From 5d869a24c0658dbd31e969f0e22d9edb3fe6e3ac Mon Sep 17 00:00:00 2001
From: Florent Morselli <florent.morselli@spomky-labs.com>
Date: Sun, 30 Aug 2026 16:22:31 +0200
Subject: [PATCH] ci: check out the repository properly in the gitsplit
 workflow

The step cloned the repository by hand into a path unrelated to the
workspace, and always landed on the default branch. gitsplit therefore
applied the .gitsplit.yml of that branch to every reference it walks,
whatever ref had actually been pushed. A split declared for the next
minor then governed the older branches too, and a target repository
that did not exist yet aborted the publication of every package.

actions/checkout gives the ref that triggered the run, with the full
history gitsplit needs to walk the branches and tags. Credentials are
not persisted: the container reads a public repository and only needs
GITSPLIT_TOKEN for the targets it pushes to.
---
 .github/workflows/gitsplit.yml | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/gitsplit.yml b/.github/workflows/gitsplit.yml
index 3fddc29b0..adf3d6d1f 100644
--- a/.github/workflows/gitsplit.yml
+++ b/.github/workflows/gitsplit.yml
@@ -1,4 +1,16 @@
 name: gitsplit
+
+# gitsplit walks every branch and tag matching the "origins" patterns of
+# .gitsplit.yml, so the checkout must be unshallow: fetch-depth: 0.
+#
+# It also reads a single .gitsplit.yml, the one in the working copy, and
+# applies it to all of those references. Checking out the ref that triggered
+# the run keeps that config in step with the branch being pushed, instead of
+# whatever the default branch happens to declare at that moment.
+#
+# The container is not given the repository credentials: it only needs to read
+# a public repository, and GITSPLIT_TOKEN for the targets it pushes to.
+
 on:
   push:
     tags:
@@ -13,9 +25,13 @@ jobs:
   gitsplit:
     runs-on: ubuntu-latest
     steps:
-      - name: checkout
-        run: git clone https://github.com/web-token/jwt-framework /home/runner/work/web-token/jwt-framework && cd /home/runner/work/web-token/jwt-framework
-      - name: Split repositories
-        run: docker run --rm -t -e GH_TOKEN -v /cache/gitsplit:/cache/gitsplit -v /home/runner/work/web-token/jwt-framework:/srv jderusse/gitsplit gitsplit
+      - name: "Checkout"
+        uses: "actions/checkout@v5"
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: "Split repositories"
+        run: docker run --rm -t -e GH_TOKEN -v /cache/gitsplit:/cache/gitsplit -v ${{ github.workspace }}:/srv jderusse/gitsplit gitsplit
         env:
           GH_TOKEN: ${{ secrets.GITSPLIT_TOKEN }}