bug: sparse-checkout checks out undefined paths

[konck2]

Issue: sparse-checkout checks out undefined paths

  uses: actions/checkout@v4
  with:
    fetch-depth: 1
    ref: ${{ github.sha }}
    sparse-checkout-cone-mode: false
    sparse-checkout: |
      folder1
      myfile.yaml

Actual behaviour (checks out repository contents in following manner):

- folder1
- folderabc/myfile.yaml
- folderabc2/myfile.yaml
- myfile.yaml

Expected behaviour:

- folder1
- myfile.yaml

[Eric Fenderbosch]

Similar problem:

      - name: Checkout Liquibase Migrations
        uses: actions/checkout@v4
        with:
          repository: our-org/other-repo
          ref: release
          ssh-key: ${{ secrets.SHHH }}
          path: liquibase
          sparse-checkout: src/main/resources/liquibase
          show-progress: false

Actual behavior: entire tree of our-org/other-repo is checked out under liquibase

Expected behavior: only the src/main/resources/liquibase tree is checked out.

[Brad Hajek]

Similar issue here as well.

Options sent to actions/checkout (same results whether providing sparse-checkout a single path as shown below or '|\n scripts' as documented):

Run actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
  with:
    repository: our-org/central-repo
    ref: main
    token: ***
    sparse-checkout: scripts
  
    path: devsecops
    ssh-strict: true
    persist-credentials: true
    clean: true
    sparse-checkout-cone-mode: true
    fetch-depth: 1
    fetch-tags: false
    show-progress: true
    lfs: false
    submodules: false
    set-safe-directory: true

Output from the runner, after checkout action:

ls -laR devsecops/
devsecops/:
total 48
drwxr-xr-x 4 root root  4096 Mar 15 16:46 .
drwxr-xr-x 9 root root  4096 Mar 15 16:46 ..
drwxr-xr-x 8 root root  4096 Mar 15 16:46 .git
-rw-r--r-- 1 root root    88 Mar 15 16:46 CODEOWNERS
-rw-r--r-- 1 root root   237 Mar 15 16:46 LICENSE
-rw-r--r-- 1 root root 16987 Mar 15 16:46 README.md
drwxr-xr-x 2 root root  4096 Mar 15 16:46 scripts
devsecops/.git:
total 60
drwxr-xr-x 8 root root 4096 Mar 15 16:46 .
drwxr-xr-x 4 root root 4096 Mar 15 16:46 ..
-rw-r--r-- 1 root root  115 Mar 15 16:46 FETCH_HEAD
-rw-r--r-- 1 root root   23 Mar 15 16:46 HEAD
drwxr-xr-x 2 root root 4096 Mar 15 16:46 branches
-rw-r--r-- 1 root root  520 Mar 15 16:46 config
-rw-r--r-- 1 root root   57 Mar 15 16:46 config.worktree
-rw-r--r-- 1 root root   73 Mar 15 16:46 description
drwxr-xr-x 2 root root 4096 Mar 15 16:46 hooks
-rw-r--r-- 1 root root 3542 Mar 15 16:46 index
drwxr-xr-x 2 root root 4096 Mar 15 16:46 info
drwxr-xr-x 3 root root 4096 Mar 15 16:46 logs
drwxr-xr-x 4 root root 4096 Mar 15 16:46 objects
drwxr-xr-x 5 root root 4096 Mar 15 16:46 refs
-rw-r--r-- 1 root root   41 Mar 15 16:46 shallow
...
devsecops/.git/refs/tags:
total 8
drwxr-xr-x 2 root root 4096 Mar 15 16:46 .
drwxr-xr-x 5 root root 4096 Mar 15 16:46 ..
devsecops/scripts:
total 64
drwxr-xr-x 2 root root 4096 Mar 15 16:46 .
drwxr-xr-x 4 root root 4096 Mar 15 16:46 ..
<redacted>