fix(release-actions): changed files match

neilime · neilime · commit 0a46dea3c382 · 2025-11-21T19:26:35.000+01:00
Signed-off-by: Emilien Escalle &lt;emilien.escalle@escemi.com&gt;
diff --git a/.github/workflows/__test-action-check-url-lighthouse.yml b/.github/workflows/__test-action-check-url-lighthouse.yml
@@ -14,6 +14,8 @@ jobs:
     steps:
       - name: Arrange - Checkout
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - name: Act - Check URL Lighthouse
         id: check-url-lighthouse
diff --git a/.github/workflows/__test-action-check-url-ping.yml b/.github/workflows/__test-action-check-url-ping.yml
@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: Arrange - Checkout
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup - Configure mock server
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
diff --git a/.github/workflows/__test-action-deploy-argocd-manifest-files.yml b/.github/workflows/__test-action-deploy-argocd-manifest-files.yml
@@ -21,6 +21,8 @@ jobs:
       TEST_EXPECTED_MANIFEST_FILE: tests/argocd-app-of-apps/ci/manifests/ci-test/test-app/expected.yml
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - name: Arrange - Create test manifest files
         run: |
diff --git a/.github/workflows/__test-action-deploy-jekyll-jampack.yml b/.github/workflows/__test-action-deploy-jekyll-jampack.yml
@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: Arrange - Checkout
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - name: Arrange - Create linked test pages
         run: |
diff --git a/.github/workflows/__test-action-deployment.yml b/.github/workflows/__test-action-deployment.yml
@@ -14,6 +14,8 @@ jobs:
       deployments: write
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - id: create-deployment
         uses: ./actions/deployment/create
diff --git a/.github/workflows/clean-deploy-argocd-app-of-apps.yml b/.github/workflows/clean-deploy-argocd-app-of-apps.yml
@@ -72,6 +72,8 @@ jobs:
             core.setOutput("repository", repository);
 
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       # jscpd:ignore-start
       # FIXME: This is a workaround for having workflow actions. See https://github.com/orgs/community/discussions/38659
@@ -80,6 +82,7 @@ jobs:
 
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
@@ -142,6 +145,7 @@ jobs:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         if: always() && steps.oidc.outputs.job_workflow_repo_name_and_owner
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
diff --git a/.github/workflows/clean-deploy.yml b/.github/workflows/clean-deploy.yml
@@ -125,6 +125,7 @@ jobs:
 
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
@@ -179,6 +180,7 @@ jobs:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         if: always() && steps.oidc.outputs.job_workflow_repo_name_and_owner
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
diff --git a/.github/workflows/deploy-argocd-app-of-apps.yml b/.github/workflows/deploy-argocd-app-of-apps.yml
@@ -140,6 +140,8 @@ jobs:
           uri: ${{ steps.check-client-payload.outputs.chart }}
 
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       # FIXME: This is a workaround for having workflow actions. See https://github.com/orgs/community/discussions/38659
       # jscpd:ignore-start
@@ -148,6 +150,7 @@ jobs:
 
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
diff --git a/.github/workflows/deploy-chart.yml b/.github/workflows/deploy-chart.yml
@@ -349,6 +349,7 @@ jobs:
 
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
@@ -457,6 +458,7 @@ jobs:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         if: always() && steps.oidc.outputs.job_workflow_repo_name_and_owner
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
diff --git a/.github/workflows/deploy-checks.yml b/.github/workflows/deploy-checks.yml
@@ -78,6 +78,7 @@ jobs:
 
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
@@ -101,6 +102,7 @@ jobs:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         if: always() && steps.oidc.outputs.job_workflow_repo_name_and_owner
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
diff --git a/.github/workflows/deploy-finish.yml b/.github/workflows/deploy-finish.yml
@@ -66,6 +66,7 @@ jobs:
 
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
@@ -91,6 +92,7 @@ jobs:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         if: always() && steps.oidc.outputs.job_workflow_repo_name_and_owner
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
@@ -172,6 +174,7 @@ jobs:
 
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
@@ -193,6 +196,7 @@ jobs:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         if: always() && steps.oidc.outputs.job_workflow_repo_name_and_owner
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
diff --git a/.github/workflows/deploy-start.yml b/.github/workflows/deploy-start.yml
@@ -104,6 +104,7 @@ jobs:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         if: ${{ steps.trigger.outputs.trigger }}
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
@@ -123,6 +124,7 @@ jobs:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         if: always() && steps.oidc.outputs.job_workflow_repo_name_and_owner && steps.trigger.outputs.trigger
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
@@ -144,6 +146,7 @@ jobs:
 
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
@@ -168,6 +171,7 @@ jobs:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         if: always() && steps.oidc.outputs.job_workflow_repo_name_and_owner
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
diff --git a/.github/workflows/finish-deploy-argocd-app-of-apps.yml b/.github/workflows/finish-deploy-argocd-app-of-apps.yml
@@ -64,6 +64,8 @@ jobs:
       state: ${{ steps.get-state-from-status.outputs.state }}
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - id: check-client-payload
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@@ -145,6 +147,7 @@ jobs:
 
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
+          persist-credentials: false
           path: ./self-workflow
           repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
           ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
@@ -110,6 +110,7 @@ jobs:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         if: steps.get-config.outputs.config
         with:
+          persist-credentials: false
           ref: refs/heads/${{ github.event.repository.default_branch }}
           sparse-checkout: ${{ env.CONFIG_PATH }}
 
diff --git a/.github/workflows/release-actions.yml b/.github/workflows/release-actions.yml
@@ -157,24 +157,22 @@ jobs:
             ${{ steps.get-manifest-files.outputs.paths }}
           dir_names_exclude_current_dir: true
           separator: "\n"
+          json: true
+          escape_json: false
 
       - id: get-changed-files
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           UPDATE_ALL: ${{ inputs.update-all }}
-          CHANGED_FILES: |
-            ${{ steps.changed-files.outputs.all_changed_and_modified_files }}
+          CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_and_modified_files }}
           DOCUMENTATION_FILES: |
             ${{ steps.get-documentation-files.outputs.paths }}
           MANIFEST_FILES: |
             ${{ steps.get-manifest-files.outputs.paths }}
         with:
           script: |
             const { join, relative } = require('path');
-            const changedFiles = process.env.CHANGED_FILES
-              .split('\n')
-              .map(f => f.trim())
-              .filter(Boolean);
+            const changedFiles = JSON.parse(process.env.CHANGED_FILES).map(f => f.trim()).filter(Boolean);
 
             core.debug(`Changed files: ${changedFiles.join(', ')}`);
             const currentWorkflow = process.env.GITHUB_WORKFLOW_REF.replace(`${process.env.GITHUB_REPOSITORY}/`, '').replace(/@.*/, '');
@@ -281,6 +279,8 @@ jobs:
     runs-on: ${{ fromJson(inputs.runs-on) }}
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
@@ -318,6 +318,8 @@ jobs:
       artifact-id: ${{ steps.upload-artifact.outputs.artifact-id }}
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         if: needs.generate-documentation.outputs.artifact-id
diff --git a/actions/release/create/action.yml b/actions/release/create/action.yml
@@ -27,6 +27,7 @@ runs:
   steps:
     - uses: hoverkraft-tech/ci-github-common/actions/checkout@c314229c3ca6914f7023ffca7afc26753ab99b41 # 0.30.1
       with:
+        persist-credentials: false
         fetch-depth: "0"
 
     - id: release
