Skip to content

Exclude the .git directory by default#599

Closed
joshmgross wants to merge 3 commits intomainfrom
joshmgross/exclude-git-directory
Closed

Exclude the .git directory by default#599
joshmgross wants to merge 3 commits intomainfrom
joshmgross/exclude-git-directory

Conversation

@joshmgross
Copy link
Copy Markdown
Contributor

This is an alternative approach to #598 targeting just the .git directory.

We want to ensure this action is safe by default and users can't accidentally upload their Git credentials into an artifact that can then be exfiltrated.

This is still a breaking change, but less impactful than #598.

Users can opt out of this change by setting the newly added include-git-directory input.

@joshmgross joshmgross requested a review from a team as a code owner August 16, 2024 00:31
@joshmgross
Copy link
Copy Markdown
Contributor Author

Closing in favor of #598

@Arusekk
Copy link
Copy Markdown

Arusekk commented Sep 30, 2024

Can this be reconsidered please? The other one is a very hard breaking change to all projects using coverage.py for instance (I bet there are other uses as well). Now the disaster has already happened, so it might be 'too late' or something, but I believe that this PR would have otherwise been a net benefit rather than what happened there.

Example of how projects needed to adapt:
Gallopsled/pwntools#2477

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants