checkout

A shell-only replacement for actions/checkout. It fetches the repository into the workspace with plain git, so it works in images without Node.js.

- uses: fakehacker/actions/checkout@v1.0.0
  # with:
  #   ref: ${{ github.ref }}
  #   fetch-depth: "1"
  #   token: ${{ github.token }}

Always reference it remotely (fakehacker/actions/checkout@...), never as a local ./checkout. The runner reads local actions from the workspace, and the workspace stays empty until this action has run.

Inputs

Input	Default	Description
ref	${{ github.ref }}	Ref to fetch: a branch, a tag, refs/pull/N/head or a commit SHA.
fetch-depth	"1"	Depth of the shallow fetch. "0" fetches the full history.
token	${{ github.token }}	Token for the authenticated fetch. Pass a personal access token to read a repo the workflow token can't access.

How it works

1. Ensure git. If git isn't on PATH, it's installed with whichever package manager the image has. The managers are tried in this order: apt-get, apk, dnf, microdnf, yum, zypper, pacman. The only requirement is a POSIX sh.
2. Fetch source.
   • git config --global --add safe.directory '*' stops git from complaining about the workspace's owner.
   • git init runs in the workspace, and origin is set to https://<server>/<owner>/<repo>.git, built from GITHUB_SERVER_URL and GITHUB_REPOSITORY.
   • The ref is fetched with an Authorization: Basic header built from GITHUB_ACTOR and the token. The header is passed only to that one git fetch and is never written to the git config.
   • Finally it runs git checkout FETCH_HEAD.

Differences from actions/checkout

• Detached HEAD: the result is a checked-out commit, not a local branch. Run git switch -c <name> if your later steps need a branch.
• No credentials kept: git push or git fetch in later steps must supply their own authentication.
• No tags: they're not fetched by default. Use fetch-depth: "0" and run git fetch --tags yourself if you need them, for example for git describe.
• No submodules or LFS: neither is supported.
• No path input: it always checks out into the current working directory, which is normally the workspace.
• HTTPS only: it assumes the server URL starts with https://. A Forgejo instance served over plain http:// gets a broken remote URL.
• Empty workspace expected: run it before anything writes to the workspace.