Shim /v3/repos API for actions/checkout

[silverwind]

Description

Under condition !ref && !commit, actions/checkout calls out to the GitHub API:

https://github.com/actions/checkout/blob/8eb1f6a495037164bea451156472f35fdd6bafc0/src/github-api-helper.ts#L26

::group::Determining the default branch
Retrieving the default branch name
Not found.

It will fetch /api/v3/repos/[user]/[reponame] which is not available on Gitea's API. I wonder whether we should make some shims specific for this because the action it by far the most commonly action to use.

Original issue report: #29654

[ChristopherHX]

This action would also call the api if you use an docker image / system without git tool / ancient version to download a zip archive
However I never debugged this specfic case and have no idea if this also just needs a shim for /v3/repos as well to work.

[silverwind]

This was reported in Discord, I asked the user to share more details on how they are running into this issue.

[silverwind]

Yes, this section confirms that the affected code is only used when git is not available:

https://github.com/actions/checkout/blob/8eb1f6a495037164bea451156472f35fdd6bafc0/src/git-source-provider.ts#L74

[silverwind]

I think we may consider just requiring git in the image. It's unfortunate that actions/checkout fails with such an confusing error message. We could just validate presence of git in act-runner to make the error reason clear.

[ChristopherHX]

The issue mentioned in the discord is this one

on: push
jobs:
  _:
    runs-on: k8s # <--- change this to match what you use
    container: buildpack-deps:noble # <--- any image with git would trigger this
    steps:
    - uses: https://github.com/actions/checkout@v3
      with:
        repository: christopher/service-container # <--- This also trigger the /v3 path

log with the actions/runner on gitea with usable git is installed

##[group]Run https~//github.com/actions/checkout@v3
with:
  repository: christopher/service-container
  token: ***
  ssh-strict: true
  persist-credentials: true
  clean: true
  sparse-checkout-cone-mode: true
  fetch-depth: 1
  fetch-tags: false
  lfs: false
  submodules: false
  set-safe-directory: true
##[endgroup]
##[group]Run '/home/runner/k8s/index.js'
shell: /home/runner/externals/node16/bin/node {0}
##[endgroup]
Syncing repository: christopher/service-container
##[group]Getting Git version info
Working directory is '/__w/test-actions/test-actions'
[command]/usr/bin/git version
git version [2](http://rpi2server.fritz.box:3000/christopher/test-actions/actions/runs/83#jobstep-2-2).4[3](http://rpi2server.fritz.box:3000/christopher/test-actions/actions/runs/83#jobstep-2-3).0
##[endgroup]
Temporarily overriding HOME='/__w/_temp/ff9d86a2-ffe[4](http://rpi2server.fritz.box:3000/christopher/test-actions/actions/runs/83#jobstep-2-4)-4d01-b6bc-f[5](http://rpi2server.fritz.box:3000/christopher/test-actions/actions/runs/83#jobstep-2-5)5f5894[6](http://rpi2server.fritz.box:3000/christopher/test-actions/actions/runs/83#jobstep-2-6)cb3' before making global git config changes
Adding repository directory to the temporary git global config as a safe directory
[command]/usr/bin/git config --global --add safe.directory /__w/test-actions/test-actions
Deleting the contents of '/__w/test-actions/test-actions'
##[group]Initializing the repository
[command]/usr/bin/git init /__w/test-actions/test-actions
hint: Using 'master' as the name for the initial branch. This default branch name
hint: is subject to change. To configure the initial branch name to use in all
hint: of your new repositories, which will suppress this warning, call:
hint: 
hint: 	git config --global init.defaultBranch <name>
hint: 
hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
hint: 'development'. The just-created branch can be renamed via this command:
hint: 
hint: 	git branch -m <name>
Initialized empty Git repository in /__w/test-actions/test-actions/.git/
[command]/usr/bin/git remote add origin http://rpi2server.fritz.box:3000/christopher/service-container
##[endgroup]
##[group]Disabling automatic garbage collection
[command]/usr/bin/git config --local gc.auto 0
##[endgroup]
##[group]Setting up auth
[command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
[command]/usr/bin/git config --local --name-only --get-regexp http\.http\:\/\/rpi2server\.fritz\.box\:3000\/\.extraheader
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.http\:\/\/rpi2server\.fritz\.box\:3000\/\.extraheader' && git config --local --unset-all 'http.http://rpi2server.fritz.box:3000/.extraheader' || :"
[command]/usr/bin/git config --local http.http://rpi2server.fritz.box:3000/.extraheader AUTHORIZATION: basic ***
##[endgroup]
##[group]Determining the default branch
Retrieving the default branch name
Not found.

I think we may consider just requiring git in the image.

That's what I'm doing for my own purposes, since 2021...

[silverwind]

The only other two API calls I see in this fallback code are here:

https://github.com/actions/checkout/blob/8eb1f6a495037164bea451156472f35fdd6bafc0/src/github-api-helper.ts#L135-L136

These go to /repos/{owner}/{repo}/tarball/{ref} and /repos/{owner}/{repo}/zipball/{ref}. I think this is unversioned API that is likely present on Gitea.

[silverwind]

I don't think it's wise to require git after all. There may be more scenarios where it won't be there and I assume GitHub must have had good reasons for adding that fallback download via archive.

[nyanotech]

This was reported in Discord, I asked the user to share more details on how they are running into this issue.

I guess I should say on this bug; I'm the user who reported it in discord, and #29654 is my report of this.

The details are in #29654, but in short, the actions workflow that I have that runs into this is basically this example; the second repo's ref isn't plumbed in via the normal means.

Manually specifying a ref to check out in the action works around this issue.

[silverwind]

Closing in favor of #29654.