Merge branch 'main' into sec

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/submodule-sync.yml

@@ -19,7 +19,7 @@ jobs:
           git submodule update --remote --recursive
       
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v5.0.0
+        uses: peter-evans/create-pull-request@v4.2.4
         with:
           title: "Updated submodule"
           labels: "merge when passing"

.github/workflows/sync-release-version.yml

@@ -32,7 +32,6 @@ jobs:
 
   update-version:
     runs-on: ubuntu-latest
-    needs: create-sec-tag
     steps:
       - uses: actions/checkout@v3
         with:
@@ -50,7 +49,7 @@ jobs:
       - name: Run git-cliff
         uses: tj-actions/git-cliff@v1
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v5.0.0
+        uses: peter-evans/create-pull-request@v4.2.4
         with:
           base: "main"
           labels: "merge when passing"

.github/workflows/test.yml

@@ -7,11 +7,9 @@ on:
   pull_request:
     branches:
       - main
-      - sec
   pull_request_review:
     branches:
       - main
-      - sec
 
 jobs:
   shellcheck:

.github/workflows/update-readme.yml

@@ -34,7 +34,7 @@ jobs:
 
       - name: Create Pull Request
         if: failure()
-        uses: peter-evans/create-pull-request@v5
+        uses: peter-evans/create-pull-request@v4
         with:
           base: "main"
           labels: "merge when passing"

README.md

@@ -63,7 +63,7 @@ Retrieve all changed files and directories relative to a target branch, preceedi
 
 ## Usage
 
-> **Warning**:
+> NOTE: :warning:
 >
 > *   **IMPORTANT:** For `push` events you need to include `fetch-depth: 0` **OR** `fetch-depth: 2` depending on your use case.
 > *   For monorepos where pulling all the branch history might not be desired, you can omit `fetch-depth` for `pull_request` events.
@@ -350,6 +350,7 @@ See [action.yml](action.yml#L264) for a list of all available keys.
 
 ```yaml
 ...
+
    - name: Get changed files and write the outputs to a json file
      id: changed-files-write-output-files-json
      uses: ./
@@ -664,7 +665,7 @@ See [inputs](#inputs) for more information.
 </li>
 </ul>
 
-> **Warning**: This setting overrides the commit sha used by setting `since_last_remote_commit` to true.
+> NOTE: This setting overrides the commit sha used by setting `since_last_remote_commit` to true.
 > It is recommended to use either solution that works for your use case.
 
 See [inputs](#inputs) for more information.
@@ -744,7 +745,7 @@ And many more...
 
 ## Known Limitation
 
-> **Warning**:
+> NOTE: :warning:
 >
 > *   Using characters like `\n`, `%`, `.` and `\r` as separators would be [URL encoded](https://www.w3schools.com/tags/ref_urlencode.asp)
 > *   Spaces in file names can introduce bugs when using bash loops. See: [#216](https://github.com/tj-actions/changed-files/issues/216)
@@ -756,26 +757,43 @@ And many more...
 
 With the switch from using grep's Extended regex to match files to the natively supported workflow glob pattern matching syntax introduced in [v13](https://github.com/tj-actions/changed-files/releases/tag/v13) you'll need to modify patterns used to match `files`.
 
-```diff
+**BEFORE**
+
+```yml
 ...
+
+      - name: Get specific changed files
+        id: changed-files-specific
+        uses: tj-actions/changed-files@v12.2
+        with:
+          files: |
+            \.sh$
+            .(sql|py)$
+            ^(mynewfile|custom)
+```
+
+**AFTER**
+
+```yml
+...
+
       - name: Get specific changed files
         id: changed-files-specific
         uses: tj-actions/changed-files@v24
         with:
           files: |
--            \.sh$
--            .(sql|py)$
--            ^(dir1|dir2)
-+            *.{sh,sql,py}
-+            dir1
-+            dir2
+            *.sh
+            *.sql
+            *.py
+            mynewfile
+            custom/**
 ```
 
 *   Free software: [MIT license](LICENSE)
 
 ## Credits
 
-This package was created with [cookiecutter-action](https://github.com/tj-actions/cookiecutter-action).
+This package was created with [Cookiecutter](https://github.com/cookiecutter/cookiecutter).
 
 *   [tj-actions/glob](https://github.com/tj-actions/glob)
 *   [tj-actions/auto-doc](https://github.com/tj-actions/auto-doc)

action.yml

@@ -208,7 +208,7 @@ runs:
         INPUT_FETCH_DEPTH: ${{ inputs.fetch_depth }}
         INPUT_SINCE_LAST_REMOTE_COMMIT: ${{ inputs.since_last_remote_commit }}
     - name: Glob match
-      uses: tj-actions/glob@v17.2.5
+      uses: tj-actions/glob@825a28bd3761909f83c56df3a13ccd5dbfa367b6 # v16.14
       id: glob
       with:
         files: ${{ inputs.files }}
@@ -255,7 +255,7 @@ runs:
         INPUT_HAS_CUSTOM_PATTERNS: ${{ steps.glob.outputs.has-custom-patterns }}
         INPUT_JSON_RAW_FORMAT: ${{ inputs.json_raw_format }}
     - name: Generate output files
-      uses: tj-actions/json2file@v1.4.2
+      uses: tj-actions/json2file@c56bc641b77b7b29451be35949e452fcadadf0d0 # v1.4.0
       if: inputs.write_output_files == 'true'
       with:
         outputs: ${{ toJSON(steps.changed-files.outputs) }}

diff-sha.sh

@@ -133,23 +133,23 @@ if [[ -z $GITHUB_EVENT_PULL_REQUEST_BASE_REF ]]; then
         if [[ "$GITHUB_EVENT_FORCED" == "false" || -z "$GITHUB_EVENT_FORCED" ]]; then
           PREVIOUS_SHA=$GITHUB_EVENT_BEFORE && exit_status=$? || exit_status=$?
         else
-          PREVIOUS_SHA=$(git rev-list -n 1 "HEAD^" || true) && exit_status=$? || exit_status=$?
+          PREVIOUS_SHA=$(git rev-list -n 1 "HEAD^") && exit_status=$? || exit_status=$?
         fi
       else
-        PREVIOUS_SHA=$(git rev-list -n 1 "HEAD^" || true) && exit_status=$? || exit_status=$?
+        PREVIOUS_SHA=$(git rev-list -n 1 "HEAD^") && exit_status=$? || exit_status=$?
       fi
 
       if [[ -z "$PREVIOUS_SHA" || "$PREVIOUS_SHA" == "0000000000000000000000000000000000000000" ]]; then
-        PREVIOUS_SHA=$(git rev-list -n 1 "HEAD^" || true) && exit_status=$? || exit_status=$?
+        PREVIOUS_SHA=$(git rev-list -n 1 "HEAD^") && exit_status=$? || exit_status=$?
       fi
 
-      if [[ -z "$PREVIOUS_SHA" || "$PREVIOUS_SHA" == "$CURRENT_SHA" ]]; then
-        if ! git rev-parse "$CURRENT_SHA^1" &>/dev/null; then
+      if [[ "$PREVIOUS_SHA" == "$CURRENT_SHA" ]]; then
+        if ! git rev-parse "$PREVIOUS_SHA^1" &>/dev/null; then
           INITIAL_COMMIT="true"
           PREVIOUS_SHA=$(git rev-parse "$CURRENT_SHA")
           echo "::warning::Initial commit detected no previous commit found."
         else
-          PREVIOUS_SHA=$(git rev-parse "$CURRENT_SHA^1")
+          PREVIOUS_SHA=$(git rev-parse "$PREVIOUS_SHA^1")
         fi
       else
         if [[ -z "$PREVIOUS_SHA" ]]; then
@@ -251,13 +251,13 @@ else
 
       if [[ "$IS_SHALLOW" == "true" ]]; then
         # check if the merge base is in the local history
-        if ! git diff --name-only --ignore-submodules=all "$PREVIOUS_SHA$DIFF$CURRENT_SHA" 1>/dev/null 2>&1; then
+        if ! git merge-base "$PREVIOUS_SHA" "$CURRENT_SHA" 1>/dev/null 2>&1; then
           echo "::debug::Merge base is not in the local history, fetching remote target branch..."
           # Fetch more of the target branch history until the merge base is found
           for i in {1..10}; do
             # shellcheck disable=SC2086
             git fetch $EXTRA_ARGS -u --progress --deepen="$INPUT_FETCH_DEPTH" origin +refs/heads/"$TARGET_BRANCH":refs/remotes/origin/"$TARGET_BRANCH" 1>/dev/null
-            if git diff --name-only --ignore-submodules=all "$PREVIOUS_SHA$DIFF$CURRENT_SHA" 1>/dev/null 2>&1; then
+            if git merge-base "$PREVIOUS_SHA" "$CURRENT_SHA" 1>/dev/null 2>&1; then
               break
             fi
             echo "::debug::Merge base is not in the local history, fetching remote target branch again..."

get-changed-paths.sh

@@ -126,7 +126,7 @@ function get_renames() {
       (
         cd "$sub" && (
           # the strange magic number is a hardcoded "empty tree" commit sha
-          get_renames "${sub_commit_pre:-4b825dc642cb6eb9a060e54bf8d69288fbee4904}" "${sub_commit_cur}" | awk -v r="$sub" '{ print "" r "/" $0}'
+          git log --name-status --ignore-submodules=all "${sub_commit_pre:-4b825dc642cb6eb9a060e54bf8d69288fbee4904}".."${sub_commit_cur}" | { grep -E "^R" || true; } | awk -F '\t' -v d="$INPUT_OLD_NEW_SEPARATOR" '{print $2d$3}' | awk -v r="$sub" '{ print "" r "/" $0}'
         )
       ) || {
         echo "::warning::Failed to get renamed files for submodule ($sub) between: ${sub_commit_pre:-4b825dc642cb6eb9a060e54bf8d69288fbee4904} ${sub_commit_cur}. Please ensure that submodules are initialized and up to date. See: https://github.com/actions/checkout#usage" >&2
@@ -134,7 +134,7 @@ function get_renames() {
     fi
   done < <(git submodule | awk '{print $2}')
 
-  git diff --name-status --ignore-submodules=all --diff-filter=R "$base$DIFF$sha" | { grep -E "^R" || true; } | awk -F '\t' -v d="$INPUT_OLD_NEW_SEPARATOR" '{print $2d$3}' && exit_status=$? || exit_status=$?
+  git log --name-status --ignore-submodules=all "$base".."$sha" | { grep -E "^R" || true; } | awk -F '\t' -v d="$INPUT_OLD_NEW_SEPARATOR" '{print $2d$3}' && exit_status=$? || exit_status=$?
 
   if [[ $exit_status -ne 0 ]]; then
     echo "::error::Failed to get renamed files between: $base → $sha" >&2

renovate.json

@@ -3,8 +3,8 @@
     "config:base"
   ],
   "enabled": true,
-  "prHourlyLimit": 30,
-  "prConcurrentLimit": 10,
+  "prHourlyLimit": 10,
+  "prConcurrentLimit": 5,
   "rebaseWhen": "behind-base-branch",
   "addLabels": [
     "dependencies",