actions/checkout is a GitHub Action that checks out a repository into the workflow's workspace so that subsequent steps can access its contents.
The action fetches a single commit by default—the ref or SHA that triggered the workflow—making it fast for typical CI/CD scenarios. It supports fetching full history across all branches and tags when needed via the `fetch-depth` parameter. The action persists the authentication token in the git configuration to enable authenticated git commands in workflow scripts, then removes it during cleanup. When Git 2.18 or higher is unavailable, it falls back to the REST API to download files.
Any workflow using GitHub Actions needs this action to access repository code. It is essential for continuous integration, testing, deployment, and any automation that requires working with repository files or running git commands. The action handles the common case efficiently while remaining flexible for workflows requiring deeper history or custom credential handling.
The project maintains security as a priority, having recently added protections against "pwn request" vulnerabilities by refusing to check out fork pull request code by default when triggered by `pull_request_target` or `workflow_run` events. The codebase was migrated to ESM to support newer versions of the Actions toolkit packages. The maintainers have stated they are not accepting contributions at this time but continue to provide security updates and fix major breaking changes. The project updates its runtime and dependencies regularly, including addressing known vulnerabilities in transitive dependencies.
