fix: support submodules when commit signing (#3354)

* fix: support submodules when commit signing

* create correct tree object for submodule

* update log messages

README.md

@@ -246,26 +246,6 @@ Note that the repository must be checked out on a branch with a remote, it won't
         uses: peter-evans/create-pull-request@v7
 ```
 
-<!--
-### Create a project card
-
-To create a project card for the pull request, pass the `pull-request-number` step output to [create-or-update-project-card](https://github.com/peter-evans/create-or-update-project-card) action.
-
-```yml
-      - name: Create Pull Request
-        id: cpr
-        uses: peter-evans/create-pull-request@v7
-
-      - name: Create or Update Project Card
-        if: ${{ steps.cpr.outputs.pull-request-number }}
-        uses: peter-evans/create-or-update-project-card@v2
-        with:
-          project-name: My project
-          column-name: My column
-          issue-number: ${{ steps.cpr.outputs.pull-request-number }}
-```
--->
-
 ### Auto-merge
 
 Auto-merge can be enabled on a pull request allowing it to be automatically merged once requirements have been satisfied.

__test__/create-or-update-branch.int.test.ts

@@ -250,11 +250,15 @@ describe('create-or-update-branch tests', () => {
     expect(branchCommits.length).toEqual(1)
     expect(branchCommits[0].subject).toEqual('Test changes')
     expect(branchCommits[0].changes.length).toEqual(3)
-    expect(branchCommits[0].changes).toEqual([
+    expect(branchCommits[0].changes[0].mode).toEqual('100755')
-      {mode: '100755', path: UNTRACKED_EXE_FILE, status: 'A'},
+    expect(branchCommits[0].changes[0].path).toEqual(UNTRACKED_EXE_FILE)
-      {mode: '100644', path: TRACKED_FILE, status: 'M'},
+    expect(branchCommits[0].changes[0].status).toEqual('A')
-      {mode: '100644', path: UNTRACKED_FILE, status: 'A'}
+    expect(branchCommits[0].changes[1].mode).toEqual('100644')
-    ])
+    expect(branchCommits[0].changes[1].path).toEqual(TRACKED_FILE)
+    expect(branchCommits[0].changes[1].status).toEqual('M')
+    expect(branchCommits[0].changes[2].mode).toEqual('100644')
+    expect(branchCommits[0].changes[2].path).toEqual(UNTRACKED_FILE)
+    expect(branchCommits[0].changes[2].status).toEqual('A')
   })
 
   it('tests buildBranchCommits with addition and deletion', async () => {
@@ -272,11 +276,15 @@ describe('create-or-update-branch tests', () => {
     expect(branchCommits.length).toEqual(1)
     expect(branchCommits[0].subject).toEqual('Test changes')
     expect(branchCommits[0].changes.length).toEqual(3)
-    expect(branchCommits[0].changes).toEqual([
+    expect(branchCommits[0].changes[0].mode).toEqual('100644')
-      {mode: '100644', path: TRACKED_FILE, status: 'D'},
+    expect(branchCommits[0].changes[0].path).toEqual(TRACKED_FILE)
-      {mode: '100644', path: UNTRACKED_FILE, status: 'A'},
+    expect(branchCommits[0].changes[0].status).toEqual('D')
-      {mode: '100644', path: TRACKED_FILE_NEW_PATH, status: 'A'}
+    expect(branchCommits[0].changes[1].mode).toEqual('100644')
-    ])
+    expect(branchCommits[0].changes[1].path).toEqual(UNTRACKED_FILE)
+    expect(branchCommits[0].changes[1].status).toEqual('A')
+    expect(branchCommits[0].changes[2].mode).toEqual('100644')
+    expect(branchCommits[0].changes[2].path).toEqual(TRACKED_FILE_NEW_PATH)
+    expect(branchCommits[0].changes[2].status).toEqual('A')
   })
 
   it('tests buildBranchCommits with multiple commits', async () => {
@@ -294,10 +302,13 @@ describe('create-or-update-branch tests', () => {
       expect(branchCommits[i].subject).toEqual(`Test changes ${i}`)
       expect(branchCommits[i].changes.length).toEqual(2)
       const untrackedFileStatus = i == 0 ? 'A' : 'M'
-      expect(branchCommits[i].changes).toEqual([
+
-        {mode: '100644', path: TRACKED_FILE, status: 'M'},
+      expect(branchCommits[i].changes[0].mode).toEqual('100644')
-        {mode: '100644', path: UNTRACKED_FILE, status: untrackedFileStatus}
+      expect(branchCommits[i].changes[0].path).toEqual(TRACKED_FILE)
-      ])
+      expect(branchCommits[i].changes[0].status).toEqual('M')
+      expect(branchCommits[i].changes[1].mode).toEqual('100644')
+      expect(branchCommits[i].changes[1].path).toEqual(UNTRACKED_FILE)
+      expect(branchCommits[i].changes[1].status).toEqual(untrackedFileStatus)
     }
   })
 

__test__/entrypoint.sh

@@ -19,14 +19,17 @@ git clone git://127.0.0.1/repos/test-base.git /git/local/repos/test-base
 cd /git/local/repos/test-base
 git config --global user.email "you@example.com"
 git config --global user.name "Your Name"
-echo "#test-base" > README.md
+echo "#test-base" > README_TEMP.md
 git add .
 git commit -m "initial commit"
 git commit --allow-empty -m "empty commit for tests"
-echo "#test-base :sparkles:" > README.md
+echo "#test-base :sparkles:" > README_TEMP.md
 git add .
 git commit -m "add sparkles" -m "Change description:
-- updates README.md to add sparkles to the title"
+- updates README_TEMP.md to add sparkles to the title"
+mv README_TEMP.md README.md
+git add .
+git commit -m "rename readme"
 git push -u
 git log -1 --pretty=oneline
 git config --global --unset user.email

__test__/git-command-manager.int.test.ts

@@ -11,15 +11,16 @@ describe('git-command-manager integration tests', () => {
   })
 
   it('tests getCommit', async () => {
-    const initialCommit = await git.getCommit('HEAD^^')
+    const initialCommit = await git.getCommit('HEAD^^^')
-    const emptyCommit = await git.getCommit('HEAD^')
+    const emptyCommit = await git.getCommit('HEAD^^')
+    const modifiedCommit = await git.getCommit('HEAD^')
     const headCommit = await git.getCommit('HEAD')
 
     expect(initialCommit.subject).toEqual('initial commit')
     expect(initialCommit.signed).toBeFalsy()
-    expect(initialCommit.changes).toEqual([
+    expect(initialCommit.changes[0].mode).toEqual('100644')
-      {mode: '100644', status: 'A', path: 'README.md'}
+    expect(initialCommit.changes[0].status).toEqual('A')
-    ])
+    expect(initialCommit.changes[0].path).toEqual('README_TEMP.md')
 
     expect(emptyCommit.subject).toEqual('empty commit for tests')
     expect(emptyCommit.tree).toEqual(initialCommit.tree) // empty commits have no tree and reference the parent's
@@ -27,11 +28,21 @@ describe('git-command-manager integration tests', () => {
     expect(emptyCommit.signed).toBeFalsy()
     expect(emptyCommit.changes).toEqual([])
 
-    expect(headCommit.subject).toEqual('add sparkles')
+    expect(modifiedCommit.subject).toEqual('add sparkles')
-    expect(headCommit.parents[0]).toEqual(emptyCommit.sha)
+    expect(modifiedCommit.parents[0]).toEqual(emptyCommit.sha)
+    expect(modifiedCommit.signed).toBeFalsy()
+    expect(modifiedCommit.changes[0].mode).toEqual('100644')
+    expect(modifiedCommit.changes[0].status).toEqual('M')
+    expect(modifiedCommit.changes[0].path).toEqual('README_TEMP.md')
+
+    expect(headCommit.subject).toEqual('rename readme')
+    expect(headCommit.parents[0]).toEqual(modifiedCommit.sha)
     expect(headCommit.signed).toBeFalsy()
-    expect(headCommit.changes).toEqual([
+    expect(headCommit.changes[0].mode).toEqual('100644')
-      {mode: '100644', status: 'M', path: 'README.md'}
+    expect(headCommit.changes[0].status).toEqual('A')
-    ])
+    expect(headCommit.changes[0].path).toEqual('README.md')
+    expect(headCommit.changes[1].mode).toEqual('100644')
+    expect(headCommit.changes[1].status).toEqual('D')
+    expect(headCommit.changes[1].path).toEqual('README_TEMP.md')
   })
 })

dist/index.js

@@ -745,6 +745,8 @@ class GitCommandManager {
                 'show',
                 '--raw',
                 '--cc',
+                '--no-renames',
+                '--no-abbrev',
                 `--format=%H%n%T%n%P%n%G?%n%s%n%b%n${endOfBody}`,
                 ref
             ]);
@@ -760,12 +762,13 @@ class GitCommandManager {
                 subject: detailLines[4],
                 body: detailLines.slice(5, endOfBodyIndex).join('\n'),
                 changes: lines.slice(endOfBodyIndex + 2, -1).map(line => {
-                    const change = line.match(/^:(\d{6}) (\d{6}) \w{7} \w{7} ([AMD])\s+(.*)$/);
+                    const change = line.match(/^:(\d{6}) (\d{6}) \w{40} (\w{40}) ([AMD])\s+(.*)$/);
                     if (change) {
                         return {
-                            mode: change[3] === 'D' ? change[1] : change[2],
+                            mode: change[4] === 'D' ? change[1] : change[2],
-                            status: change[3],
+                            dstSha: change[3],
-                            path: change[4]
+                            status: change[4],
+                            path: change[5]
                         };
                     }
                     else {
@@ -1366,25 +1369,37 @@ class GitHubHelper {
             let treeSha = parentCommit.tree;
             if (commit.changes.length > 0) {
                 core.info(`Creating tree objects for local commit ${commit.sha}`);
-                const treeObjects = yield Promise.all(commit.changes.map((_a) => __awaiter(this, [_a], void 0, function* ({ path, mode, status }) {
+                const treeObjects = yield Promise.all(commit.changes.map((_a) => __awaiter(this, [_a], void 0, function* ({ path, mode, status, dstSha }) {
-                    let sha = null;
+                    if (mode === '160000') {
-                    if (status === 'A' || status === 'M') {
+                        // submodule
-                        try {
+                        core.info(`Creating tree object for submodule commit at '${path}'`);
-                            const { data: blob } = yield blobCreationLimit(() => this.octokit.rest.git.createBlob(Object.assign(Object.assign({}, repository), { content: utils.readFileBase64([repoPath, path]), encoding: 'base64' })));
+                        return {
-                            sha = blob.sha;
+                            path,
-                        }
+                            mode,
-                        catch (error) {
+                            sha: dstSha,
-                            core.error(`Error creating blob for file '${path}': ${utils.getErrorMessage(error)}`);
+                            type: 'commit'
-                            throw error;
+                        };
-                        }
+                    }
+                    else {
+                        let sha = null;
+                        if (status === 'A' || status === 'M') {
+                            try {
+                                const { data: blob } = yield blobCreationLimit(() => this.octokit.rest.git.createBlob(Object.assign(Object.assign({}, repository), { content: utils.readFileBase64([repoPath, path]), encoding: 'base64' })));
+                                sha = blob.sha;
+                            }
+                            catch (error) {
+                                core.error(`Error creating blob for file '${path}': ${utils.getErrorMessage(error)}`);
+                                throw error;
+                            }
+                        }
+                        core.info(`Creating tree object for blob at '${path}' with status '${status}'`);
+                        return {
+                            path,
+                            mode,
+                            sha,
+                            type: 'blob'
+                        };
                     }
-                    core.info(`Created blob for file '${path}'`);
-                    return {
-                        path,
-                        mode,
-                        sha,
-                        type: 'blob'
-                    };
                 })));
                 const chunkSize = 100;
                 const chunkedTreeObjects = Array.from({ length: Math.ceil(treeObjects.length / chunkSize) }, (_, i) => treeObjects.slice(i * chunkSize, i * chunkSize + chunkSize));

docs/concepts-guidelines.md

@@ -303,7 +303,7 @@ GitHub App generated tokens can be configured with fine-grained permissions and
     - Uncheck `Active` under `Webhook`. You do not need to enter a `Webhook URL`.
     - Under `Repository permissions: Contents` select `Access: Read & write`.
     - Under `Repository permissions: Pull requests` select `Access: Read & write`.
-    - Under `Repository permissions: Workflows` select `Access: Read-only`.
+    - Under `Repository permissions: Workflows` select `Access: Read & write`.
       - **NOTE**: Only needed if pull requests could contain changes to Actions workflows.
     - Under `Organization permissions: Members` select `Access: Read-only`.
       - **NOTE**: Only needed if you would like add teams as reviewers to PRs.

package-lock.json

@@ -21,12 +21,12 @@
         "uuid": "^9.0.1"
       },
       "devDependencies": {
-        "@types/jest": "^29.5.12",
+        "@types/jest": "^29.5.13",
-        "@types/node": "^18.19.48",
+        "@types/node": "^18.19.50",
         "@typescript-eslint/eslint-plugin": "^7.18.0",
         "@typescript-eslint/parser": "^7.18.0",
         "@vercel/ncc": "^0.38.1",
-        "eslint": "^8.57.0",
+        "eslint": "^8.57.1",
         "eslint-import-resolver-typescript": "^3.6.3",
         "eslint-plugin-github": "^4.10.2",
         "eslint-plugin-import": "^2.30.0",
@@ -38,7 +38,7 @@
         "js-yaml": "^4.1.0",
         "prettier": "^3.3.3",
         "ts-jest": "^29.2.5",
-        "typescript": "^5.5.4"
+        "typescript": "^5.6.2"
       }
     },
     "node_modules/@actions/core": {
@@ -735,9 +735,9 @@
       }
     },
     "node_modules/@eslint/js": {
-      "version": "8.57.0",
+      "version": "8.57.1",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.57.0.tgz",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.57.1.tgz",
-      "integrity": "sha512-Ys+3g2TaW7gADOJzPt83SJtCDhMjndcDMFVQ/Tj9iA1BfJzFKD9mAUXT3OenpuPHbI6P/myECxRJrofUsDx/5g==",
+      "integrity": "sha512-d9zaMRSTIKDLhctzH12MtXvJKSSUhaHcjV+2Z+GK+EEY7XKpP5yR4x+N3TAcHTcu963nIr+TMcCb4DBCYX1z6Q==",
       "dev": true,
       "engines": {
         "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
@@ -758,13 +758,13 @@
       "dev": true
     },
     "node_modules/@humanwhocodes/config-array": {
-      "version": "0.11.14",
+      "version": "0.13.0",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.14.tgz",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.13.0.tgz",
-      "integrity": "sha512-3T8LkOmg45BV5FICb15QQMsyUSWrQ8AygVfC7ZG32zOalnqrilm018ZVCw0eapXux8FtA33q8PSRSstjee3jSg==",
+      "integrity": "sha512-DZLEEqFWQFiyK6h5YIeynKx7JlvCYWL0cImfSRXZ9l4Sg2efkFGTuFf6vzXjK1cq6IYkU+Eg/JizXw+TD2vRNw==",
       "deprecated": "Use @eslint/config-array instead",
       "dev": true,
       "dependencies": {
-        "@humanwhocodes/object-schema": "^2.0.2",
+        "@humanwhocodes/object-schema": "^2.0.3",
         "debug": "^4.3.1",
         "minimatch": "^3.0.5"
       },
@@ -1527,9 +1527,9 @@
       }
     },
     "node_modules/@types/jest": {
-      "version": "29.5.12",
+      "version": "29.5.13",
-      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-29.5.12.tgz",
+      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-29.5.13.tgz",
-      "integrity": "sha512-eDC8bTvT/QhYdxJAulQikueigY5AsdBRH2yDKW3yveW7svY3+DzN84/2NUgkw10RTiJbWqZrTtoGVdYlvFJdLw==",
+      "integrity": "sha512-wd+MVEZCHt23V0/L642O5APvspWply/rGY5BcW4SUETo2UzPU3Z26qr8jC2qxpimI2jjx9h7+2cj2FwIr01bXg==",
       "dev": true,
       "dependencies": {
         "expect": "^29.0.0",
@@ -1560,9 +1560,9 @@
       "dev": true
     },
     "node_modules/@types/node": {
-      "version": "18.19.48",
+      "version": "18.19.50",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.48.tgz",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.50.tgz",
-      "integrity": "sha512-7WevbG4ekUcRQSZzOwxWgi5dZmTak7FaxXDoW7xVxPBmKx1rTzfmRLkeCgJzcbBnOV2dkhAPc8cCeT6agocpjg==",
+      "integrity": "sha512-xonK+NRrMBRtkL1hVCc3G+uXtjh1Al4opBLjqVmipe5ZAaBYWW6cNAiBVZ1BvmkBhep698rP3UM3aRAdSALuhg==",
       "dev": true,
       "dependencies": {
         "undici-types": "~5.26.4"
@@ -3501,16 +3501,16 @@
       }
     },
     "node_modules/eslint": {
-      "version": "8.57.0",
+      "version": "8.57.1",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.57.0.tgz",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.57.1.tgz",
-      "integrity": "sha512-dZ6+mexnaTIbSBZWgou51U6OmzIhYM2VcNdtiTtI7qPNZm35Akpr0f6vtw3w1Kmn5PYo+tZVfh13WrhpS6oLqQ==",
+      "integrity": "sha512-ypowyDxpVSYpkXr9WPv2PAZCtNip1Mv5KTW0SCurXv/9iOpcrH9PaqUElksqEB6pChqHGDRCFTyrZlGhnLNGiA==",
       "dev": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.6.1",
         "@eslint/eslintrc": "^2.1.4",
-        "@eslint/js": "8.57.0",
+        "@eslint/js": "8.57.1",
-        "@humanwhocodes/config-array": "^0.11.14",
+        "@humanwhocodes/config-array": "^0.13.0",
         "@humanwhocodes/module-importer": "^1.0.1",
         "@nodelib/fs.walk": "^1.2.8",
         "@ungap/structured-clone": "^1.2.0",
@@ -7756,9 +7756,9 @@
       }
     },
     "node_modules/typescript": {
-      "version": "5.5.4",
+      "version": "5.6.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.5.4.tgz",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.6.2.tgz",
-      "integrity": "sha512-Mtq29sKDAEYP7aljRgtPOpTvOfbwRWlS6dPRzwjdE+C0R4brX/GUyhHSecbHMFLNBLcJIPt9nl9yG5TZ1weH+Q==",
+      "integrity": "sha512-NW8ByodCSNCwZeghjN3o+JX5OFH0Ojg6sadjEKY4huZ52TqbJTJnDo5+Tw98lSy63NZvi4n+ez5m2u5d4PkZyw==",
       "dev": true,
       "bin": {
         "tsc": "bin/tsc",

package.json

@@ -41,12 +41,12 @@
     "uuid": "^9.0.1"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.12",
+    "@types/jest": "^29.5.13",
-    "@types/node": "^18.19.48",
+    "@types/node": "^18.19.50",
     "@typescript-eslint/eslint-plugin": "^7.18.0",
     "@typescript-eslint/parser": "^7.18.0",
     "@vercel/ncc": "^0.38.1",
-    "eslint": "^8.57.0",
+    "eslint": "^8.57.1",
     "eslint-import-resolver-typescript": "^3.6.3",
     "eslint-plugin-github": "^4.10.2",
     "eslint-plugin-import": "^2.30.0",
@@ -58,6 +58,6 @@
     "js-yaml": "^4.1.0",
     "prettier": "^3.3.3",
     "ts-jest": "^29.2.5",
-    "typescript": "^5.5.4"
+    "typescript": "^5.6.2"
   }
 }

src/git-command-manager.ts

@@ -14,6 +14,7 @@ export type Commit = {
   body: string
   changes: {
     mode: string
+    dstSha: string
     status: 'A' | 'M' | 'D'
     path: string
   }[]
@@ -159,6 +160,8 @@ export class GitCommandManager {
       'show',
       '--raw',
       '--cc',
+      '--no-renames',
+      '--no-abbrev',
       `--format=%H%n%T%n%P%n%G?%n%s%n%b%n${endOfBody}`,
       ref
     ])
@@ -176,13 +179,14 @@ export class GitCommandManager {
       body: detailLines.slice(5, endOfBodyIndex).join('\n'),
       changes: lines.slice(endOfBodyIndex + 2, -1).map(line => {
         const change = line.match(
-          /^:(\d{6}) (\d{6}) \w{7} \w{7} ([AMD])\s+(.*)$/
+          /^:(\d{6}) (\d{6}) \w{40} (\w{40}) ([AMD])\s+(.*)$/
         )
         if (change) {
           return {
-            mode: change[3] === 'D' ? change[1] : change[2],
+            mode: change[4] === 'D' ? change[1] : change[2],
-            status: change[3],
+            dstSha: change[3],
-            path: change[4]
+            status: change[4],
+            path: change[5]
           }
         } else {
           unparsedChanges.push(line)

src/github-helper.ts

@@ -35,7 +35,7 @@ type TreeObject = {
   path: string
   mode: '100644' | '100755' | '040000' | '160000' | '120000'
   sha: string | null
-  type: 'blob'
+  type: 'blob' | 'commit'
 }
 
 export class GitHubHelper {
@@ -255,31 +255,44 @@ export class GitHubHelper {
     if (commit.changes.length > 0) {
       core.info(`Creating tree objects for local commit ${commit.sha}`)
       const treeObjects = await Promise.all(
-        commit.changes.map(async ({path, mode, status}) => {
+        commit.changes.map(async ({path, mode, status, dstSha}) => {
-          let sha: string | null = null
+          if (mode === '160000') {
-          if (status === 'A' || status === 'M') {
+            // submodule
-            try {
+            core.info(`Creating tree object for submodule commit at '${path}'`)
-              const {data: blob} = await blobCreationLimit(() =>
+            return <TreeObject>{
-                this.octokit.rest.git.createBlob({
+              path,
-                  ...repository,
+              mode,
-                  content: utils.readFileBase64([repoPath, path]),
+              sha: dstSha,
-                  encoding: 'base64'
+              type: 'commit'
-                })
+            }
-              )
+          } else {
-              sha = blob.sha
+            let sha: string | null = null
-            } catch (error) {
+            if (status === 'A' || status === 'M') {
-              core.error(
+              try {
-                `Error creating blob for file '${path}': ${utils.getErrorMessage(error)}`
+                const {data: blob} = await blobCreationLimit(() =>
-              )
+                  this.octokit.rest.git.createBlob({
-              throw error
+                    ...repository,
+                    content: utils.readFileBase64([repoPath, path]),
+                    encoding: 'base64'
+                  })
+                )
+                sha = blob.sha
+              } catch (error) {
+                core.error(
+                  `Error creating blob for file '${path}': ${utils.getErrorMessage(error)}`
+                )
+                throw error
+              }
+            }
+            core.info(
+              `Creating tree object for blob at '${path}' with status '${status}'`
+            )
+            return <TreeObject>{
+              path,
+              mode,
+              sha,
+              type: 'blob'
             }
-          }
-          core.info(`Created blob for file '${path}'`)
-          return <TreeObject>{
-            path,
-            mode,
-            sha,
-            type: 'blob'
           }
         })
       )