()
-    expect(settings.ref).toStrictEqual('0123456789012345678901234567890123456789')
+    expect(settings.ref).toStrictEqual(
+      '0123456789012345678901234567890123456789'
+    )
     expect(settings.commit).toBeTruthy()
-    expect(settings.commit).toStrictEqual('0123456789012345678901234567890123456789')
+    expect(settings.commit).toStrictEqual(
+      '0123456789012345678901234567890123456789'
+    )
   })
 })

From a52fa92dc961890c1572c72f382d4190aa8ad75d Mon Sep 17 00:00:00 2001
From: James Bradlee <james.bradlee@telenor.no>
Date: Tue, 20 Aug 2024 10:59:18 +0200
Subject: [PATCH 7/9] build updates docs

Signed-off-by: James Bradlee <james.bradlee@telenor.no>
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 9b6176d94..36f6465ce 100644
--- a/README.md
+++ b/README.md
@@ -29,6 +29,11 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
     # Otherwise, uses the default branch.
     ref: ''
 
+    # The commit SHA to checkout. Used when ref is not specified or is ambiguous. This
+    # can be used as a replacement for ref, or alongside it to checkout a specific
+    # commit of the ref.
+    commit: ''
+
     # Personal access token (PAT) used to fetch the repository. The PAT is configured
     # with the local git config, which enables your scripts to run authenticated git
     # commands. The post-job step removes the PAT.

From 1be0f9404cf8618e25c4809482076d6ebe47e318 Mon Sep 17 00:00:00 2001
From: James Bradlee <james.bradlee@telenor.no>
Date: Tue, 20 Aug 2024 10:59:28 +0200
Subject: [PATCH 8/9] builds updates dist

Signed-off-by: James Bradlee <james.bradlee@telenor.no>
---
 dist/index.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dist/index.js b/dist/index.js
index 9d959a9ee..9946771ab 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -1717,6 +1717,7 @@ const path = __importStar(__nccwpck_require__(1017));
 const workflowContextHelper = __importStar(__nccwpck_require__(9568));
 function getInputs() {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const result = {};
         // GitHub workspace
         let githubWorkspacePath = process.env['GITHUB_WORKSPACE'];
@@ -1748,7 +1749,11 @@ function getInputs() {
         const isWorkflowRepository = qualifiedRepository.toUpperCase() ===
             `${github.context.repo.owner}/${github.context.repo.repo}`.toUpperCase();
         // Source branch, source version
-        result.ref = core.getInput('ref');
+        result.commit = core.getInput('commit');
+        if (result.commit && !result.commit.match(/^[0-9a-fA-F]{40}$/)) {
+            throw new Error(`The commit SHA '${result.commit}' is not a valid SHA.`);
+        }
+        result.ref = (_a = core.getInput('ref')) !== null && _a !== void 0 ? _a : result.commit;
         if (!result.ref) {
             if (isWorkflowRepository) {
                 result.ref = github.context.ref;

From 0865c4bfce7deea86ea9a5aebef018b997ab2a29 Mon Sep 17 00:00:00 2001
From: James Bradlee <james.bradlee@telenor.no>
Date: Tue, 20 Aug 2024 17:48:27 +0200
Subject: [PATCH 9/9] must use `||` and not `??` when falling back to commit
 when ref is not provided.

Signed-off-by: James Bradlee <james.bradlee@telenor.no>
---
 __test__/input-helper.test.ts | 6 ++----
 dist/index.js                 | 3 +--
 src/input-helper.ts           | 2 +-
 3 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/__test__/input-helper.test.ts b/__test__/input-helper.test.ts
index 8fb4e219d..99187b691 100644
--- a/__test__/input-helper.test.ts
+++ b/__test__/input-helper.test.ts
@@ -163,10 +163,8 @@ describe('input-helper tests', () => {
     inputs.commit = '0123456789012345678901234567890123456789'
     const settings: IGitSourceSettings = await inputHelper.getInputs()
     expect(settings).toBeTruthy()
-    expect(settings.ref).toBeTruthy()
-    expect(settings.ref).toStrictEqual(
-      '0123456789012345678901234567890123456789'
-    )
+    expect(settings.ref).toBeFalsy()
+    expect(settings.ref).toStrictEqual('')
     expect(settings.commit).toBeTruthy()
     expect(settings.commit).toStrictEqual(
       '0123456789012345678901234567890123456789'
diff --git a/dist/index.js b/dist/index.js
index 9946771ab..06398b566 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -1717,7 +1717,6 @@ const path = __importStar(__nccwpck_require__(1017));
 const workflowContextHelper = __importStar(__nccwpck_require__(9568));
 function getInputs() {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a;
         const result = {};
         // GitHub workspace
         let githubWorkspacePath = process.env['GITHUB_WORKSPACE'];
@@ -1753,7 +1752,7 @@ function getInputs() {
         if (result.commit && !result.commit.match(/^[0-9a-fA-F]{40}$/)) {
             throw new Error(`The commit SHA '${result.commit}' is not a valid SHA.`);
         }
-        result.ref = (_a = core.getInput('ref')) !== null && _a !== void 0 ? _a : result.commit;
+        result.ref = core.getInput('ref') || result.commit;
         if (!result.ref) {
             if (isWorkflowRepository) {
                 result.ref = github.context.ref;
diff --git a/src/input-helper.ts b/src/input-helper.ts
index 768ae62a3..de6463612 100644
--- a/src/input-helper.ts
+++ b/src/input-helper.ts
@@ -62,7 +62,7 @@ export async function getInputs(): Promise<IGitSourceSettings> {
     throw new Error(`The commit SHA '${result.commit}' is not a valid SHA.`)
   }
 
-  result.ref = core.getInput('ref') ?? result.commit
+  result.ref = core.getInput('ref') || result.commit
   if (!result.ref) {
     if (isWorkflowRepository) {
       result.ref = github.context.ref