generateFetchStepLines generates a "Fetch additional refs" YAML step for the given checkout entry when it has fetch refs configured. Returns an empty string when there are no fetch refs. The index parameter identifies the checkout's position in the ordered list, used to reference the correct app tok
(entry *resolvedCheckout, index int)
| 637 | // (like all GitHub Actions environment variables containing secrets); GitHub Actions |
| 638 | // automatically masks secret values in logs. |
| 639 | func generateFetchStepLines(entry *resolvedCheckout, index int) string { |
| 640 | if len(entry.fetchRefs) == 0 { |
| 641 | return "" |
| 642 | } |
| 643 | |
| 644 | checkoutManagerLog.Printf("Generating fetch step for index=%d, refs=%v", index, entry.fetchRefs) |
| 645 | |
| 646 | // Build step name |
| 647 | name := "Fetch additional refs" |
| 648 | if entry.key.repository != "" { |
| 649 | name = "Fetch additional refs for " + entry.key.repository |
| 650 | } |
| 651 | |
| 652 | // Determine authentication token |
| 653 | token := resolveCheckoutTokenExpression(entry, index, true) |
| 654 | |
| 655 | // Build refspecs |
| 656 | refspecs := make([]string, 0, len(entry.fetchRefs)) |
| 657 | for _, ref := range entry.fetchRefs { |
| 658 | refspecs = append(refspecs, fmt.Sprintf("'%s'", fetchRefToRefspec(ref))) |
| 659 | } |
| 660 | |
| 661 | // Build the git command, navigating to the checkout directory when needed |
| 662 | gitPrefix := "git" |
| 663 | if entry.key.path != "" { |
| 664 | gitPrefix = fmt.Sprintf(`git -C "${{ github.workspace }}/%s"`, entry.key.path) |
| 665 | } |
| 666 | |
| 667 | // Mirror the fetch-depth from the actions/checkout step so this fetch doesn't |
| 668 | // expand a shallow clone into a full-history fetch. |
| 669 | // - nil (unset) → actions/checkout defaults to depth=1; pass --depth=1 |
| 670 | // - 0 → full history explicitly requested; omit the flag |
| 671 | // - N > 0 → pass --depth=N to match |
| 672 | depthFlag := "" |
| 673 | effectiveDepth := 1 |
| 674 | if entry.fetchDepth != nil { |
| 675 | effectiveDepth = *entry.fetchDepth |
| 676 | } |
| 677 | if effectiveDepth > 0 { |
| 678 | depthFlag = fmt.Sprintf(" --depth=%d", effectiveDepth) |
| 679 | } |
| 680 | |
| 681 | var sb strings.Builder |
| 682 | fmt.Fprintf(&sb, " - name: %s\n", name) |
| 683 | sb.WriteString(" env:\n") |
| 684 | fmt.Fprintf(&sb, " GH_AW_FETCH_TOKEN: %s\n", token) |
| 685 | sb.WriteString(" run: |\n") |
| 686 | sb.WriteString(" header=$(printf \"x-access-token:%s\" \"${GH_AW_FETCH_TOKEN}\" | base64 -w 0)\n") |
| 687 | fmt.Fprintf(&sb, ` %s -c "http.extraheader=Authorization: Basic ${header}" fetch origin%s %s`+"\n", |
| 688 | gitPrefix, depthFlag, strings.Join(refspecs, " ")) |
| 689 | return sb.String() |
| 690 | } |
| 691 | |
| 692 | func resolveCheckoutTokenExpression(entry *resolvedCheckout, checkoutIndex int, defaultWhenEmpty bool) string { |
| 693 | token := entry.token |