Merge branch 'main' into sec

Co-authored-by: jackton1 <jackton1@users.noreply.github.com>

.github/workflows/submodule-sync.yml

@@ -19,7 +19,7 @@ jobs:
           git submodule update --remote --recursive
       
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v4.2.4
+        uses: peter-evans/create-pull-request@v5.0.0
         with:
           title: "Updated submodule"
           labels: "merge when passing"

.github/workflows/sync-release-version.yml

@@ -32,6 +32,7 @@ jobs:
 
   update-version:
     runs-on: ubuntu-latest
+    needs: create-sec-tag
     steps:
       - uses: actions/checkout@v3
         with:
@@ -49,7 +50,7 @@ jobs:
       - name: Run git-cliff
         uses: tj-actions/git-cliff@v1
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v4.2.4
+        uses: peter-evans/create-pull-request@v5.0.0
         with:
           base: "main"
           labels: "merge when passing"

.github/workflows/test.yml

@@ -7,9 +7,11 @@ on:
   pull_request:
     branches:
       - main
+      - sec
   pull_request_review:
     branches:
       - main
+      - sec
 
 jobs:
   shellcheck:

.github/workflows/update-readme.yml

@@ -34,7 +34,7 @@ jobs:
 
       - name: Create Pull Request
         if: failure()
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v5
         with:
           base: "main"
           labels: "merge when passing"

README.md

@@ -63,7 +63,7 @@ Retrieve all changed files and directories relative to a target branch, preceedi
 
 ## Usage
 
-> NOTE: :warning:
+> **Warning**:
 >
 > *   **IMPORTANT:** For `push` events you need to include `fetch-depth: 0` **OR** `fetch-depth: 2` depending on your use case.
 > *   For monorepos where pulling all the branch history might not be desired, you can omit `fetch-depth` for `pull_request` events.
@@ -350,7 +350,6 @@ See [action.yml](action.yml#L264) for a list of all available keys.
 
 ```yaml
 ...
-
    - name: Get changed files and write the outputs to a json file
      id: changed-files-write-output-files-json
      uses: ./
@@ -665,7 +664,7 @@ See [inputs](#inputs) for more information.
 </li>
 </ul>
 
-> NOTE: This setting overrides the commit sha used by setting `since_last_remote_commit` to true.
+> **Warning**: This setting overrides the commit sha used by setting `since_last_remote_commit` to true.
 > It is recommended to use either solution that works for your use case.
 
 See [inputs](#inputs) for more information.
@@ -745,7 +744,7 @@ And many more...
 
 ## Known Limitation
 
-> NOTE: :warning:
+> **Warning**:
 >
 > *   Using characters like `\n`, `%`, `.` and `\r` as separators would be [URL encoded](https://www.w3schools.com/tags/ref_urlencode.asp)
 > *   Spaces in file names can introduce bugs when using bash loops. See: [#216](https://github.com/tj-actions/changed-files/issues/216)
@@ -757,43 +756,26 @@ And many more...
 
 With the switch from using grep's Extended regex to match files to the natively supported workflow glob pattern matching syntax introduced in [v13](https://github.com/tj-actions/changed-files/releases/tag/v13) you'll need to modify patterns used to match `files`.
 
-**BEFORE**
-
-```yml
+```diff
 ...
-
-      - name: Get specific changed files
-        id: changed-files-specific
-        uses: tj-actions/changed-files@v12.2
-        with:
-          files: |
-            \.sh$
-            .(sql|py)$
-            ^(mynewfile|custom)
-```
-
-**AFTER**
-
-```yml
-...
-
       - name: Get specific changed files
         id: changed-files-specific
         uses: tj-actions/changed-files@v24
         with:
           files: |
-            *.sh
-            *.sql
-            *.py
-            mynewfile
-            custom/**
+-            \.sh$
+-            .(sql|py)$
+-            ^(dir1|dir2)
++            *.{sh,sql,py}
++            dir1
++            dir2
 ```
 
 *   Free software: [MIT license](LICENSE)
 
 ## Credits
 
-This package was created with [Cookiecutter](https://github.com/cookiecutter/cookiecutter).
+This package was created with [cookiecutter-action](https://github.com/tj-actions/cookiecutter-action).
 
 *   [tj-actions/glob](https://github.com/tj-actions/glob)
 *   [tj-actions/auto-doc](https://github.com/tj-actions/auto-doc)

action.yml

@@ -208,7 +208,7 @@ runs:
         INPUT_FETCH_DEPTH: ${{ inputs.fetch_depth }}
         INPUT_SINCE_LAST_REMOTE_COMMIT: ${{ inputs.since_last_remote_commit }}
     - name: Glob match
-      uses: tj-actions/glob@v16.14
+      uses: tj-actions/glob@eb138047b8b00dafdd53554152f8885f68a891f6 # v17.1.0
       id: glob
       with:
         files: ${{ inputs.files }}
@@ -255,7 +255,7 @@ runs:
         INPUT_HAS_CUSTOM_PATTERNS: ${{ steps.glob.outputs.has-custom-patterns }}
         INPUT_JSON_RAW_FORMAT: ${{ inputs.json_raw_format }}
     - name: Generate output files
-      uses: tj-actions/json2file@v1.4.0
+      uses: tj-actions/json2file@46d3707a327c0049b276be5977a89354b9310003 # v1.4.2
       if: inputs.write_output_files == 'true'
       with:
         outputs: ${{ toJSON(steps.changed-files.outputs) }}

diff-sha.sh

@@ -251,13 +251,13 @@ else
 
       if [[ "$IS_SHALLOW" == "true" ]]; then
         # check if the merge base is in the local history
-        if ! git merge-base "$PREVIOUS_SHA" "$CURRENT_SHA" 1>/dev/null 2>&1; then
+        if ! git diff --name-only --ignore-submodules=all "$PREVIOUS_SHA$DIFF$CURRENT_SHA" 1>/dev/null 2>&1; then
           echo "::debug::Merge base is not in the local history, fetching remote target branch..."
           # Fetch more of the target branch history until the merge base is found
           for i in {1..10}; do
             # shellcheck disable=SC2086
             git fetch $EXTRA_ARGS -u --progress --deepen="$INPUT_FETCH_DEPTH" origin +refs/heads/"$TARGET_BRANCH":refs/remotes/origin/"$TARGET_BRANCH" 1>/dev/null
-            if git merge-base "$PREVIOUS_SHA" "$CURRENT_SHA" 1>/dev/null 2>&1; then
+            if git diff --name-only --ignore-submodules=all "$PREVIOUS_SHA$DIFF$CURRENT_SHA" 1>/dev/null 2>&1; then
               break
             fi
             echo "::debug::Merge base is not in the local history, fetching remote target branch again..."

get-changed-paths.sh

@@ -126,7 +126,7 @@ function get_renames() {
       (
         cd "$sub" && (
           # the strange magic number is a hardcoded "empty tree" commit sha
-          git log --name-status --ignore-submodules=all "${sub_commit_pre:-4b825dc642cb6eb9a060e54bf8d69288fbee4904}".."${sub_commit_cur}" | { grep -E "^R" || true; } | awk -F '\t' -v d="$INPUT_OLD_NEW_SEPARATOR" '{print $2d$3}' | awk -v r="$sub" '{ print "" r "/" $0}'
+          get_renames "${sub_commit_pre:-4b825dc642cb6eb9a060e54bf8d69288fbee4904}" "${sub_commit_cur}" | awk -v r="$sub" '{ print "" r "/" $0}'
         )
       ) || {
         echo "::warning::Failed to get renamed files for submodule ($sub) between: ${sub_commit_pre:-4b825dc642cb6eb9a060e54bf8d69288fbee4904} ${sub_commit_cur}. Please ensure that submodules are initialized and up to date. See: https://github.com/actions/checkout#usage" >&2
@@ -134,7 +134,7 @@ function get_renames() {
     fi
   done < <(git submodule | awk '{print $2}')
 
-  git log --name-status --ignore-submodules=all "$base".."$sha" | { grep -E "^R" || true; } | awk -F '\t' -v d="$INPUT_OLD_NEW_SEPARATOR" '{print $2d$3}' && exit_status=$? || exit_status=$?
+  git diff --name-status --ignore-submodules=all --diff-filter=R "$base$DIFF$sha" | { grep -E "^R" || true; } | awk -F '\t' -v d="$INPUT_OLD_NEW_SEPARATOR" '{print $2d$3}' && exit_status=$? || exit_status=$?
 
   if [[ $exit_status -ne 0 ]]; then
     echo "::error::Failed to get renamed files between: $base → $sha" >&2

renovate.json

@@ -3,8 +3,8 @@
     "config:base"
   ],
   "enabled": true,
-  "prHourlyLimit": 10,
-  "prConcurrentLimit": 5,
+  "prHourlyLimit": 30,
+  "prConcurrentLimit": 10,
   "rebaseWhen": "behind-base-branch",
   "addLabels": [
     "dependencies",