Bump the minor-actions-dependencies group with 2 updates

Bumps the minor-actions-dependencies group with 2 updates: [docker/login-action](https://github.com/docker/login-action) and [docker/build-push-action](https://github.com/docker/build-push-action).


Updates `docker/login-action` from 4.2.0 to 4.4.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v4.2.0...v4.4.0)

Updates `docker/build-push-action` from 7.2.0 to 7.3.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v7.2.0...v7.3.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-actions-dependencies
- dependency-name: docker/build-push-action
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

.eslintignore

@@ -0,0 +1,3 @@
+dist/
+lib/
+node_modules/

.eslintrc.json

@@ -0,0 +1,53 @@
+{
+  "plugins": ["jest", "@typescript-eslint"],
+  "extends": ["plugin:github/recommended"],
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "ecmaVersion": 9,
+    "sourceType": "module",
+    "project": "./tsconfig.json"
+  },
+  "rules": {
+    "eslint-comments/no-use": "off",
+    "import/no-namespace": "off",
+    "no-unused-vars": "off",
+    "@typescript-eslint/no-unused-vars": "error",
+    "@typescript-eslint/explicit-member-accessibility": ["error", {"accessibility": "no-public"}],
+    "@typescript-eslint/no-require-imports": "error",
+    "@typescript-eslint/array-type": "error",
+    "@typescript-eslint/await-thenable": "error",
+    "camelcase": "off",
+    "@typescript-eslint/explicit-function-return-type": ["error", {"allowExpressions": true}],
+    "@typescript-eslint/func-call-spacing": ["error", "never"],
+    "@typescript-eslint/no-array-constructor": "error",
+    "@typescript-eslint/no-empty-interface": "error",
+    "@typescript-eslint/no-explicit-any": "error",
+    "@typescript-eslint/no-extraneous-class": "error",
+    "@typescript-eslint/no-floating-promises": "error",
+    "@typescript-eslint/no-for-in-array": "error",
+    "@typescript-eslint/no-inferrable-types": "error",
+    "@typescript-eslint/no-misused-new": "error",
+    "@typescript-eslint/no-namespace": "error",
+    "@typescript-eslint/no-non-null-assertion": "warn",
+    "@typescript-eslint/no-unnecessary-qualifier": "error",
+    "@typescript-eslint/no-unnecessary-type-assertion": "error",
+    "@typescript-eslint/no-useless-constructor": "error",
+    "@typescript-eslint/no-var-requires": "error",
+    "@typescript-eslint/prefer-for-of": "warn",
+    "@typescript-eslint/prefer-function-type": "warn",
+    "@typescript-eslint/prefer-includes": "error",
+    "@typescript-eslint/prefer-string-starts-ends-with": "error",
+    "@typescript-eslint/promise-function-async": "error",
+    "@typescript-eslint/require-array-sort-compare": "error",
+    "@typescript-eslint/restrict-plus-operands": "error",
+    "semi": "off",
+    "@typescript-eslint/semi": ["error", "never"],
+    "@typescript-eslint/type-annotation-spacing": "error",
+    "@typescript-eslint/unbound-method": "error"
+  },
+  "env": {
+    "node": true,
+    "es6": true,
+    "jest/globals": true
+  }
+}

__test__/input-helper.test.ts

@@ -180,50 +180,4 @@ describe('input-helper tests', () => {
     const settings: IGitSourceSettings = await inputHelper.getInputs()
     expect(settings.workflowOrganizationId).toBe(123456)
   })
-
-  describe('unsafe PR checkout guard', () => {
-    const forkPayload = {
-      repository: {id: 100},
-      pull_request: {
-        head: {
-          sha: '1234567890123456789012345678901234567890',
-          repo: {id: 200, full_name: 'attacker/fork'}
-        },
-        merge_commit_sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
-      }
-    }
-
-    it('allows the default self-checkout on a fork pull_request_target', async () => {
-      const originalEvent = mockGithubContext.eventName
-      const originalPayload = mockGithubContext.payload
-      try {
-        mockGithubContext.eventName = 'pull_request_target'
-        mockGithubContext.payload = forkPayload
-        // Simulate a rebase/fast-forward merge where the base tip (event SHA)
-        // equals the PR head SHA. The default self-checkout must still succeed.
-        mockGithubContext.sha = '1234567890123456789012345678901234567890'
-        const settings: IGitSourceSettings = await inputHelper.getInputs()
-        expect(settings.commit).toBe('1234567890123456789012345678901234567890')
-      } finally {
-        mockGithubContext.eventName = originalEvent
-        mockGithubContext.payload = originalPayload
-      }
-    })
-
-    it('refuses an explicit fork repository on pull_request_target', async () => {
-      const originalEvent = mockGithubContext.eventName
-      const originalPayload = mockGithubContext.payload
-      try {
-        mockGithubContext.eventName = 'pull_request_target'
-        mockGithubContext.payload = forkPayload
-        inputs.repository = 'attacker/fork'
-        await expect(inputHelper.getInputs()).rejects.toThrow(
-          /Refusing to check out fork pull request code/
-        )
-      } finally {
-        mockGithubContext.eventName = originalEvent
-        mockGithubContext.payload = originalPayload
-      }
-    })
-  })
 })

dist/index.js

@@ -42191,19 +42191,12 @@ async function getInputs() {
         (getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() ===
             'TRUE';
     core_debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`);
-    // The default self-checkout (this repository with no explicit ref) always
-    // resolves to the trusted ref/commit GitHub set for the triggering event, so
-    // the fork-checkout guard only needs to run when the caller customized the
-    // repository or ref.
-    const isDefaultCheckout = isWorkflowRepository && !getInput('ref');
-    if (!isDefaultCheckout) {
-        assertSafePrCheckout({
-            qualifiedRepository,
-            ref: result.ref,
-            commit: result.commit,
-            allowUnsafePrCheckout: result.allowUnsafePrCheckout
-        });
-    }
+    assertSafePrCheckout({
+        qualifiedRepository,
+        ref: result.ref,
+        commit: result.commit,
+        allowUnsafePrCheckout: result.allowUnsafePrCheckout
+    });
     return result;
 }
 

eslint.config.mjs

@@ -1,62 +0,0 @@
-import github from 'eslint-plugin-github'
-import jest from 'eslint-plugin-jest'
-
-const githubConfigs = github.getFlatConfigs()
-
-export default [
-  {
-    ignores: ['**/node_modules/**', '**/lib/**', '**/dist/**']
-  },
-  githubConfigs.recommended,
-  ...githubConfigs.typescript,
-  {
-    files: ['**/*.ts'],
-    languageOptions: {
-      parserOptions: {
-        project: './tsconfig.json'
-      }
-    },
-    rules: {
-      'eslint-comments/no-use': 'off',
-      'import/no-namespace': 'off',
-      'no-unused-vars': 'off',
-      '@typescript-eslint/no-unused-vars': 'error',
-      '@typescript-eslint/explicit-member-accessibility': [
-        'error',
-        {accessibility: 'no-public'}
-      ],
-      '@typescript-eslint/no-require-imports': 'error',
-      '@typescript-eslint/array-type': 'error',
-      '@typescript-eslint/await-thenable': 'error',
-      camelcase: 'off',
-      '@typescript-eslint/explicit-function-return-type': [
-        'error',
-        {allowExpressions: true}
-      ],
-      '@typescript-eslint/no-array-constructor': 'error',
-      '@typescript-eslint/no-explicit-any': 'error',
-      '@typescript-eslint/no-extraneous-class': 'error',
-      '@typescript-eslint/no-floating-promises': 'error',
-      '@typescript-eslint/no-for-in-array': 'error',
-      '@typescript-eslint/no-inferrable-types': 'error',
-      '@typescript-eslint/no-misused-new': 'error',
-      '@typescript-eslint/no-namespace': 'error',
-      '@typescript-eslint/no-non-null-assertion': 'warn',
-      '@typescript-eslint/no-unnecessary-qualifier': 'error',
-      '@typescript-eslint/no-unnecessary-type-assertion': 'error',
-      '@typescript-eslint/no-useless-constructor': 'error',
-      '@typescript-eslint/prefer-for-of': 'warn',
-      '@typescript-eslint/prefer-function-type': 'warn',
-      '@typescript-eslint/prefer-includes': 'error',
-      '@typescript-eslint/prefer-string-starts-ends-with': 'error',
-      '@typescript-eslint/promise-function-async': 'error',
-      '@typescript-eslint/require-array-sort-compare': 'error',
-      '@typescript-eslint/restrict-plus-operands': 'error',
-      '@typescript-eslint/unbound-method': 'error'
-    }
-  },
-  {
-    files: ['__test__/**/*.ts'],
-    ...jest.configs['flat/recommended']
-  }
-]

package.json

@@ -41,12 +41,12 @@
   "devDependencies": {
     "@types/jest": "^29.5.12",
     "@types/node": "^24.1.0",
-    "@typescript-eslint/eslint-plugin": "^8.54.0",
-    "@typescript-eslint/parser": "^8.54.0",
+    "@typescript-eslint/eslint-plugin": "^7.9.0",
+    "@typescript-eslint/parser": "^7.9.0",
     "@vercel/ncc": "^0.44.0",
-    "eslint": "^9.39.2",
-    "eslint-plugin-github": "^6.0.0",
-    "eslint-plugin-jest": "^29.12.1",
+    "eslint": "^8.57.0",
+    "eslint-plugin-github": "^4.10.2",
+    "eslint-plugin-jest": "^28.8.2",
     "jest": "^29.7.0",
     "js-yaml": "^4.2.0",
     "prettier": "^3.8.4",

src/input-helper.ts

@@ -168,19 +168,12 @@ export async function getInputs(): Promise<IGitSourceSettings> {
     'TRUE'
   core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`)
 
-  // The default self-checkout (this repository with no explicit ref) always
-  // resolves to the trusted ref/commit GitHub set for the triggering event, so
-  // the fork-checkout guard only needs to run when the caller customized the
-  // repository or ref.
-  const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref')
-  if (!isDefaultCheckout) {
-    unsafePrCheckoutHelper.assertSafePrCheckout({
-      qualifiedRepository,
-      ref: result.ref,
-      commit: result.commit,
-      allowUnsafePrCheckout: result.allowUnsafePrCheckout
-    })
-  }
+  unsafePrCheckoutHelper.assertSafePrCheckout({
+    qualifiedRepository,
+    ref: result.ref,
+    commit: result.commit,
+    allowUnsafePrCheckout: result.allowUnsafePrCheckout
+  })
 
   return result
 }