checkout
Otheractions/checkout
GitHub Action for checking out a repository from GitHub.
Overview
The checkout action checks out your repository under $GITHUB_WORKSPACE, allowing workflows to access the code. It supports authentication, sparse checkout, submodules, and various fetch options. It is officially maintained by GitHub.
README Preview
[](https://github.com/actions/checkout/actions/workflows/test.yml)\n\n# Checkout v7\n\n## What's new\n\n- Safer fork pull request handling: checkout now refuses to check out fork pull request code by default when the workflow is triggered by `pull_request_target` or `workflow_run`. These triggers run with the base repository's `GITHUB_TOKEN`, secrets, and runner access, where executing a fork's code commonly leads to "pwn request" vulnerabilities.\n - To opt in after [reviewing the risks](https://gh.io/securely-using-pull_request_target), set the new `allow-unsafe-pr-checkout: true` input.\n- Migrated `actions/checkout` to ESM to support new versions of the `@actions/*` packages.\n- Updated direct and transitive dependencies, including security fixes for known vulnerabilities.\n\n# Checkout v6\n\n## What's new\n\n- Improved credential security: `persist-credentials` now stores credentials in a separate file under `$RUNNER_TEMP` instead of directly in `.git/config`\n- No workflow changes required — `git fetch`, `git push`, etc. continue to work automatically\n- Running authenticated git commands from a [Docker container action](https://docs.github.com/actions/sharing-automations/creating-actions/creating-a-docker-container-action) requires Actions Runner [v2.329.0](https://github.com/actions/runner/releases/tag/v2.329.0) or later\n\n# Checkout v5\n\n## What's new\n\n- Updated to the node24 runtime\n - This requires a minimum Actions Runner version of [v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) to run.\n\n# Checkout v4\n\nThis action checks-out your repository under `$GITHUB_WORKSPACE`, so your workflow can access it.\n\nOnly a single commit is fetched by default, for the ref/SHA that triggered the workflow. Set `fetch-depth: 0` to fetch all history for all branches and tags. Refer [here](https://docs.github.com/actions/using-workflows/events-that-trigger-workflows) to learn which commit `$GITHUB_SHA` points to for different events.\n\nThe au
FAQ (5)
TroubleshootingHow do I fix actions/checkout v7 "error: invalid pattern" during cleanup on a Windows self-hosted runner?
This is a bug in actions/checkout v7.0.0. On Windows, the cleanup command passes a credential path such as C:\runner\_work\_temp\... to git config --unset, and Git interprets backslashes in that value as a regex pattern.
Upgrade to **v7.0.1 or later**, which escapes the value passed to --unset:
- uses: actions/checkout@v7.0.1If you pin the action by SHA, use the SHA corresponding to the v7.0.1 release.
As a temporary workaround, pin the verified working v5.0.1 release:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1After upgrading, rerun the workflow. If stale includeIf entries remain in a persistent self-hosted worktree, inspect .git/config and remove the checkout-created includeIf.gitdir:...path entries pointing to the temporary git-credentials-*.config file.
TroubleshootingHow do I fix proxy authentication failures when actions/checkout uses URL-encoded proxy credentials?
Upgrade @actions/http-client to version 2.2.3 (the bug was fixed in 2.2.2). Run npm install @actions/http-client@2.2.3 and verify package-lock.json references the updated version. If you are using actions/checkout in a workflow, upgrade to a release that bundles @actions/http-client 2.2.3 or later. Earlier versions send URL-encoded credentials to the proxy without decoding them, causing proxy authentication to fail.
TroubleshootingHow to fix the actions/checkout `assertSafePrCheckout` false positive on a default `pull_request_target` checkout?
This false positive occurs when a same-repository checkout without an explicit ref runs on pull_request_target and the event SHA matches the PR head SHA. It was fixed in PR #2518, which skips the unsafe-PR check for default checkouts. The fix was backported to releases/v2 through releases/v6; the backport enforcement date was moved to Monday, July 20, 2026. Workflows using floating tags such as actions/checkout@v6, @v5, @v4, @v3, or @v2 receive the update automatically. If you pinned an action by SHA, update to the patched commit for your major version. actions/checkout@v1 does not receive the backport. Avoid enabling allow-unsafe-pr-checkout: true unless you explicitly need the unsafe behavior and trust the checked-out code.
TroubleshootingHow to cache Git LFS objects in GitHub Actions to avoid exhausting the LFS download quota?
Use actions/cache for Git LFS's content-addressed object store and disable automatic LFS download during checkout:
steps:
- uses: actions/checkout@v4
with:
lfs: false
- name: Restore Git LFS cache
uses: actions/cache@v4
with:
path: .git/lfs/objects
key: lfs-${{ runner.os }}-${{ github.sha }}
restore-keys: |
lfs-${{ runner.os }}-
- name: Fetch LFS files
run: |
git lfs pull
git lfs checkoutOn a cache hit, existing LFS objects are already present in .git/lfs/objects, so git lfs pull only downloads new or missing objects instead of everything. Do not use lfs: true with this flow because checkout would download LFS files before the cache is restored.
If files remain as pointer text, run git lfs checkout after git lfs pull. To fetch only part of the repository, use git lfs pull --include="path/to/files/*".
TroubleshootingHow to fix GitHub Actions 'repository not found' when checking out a private repository?
This can occur during a GitHub incident when the automatic GITHUB_TOKEN temporarily lacks permission to access private repositories, causing Git to exit with code 128. Check https://www.githubstatus.com/ for active incidents. If an incident is in progress, wait for GitHub to resolve it and then re-run the failed workflow. The repository URL and workflow configuration may not need to be changed.