openshift-pipelines
diff --git a/‎head‎
Lines changed: 1 addition & 1 deletion b/‎head‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎upstream/.github/workflows/build.yaml‎
Lines changed: 2 additions & 2 deletions b/‎upstream/.github/workflows/build.yaml‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎upstream/.github/workflows/release.yaml‎
Lines changed: 5 additions & 5 deletions b/‎upstream/.github/workflows/release.yaml‎
Lines changed: 5 additions & 5 deletions
diff --git a/‎upstream/image/git-init/git/git.go‎
Lines changed: 16 additions & 6 deletions b/‎upstream/image/git-init/git/git.go‎
Lines changed: 16 additions & 6 deletions
diff --git a/‎upstream/image/git-init/git/git_test.go‎
Lines changed: 93 additions & 1 deletion b/‎upstream/image/git-init/git/git_test.go‎
Lines changed: 93 additions & 1 deletion
diff --git a/‎upstream/image/git-init/go.mod‎
Lines changed: 34 additions & 34 deletions b/‎upstream/image/git-init/go.mod‎
Lines changed: 34 additions & 34 deletions
@@ -1 +1 @@
-768a778f1f7ccee8a4dd142e7f115e12c7e422fd
+a2dd81492d93730eb5ce60564ee0e8f87ae4c84c
@@ -19,8 +19,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: "image/git-init/go.mod"
           cache-dependency-path: "image/git-init/go.sum"
 
@@ -26,27 +26,27 @@ jobs:
     #   run:
     #     working-directory: ./image/git-init
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - run: git fetch --prune --unshallow
 
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: "image/git-init/go.mod"
           cache-dependency-path: "image/git-init/go.sum"
 
       # This installs the current latest release.
       - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
 
-      - uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4
+      - uses: imjasonh/setup-crane@6da1ae018866400525525ce74ff892880c099987 # v0.5
 
-      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
 
       - name: Set tag output
         id: tag
         run: echo "tag_name=${GITHUB_REF#refs/*/}" >> "$GITHUB_OUTPUT"
 
-      - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+      - uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
         id: run-goreleaser
         with:
           version: latest
 
@@ -167,6 +167,11 @@ func Fetch(logger *zap.SugaredLogger, spec FetchSpec, retryConfig RetryConfig) e
 	}
 	if spec.Depth > 0 {
 		fetchArgs = append(fetchArgs, fmt.Sprintf("--depth=%d", spec.Depth))
+
+		// Prevent fetching of unrelated git objects with shallow clones.
+		if _, err := run(logger, "", "config", "--unset", "remote.origin.fetch"); err != nil {
+			logger.Warnf("Failed to unset remote.origin.fetch in git config: %s", err)
+		}
 	}
 
 	// Fetch the revision and verify with FETCH_HEAD
@@ -241,19 +246,24 @@ func showRef(logger *zap.SugaredLogger, revision, path string) (string, error) {
 	return strings.TrimSuffix(output, "\n"), nil
 }
 
-func submoduleFetch(logger *zap.SugaredLogger, spec FetchSpec, retryConfig RetryConfig) error {
-	if spec.Path != "" {
-		if err := os.Chdir(spec.Path); err != nil {
-			return fmt.Errorf("failed to change directory with path %s; err: %w", spec.Path, err)
-		}
-	}
+func buildSubmoduleUpdateArgs(spec FetchSpec) []string {
 	updateArgs := []string{"submodule", "update", "--recursive", "--init", "--force"}
 	if spec.Depth > 0 {
 		updateArgs = append(updateArgs, fmt.Sprintf("--depth=%d", spec.Depth))
 	}
 	if len(spec.SubmodulePaths) > 0 {
 		updateArgs = append(updateArgs, spec.SubmodulePaths...)
 	}
+	return updateArgs
+}
+
+func submoduleFetch(logger *zap.SugaredLogger, spec FetchSpec, retryConfig RetryConfig) error {
+	if spec.Path != "" {
+		if err := os.Chdir(spec.Path); err != nil {
+			return fmt.Errorf("failed to change directory with path %s; err: %w", spec.Path, err)
+		}
+	}
+	updateArgs := buildSubmoduleUpdateArgs(spec)
 	if _, _, err := retryWithBackoff(
 		func() (string, error) { return run(logger, "", updateArgs...) },
 		retryConfig.Initial,
 
@@ -361,6 +361,23 @@ func TestFetch(t *testing.T) {
 				HTTPSProxy:     "",
 				NOProxy:        "",
 			},
+		}, {
+			name:       "test-clone-with-depth",
+			logMessage: "Successfully cloned",
+			wantErr:    false,
+			spec: FetchSpec{
+				URL:                       "",
+				Revision:                  "",
+				Refspec:                   "",
+				Path:                      "",
+				Depth:                     1,
+				Submodules:                false,
+				SSLVerify:                 false,
+				HTTPProxy:                 "",
+				HTTPSProxy:                "",
+				NOProxy:                   "",
+				SparseCheckoutDirectories: "",
+			},
 		},
 	}
 	for _, tt := range tests {
@@ -372,6 +389,7 @@ func TestFetch(t *testing.T) {
 				}
 			}()
 			logger := zap.New(observer).Sugar()
+			logLine := 1
 
 			submodPath := ""
 			submodName := "default"
@@ -421,10 +439,42 @@ func TestFetch(t *testing.T) {
 					t.Errorf("directory patterns and sparse-checkout patterns do not match")
 				}
 			}
-			logLine := 1
+
+			if tt.spec.Depth > 0 {
+				shallowFile, err := os.Open(".git/shallow")
+				if err != nil {
+					t.Fatal("Faile to read shallow file")
+				}
+				defer shallowFile.Close()
+
+				var commitCount int
+				scanner := bufio.NewScanner(shallowFile)
+				for scanner.Scan() {
+					commitCount++
+				}
+				if commitCount != int(tt.spec.Depth) {
+					t.Errorf("Expected %d commits in shallow file, got %d", tt.spec.Depth, commitCount)
+				}
+
+				// Verify remote.origin.fetch was unset
+				_, err = run(logger, "", "config", "--get", "remote.origin.fetch")
+				if err == nil {
+					t.Error("git fetch config should be unset for a shallow clone")
+				}
+			}
+
 			if tt.spec.Submodules {
+				submoduleDirs, err := filepath.Glob(".git/modules/*")
+				if err != nil {
+					t.Fatalf("Error finding submodule directories: %v", err)
+				}
+
+				if len(submoduleDirs) == 0 {
+					t.Error("No cloned submodules found")
+				}
 				logLine = 3
 			}
+
 			checkLogMessage(t, tt.logMessage, log, logLine)
 		})
 	}
@@ -510,6 +560,48 @@ func (f *SucceedAfter) Run() (string, error) {
 	return "", fmt.Errorf("temporary error")
 }
 
+func TestBuildSubmoduleUpdateArgs(t *testing.T) {
+	tests := []struct {
+		name     string
+		spec     FetchSpec
+		expected []string
+	}{
+		{
+			name: "no depth, no submodule paths",
+			spec: FetchSpec{
+				Depth:          0,
+				SubmodulePaths: nil,
+			},
+			expected: []string{"submodule", "update", "--recursive", "--init", "--force"},
+		},
+		{
+			name: "with depth, no submodule paths",
+			spec: FetchSpec{
+				Depth:          5,
+				SubmodulePaths: nil,
+			},
+			expected: []string{"submodule", "update", "--recursive", "--init", "--force", "--depth=5"},
+		},
+		{
+			name: "no depth, with submodule paths",
+			spec: FetchSpec{
+				Depth:          0,
+				SubmodulePaths: []string{"path/to/submod1", "path/to/submod2"},
+			},
+			expected: []string{"submodule", "update", "--recursive", "--init", "--force", "path/to/submod1", "path/to/submod2"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := buildSubmoduleUpdateArgs(tt.spec)
+			if diff := cmp.Diff(tt.expected, got); diff != "" {
+				t.Errorf("buildSubmoduleUpdateArgs() mismatch (-want +got):\n%s", diff)
+			}
+		})
+	}
+}
+
 func TestRetryWithBackoff(t *testing.T) {
 	withTemporaryGitConfig(t)
 	tests := []struct {
 
@@ -1,16 +1,16 @@
 module github.com/tektoncd-catalog/git-clone/git-init
 
-go 1.23.0
+go 1.24.0
 
 require (
 	github.com/google/go-cmp v0.7.0
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/tektoncd/pipeline v0.69.0
+	github.com/tektoncd/pipeline v1.0.1
 	go.uber.org/zap v1.27.0
 )
 
 require (
-	cel.dev/expr v0.19.1 // indirect
+	cel.dev/expr v0.25.1 // indirect
 	contrib.go.opencensus.io/exporter/ocagent v0.7.1-0.20200907061046-05415f1de66d // indirect
 	contrib.go.opencensus.io/exporter/prometheus v0.4.2 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
@@ -20,64 +20,64 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
-	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/cel-go v0.23.2 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/cel-go v0.24.1 // indirect
+	github.com/google/gnostic-models v0.6.9 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
-	github.com/prometheus/client_golang v1.19.1 // indirect
+	github.com/prometheus/client_golang v1.20.5 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.55.0 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/prometheus/statsd_exporter v0.22.7 // indirect
-	github.com/stoewer/go-strcase v1.2.0 // indirect
+	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/oauth2 v0.27.0 // indirect
-	golang.org/x/sync v0.12.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/term v0.30.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	golang.org/x/time v0.9.0 // indirect
-	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
+	golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac // indirect
+	golang.org/x/net v0.48.0 // indirect
+	golang.org/x/oauth2 v0.34.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
+	golang.org/x/time v0.10.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
 	google.golang.org/api v0.217.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250115164207-1a7da9e5054f // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect
-	google.golang.org/grpc v1.70.0 // indirect
-	google.golang.org/protobuf v1.36.5 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/grpc v1.79.3 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.31.6 // indirect
-	k8s.io/apimachinery v0.31.6 // indirect
-	k8s.io/client-go v0.31.6 // indirect
+	k8s.io/api v0.32.2 // indirect
+	k8s.io/apimachinery v0.32.4 // indirect
+	k8s.io/client-go v0.32.2 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20240808142205-8e686545bdb8 // indirect
-	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
-	knative.dev/pkg v0.0.0-20250117084104-c43477f0052b // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7 // indirect
+	k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect
+	knative.dev/pkg v0.0.0-20250415155312-ed3e2158b883 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.5.0 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 )
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-768a778f1f7ccee8a4dd142e7f115e12c7e422fd`
	`1`	`+a2dd81492d93730eb5ce60564ee0e8f87ae4c84c`