Update README.md

* feat: add _run_hook helper and eight hook inputs

* fix(_run_hook): default snippet to empty when arg unset

* feat: wire add/commit hooks into _main

* feat: wire tag and push hooks into _main

* test: verify failing hook aborts the action

* docs: document hooks system in README

* test: tighten failing-hook assertion

* docs(hooks): note set -eu semantics for snippet authors

* refactor(hooks): rename action inputs to suffix with _hook

* refactor(hooks): include _hook suffix in event identifier

* docs(hooks): add notes about security implications of hooks

.github/ISSUE_TEMPLATE/config.yml

@@ -5,4 +5,4 @@ contact_links:
     about: If you can't get something to work the way you expect, open a question in our discussion forums.
   - name: Feature Request
     url: https://github.com/stefanzweifel/git-auto-commit-action/discussions/new?category=ideas
-    about: 'Suggest any ideas you have using our discussion forums.'
+    about: "Suggest any ideas you have using our discussion forums."

.github/SECURITY.md

@@ -0,0 +1,3 @@
+# Security Policy
+
+If you discover any security related issues, please email stefan@stefanzweifel.dev instead of using the issue tracker.

.github/workflows/git-auto-commit.yml

@@ -16,7 +16,9 @@ jobs:
       contents: write
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
+      with:
+        ref: ${{ github.head_ref }}
 
     - name: Use git-auto-commit-action
       id: "auto-commit-action"

.github/workflows/linter.yml

@@ -9,7 +9,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Lint Code Base
         uses: github/super-linter@v7

.github/workflows/release-drafter.yml

@@ -15,6 +15,6 @@ jobs:
       contents: write
 
     steps:
-      - uses: release-drafter/release-drafter@v6
+      - uses: release-drafter/release-drafter@v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/tests.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Install testing dependencies
       run: yarn install

.github/workflows/update-changelog.yaml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: master
 
@@ -27,7 +27,7 @@ jobs:
           latest-version: ${{ github.event.release.name }}
 
       - name: Commit updated CHANGELOG
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@v7
         with:
           branch: master
           commit_message: Update CHANGELOG

CHANGELOG.md

@@ -5,10 +5,89 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
-## [Unreleased](https://github.com/stefanzweifel/git-auto-commit-action/compare/v5.0.1...HEAD)
+## [Unreleased](https://github.com/stefanzweifel/git-auto-commit-action/compare/v7.1.0...HEAD)
 
 > TBD
 
+## [v7.1.0](https://github.com/stefanzweifel/git-auto-commit-action/compare/v7.0.0...v7.1.0) - 2025-12-17
+
+### Added
+
+- Add skip_push input option ([#401](https://github.com/stefanzweifel/git-auto-commit-action/pull/401)) [@kvanzuijlen](https://github.com/@kvanzuijlen)
+
+### Changes
+
+- docs: fix typo in README.md ([#400](https://github.com/stefanzweifel/git-auto-commit-action/pull/400)) [@GideonBear](https://github.com/@GideonBear)
+
+### Dependency Updates
+
+- Bump actions/checkout from 5 to 6 ([#399](https://github.com/stefanzweifel/git-auto-commit-action/pull/399)) [@[dependabot[bot]](https://github.com/apps/dependabot)](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))
+- Bump bats from 1.12.0 to 1.13.0 ([#398](https://github.com/stefanzweifel/git-auto-commit-action/pull/398)) [@[dependabot[bot]](https://github.com/apps/dependabot)](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))
+
+## [v7.0.0](https://github.com/stefanzweifel/git-auto-commit-action/compare/v6.0.1...v7.0.0) - 2025-10-12
+
+### Added
+
+- Restore skip_fetch, skip_checkout, create_branch ([#388](https://github.com/stefanzweifel/git-auto-commit-action/pull/388)) [@stefanzweifel](https://github.com/@stefanzweifel)
+- Restore Detached State Detection ([#393](https://github.com/stefanzweifel/git-auto-commit-action/pull/393)) [@stefanzweifel](https://github.com/@stefanzweifel)
+- Add Support for Tag Messages ([#391](https://github.com/stefanzweifel/git-auto-commit-action/pull/391)) [@EliasBoulharts](https://github.com/@EliasBoulharts)
+
+### Changed
+
+- Run Action on Node 24 ([#389](https://github.com/stefanzweifel/git-auto-commit-action/pull/389)) [@stefanzweifel](https://github.com/@stefanzweifel)
+
+### Dependency Updates
+
+- Bump actions/checkout from 4 to 5 ([#386](https://github.com/stefanzweifel/git-auto-commit-action/pull/386)) [@[dependabot[bot]](https://github.com/apps/dependabot)](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))
+
+## [v6.0.1](https://github.com/stefanzweifel/git-auto-commit-action/compare/v6.0.0...v6.0.1) - 2025-06-11
+
+### Fixed
+
+- Disable Check if Repo is in Detached State ([#379](https://github.com/stefanzweifel/git-auto-commit-action/pull/379)) [@stefanzweifel](https://github.com/@stefanzweifel)
+
+## [v6.0.0](https://github.com/stefanzweifel/git-auto-commit-action/compare/v5.2.0...v6.0.0) - 2025-06-10
+
+### Added
+
+- Throw error early if repository is in a detached state ([#357](https://github.com/stefanzweifel/git-auto-commit-action/pull/357))
+
+### Fixed
+
+- Fix PAT instructions with Dependabot ([#376](https://github.com/stefanzweifel/git-auto-commit-action/pull/376)) [@Dreamsorcerer](https://github.com/@Dreamsorcerer)
+
+### Removed
+
+- Remove support for `create_branch`, `skip_checkout`, `skip_Fetch` ([#314](https://github.com/stefanzweifel/git-auto-commit-action/pull/314))
+
+## [v5.2.0](https://github.com/stefanzweifel/git-auto-commit-action/compare/v5.1.0...v5.2.0) - 2025-04-19
+
+### Added
+
+- Add `create_git_tag_only` option to skip commiting and always create a git-tag. ([#364](https://github.com/stefanzweifel/git-auto-commit-action/pull/364)) [@zMynxx](https://github.com/@zMynxx)
+- Add Test for `create_git_tag_only` feature ([#367](https://github.com/stefanzweifel/git-auto-commit-action/pull/367)) [@stefanzweifel](https://github.com/@stefanzweifel)
+
+### Fixed
+
+- docs: Update README.md per #354 ([#361](https://github.com/stefanzweifel/git-auto-commit-action/pull/361)) [@rasa](https://github.com/@rasa)
+
+## [v5.1.0](https://github.com/stefanzweifel/git-auto-commit-action/compare/v5.0.1...v5.1.0) - 2025-01-11
+
+### Changed
+
+- Include `github.actor_id` in default `commit_author` ([#354](https://github.com/stefanzweifel/git-auto-commit-action/pull/354)) [@parkerbxyz](https://github.com/@parkerbxyz)
+
+### Fixed
+
+- docs(README): fix broken protected branch docs link ([#346](https://github.com/stefanzweifel/git-auto-commit-action/pull/346)) [@scarf005](https://github.com/@scarf005)
+- Update README.md ([#343](https://github.com/stefanzweifel/git-auto-commit-action/pull/343)) [@Kludex](https://github.com/@Kludex)
+
+### Dependency Updates
+
+- Bump bats from 1.11.0 to 1.11.1 ([#353](https://github.com/stefanzweifel/git-auto-commit-action/pull/353)) [@dependabot](https://github.com/@dependabot)
+- Bump github/super-linter from 6 to 7 ([#342](https://github.com/stefanzweifel/git-auto-commit-action/pull/342)) [@dependabot](https://github.com/@dependabot)
+- Bump github/super-linter from 5 to 6 ([#335](https://github.com/stefanzweifel/git-auto-commit-action/pull/335)) [@dependabot](https://github.com/@dependabot)
+
 ## [v5.0.1](https://github.com/stefanzweifel/git-auto-commit-action/compare/v5.0.0...v5.0.1) - 2024-04-12
 
 ### Fixed

CODE_OF_CONDUCT.md

@@ -72,5 +72,4 @@ available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.ht
 
 [homepage]: https://www.contributor-covenant.org
 
-For answers to common questions about this code of conduct, see
-https://www.contributor-covenant.org/faq
+For answers to common questions about this code of conduct, see the [Contributor Covenant FAQ](https://www.contributor-covenant.org/faq).

EXAMPLES.md

@@ -0,0 +1,551 @@
+# Examples
+
+This document shows real-world scenarios where `git-auto-commit` is useful, with a working GitHub Actions workflow for each. The scenarios are based on questions and use cases that have come up in the [issues](https://github.com/stefanzweifel/git-auto-commit-action/issues) and [discussions](https://github.com/stefanzweifel/git-auto-commit-action/discussions) of this repository over the years.
+
+If you have a use case that isn't covered here, [open a discussion](https://github.com/stefanzweifel/git-auto-commit-action/discussions) — we may add it.
+
+## Table of Contents
+
+- [Auto-format code on pull requests](#auto-format-code-on-pull-requests)
+- [Auto-fix lint errors](#auto-fix-lint-errors)
+- [Update dependency lock files](#update-dependency-lock-files)
+- [Build and commit compiled assets](#build-and-commit-compiled-assets)
+- [Auto-generate API documentation](#auto-generate-api-documentation)
+- [Update README with generated content](#update-readme-with-generated-content)
+- [Maintain a CHANGELOG](#maintain-a-changelog)
+- [Sync translations / i18n files](#sync-translations--i18n-files)
+- [Publish a static site to a separate branch](#publish-a-static-site-to-a-separate-branch)
+- [Scheduled data refresh](#scheduled-data-refresh)
+- [Create a release tag without a commit](#create-a-release-tag-without-a-commit)
+- [Fail the build instead of pushing changes (drift check)](#fail-the-build-instead-of-pushing-changes-drift-check)
+- [Sign automated commits with GPG](#sign-automated-commits-with-gpg)
+- [Squash automated changes into the previous commit](#squash-automated-changes-into-the-previous-commit)
+
+---
+
+## Auto-format code on pull requests
+
+**Description:** Run a code formatter (Prettier, php-cs-fixer, Black, gofmt, rustfmt, …) on every pull request and commit the resulting changes back to the contributor's branch. Contributors don't have to think about style; the bot fixes it for them.
+
+This is the most common use case for this Action. Running it on `pull_request` means the formatter only touches the PR branch — never your default branch directly.
+
+```yaml
+name: Format
+
+on: pull_request
+
+jobs:
+  prettier:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.head_ref }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - run: npx prettier --write .
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "style: apply prettier formatting"
+```
+
+> [!TIP]
+> If the PR comes from a fork, the Action can only push back if the contributor enabled "Allow edits by maintainers". See the [forks section in the README](README.md#use-in-forks-from-public-repositories) for details.
+
+---
+
+## Auto-fix lint errors
+
+**Description:** Many linters can both report and auto-fix problems (`eslint --fix`, `rubocop -a`, `ruff --fix`, `stylelint --fix`, …). Use the Action to commit the auto-fixed result so reviewers only see the issues that need human judgement.
+
+```yaml
+name: Lint and fix
+
+on: pull_request
+
+jobs:
+  eslint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.head_ref }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+      - run: npx eslint . --fix
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "chore: apply eslint --fix"
+```
+
+> [!TIP]
+> `file_pattern` is intentionally omitted here. If one of several custom patterns does not match a file in the repository, `git add` can fail with a pathspec error. Let the linter decide which files to change, or use a custom pattern that you know exists in your repository.
+
+---
+
+## Update dependency lock files
+
+**Description:** When a dependency tool produces a fresh lock file (`package-lock.json`, `composer.lock`, `Gemfile.lock`, `poetry.lock`, …), commit only the lock file. Pair this with a scheduled job to keep lock files in sync without manual intervention.
+
+```yaml
+name: Refresh lock file
+
+on:
+  schedule:
+    - cron: "0 6 * * 1" # every Monday at 06:00 UTC
+  workflow_dispatch:
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - run: npm install --package-lock-only
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "chore(deps): refresh package-lock.json"
+          file_pattern: package-lock.json
+```
+
+---
+
+## Build and commit compiled assets
+
+**Description:** For projects that ship a `dist/` folder (libraries, browser extensions, themes), build the assets in CI and commit them so consumers can install directly from the repo without a build step.
+
+```yaml
+name: Build dist
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+      - run: npm run build
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "build: update dist/"
+          file_pattern: "dist/**"
+```
+
+> [!NOTE]
+> If `dist/` is in `.gitignore`, the Action will not pick up changes. See the [troubleshooting section in the README](README.md#change-to-file-is-not-detected).
+
+---
+
+## Auto-generate API documentation
+
+**Description:** Tools like TypeDoc, Doxygen, Sphinx, or `cargo doc` generate documentation from source comments. Regenerate on every push to `main` and commit the output so the published docs always match the latest code.
+
+```yaml
+name: Docs
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  typedoc:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+      - run: npx typedoc --out docs/api src/index.ts
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "docs: regenerate API reference"
+          file_pattern: "docs/api/**"
+```
+
+---
+
+## Update README with generated content
+
+**Description:** Many projects keep dynamic sections in the README — a contributor list, a badge gallery, a table of contents, a list of supported plugins. Regenerate them on a schedule (or when a related file changes) and commit the result.
+
+```yaml
+name: Update contributors
+
+on:
+  schedule:
+    - cron: "0 0 * * 0" # weekly
+  workflow_dispatch:
+
+jobs:
+  contributors:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: akhilmhdh/contributors-readme-action@v2.3.10
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "docs: update contributors"
+          file_pattern: README.md
+```
+
+---
+
+## Maintain a CHANGELOG
+
+**Description:** Generate or update `CHANGELOG.md` from commit history or release notes after each merge to `main`, and commit it back.
+
+```yaml
+name: Update CHANGELOG
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # full history so the generator sees all commits
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - run: npx conventional-changelog -p angular -i CHANGELOG.md -s
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "docs: update CHANGELOG"
+          file_pattern: CHANGELOG.md
+```
+
+---
+
+## Sync translations / i18n files
+
+**Description:** When translations are managed in an external service (Crowdin, Lokalise, Weblate) or extracted from source, pull or generate the latest catalogs on a schedule and commit them.
+
+```yaml
+name: Sync translations
+
+on:
+  schedule:
+    - cron: "0 3 * * *" # daily at 03:00 UTC
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Download translations
+        run: ./scripts/pull-translations.sh
+        env:
+          CROWDIN_TOKEN: ${{ secrets.CROWDIN_TOKEN }}
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "i18n: sync translations from Crowdin"
+          file_pattern: "locales/**/*.json"
+```
+
+---
+
+## Publish a static site to a separate branch
+
+**Description:** Build a static site on `main` and push the generated output to a `gh-pages` branch so GitHub Pages can serve it. Use a second checkout directory for the publish branch so the source checkout and generated site do not get mixed together.
+
+Create the `gh-pages` branch once before using this workflow.
+
+```yaml
+name: Build site
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          path: source
+
+      - uses: actions/checkout@v5
+        with:
+          ref: gh-pages
+          path: site
+
+      - name: Build site
+        working-directory: source
+        run: ./build-site.sh # produces output in ./public
+
+      - name: Replace publish branch contents
+        run: |
+          find site -mindepth 1 -maxdepth 1 ! -name .git -exec rm -rf {} +
+          cp -R source/public/. site/
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          repository: site
+          branch: gh-pages
+          commit_message: "site: rebuild from ${{ github.sha }}"
+```
+
+> [!NOTE]
+> For most Pages workflows the official [`actions/deploy-pages`](https://github.com/actions/deploy-pages) is a better fit. Use this approach when you specifically want the build output stored in a branch.
+
+---
+
+## Scheduled data refresh
+
+**Description:** Pull data from an external source on a schedule and commit it. Common examples: tracking statistics, snapshotting an API response, refreshing a cached dataset.
+
+```yaml
+name: Refresh stats
+
+on:
+  schedule:
+    - cron: "0 * * * *" # hourly
+  workflow_dispatch:
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - run: curl -sSL https://api.example.com/stats.json -o data/stats.json
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "data: refresh hourly stats"
+          file_pattern: "data/*.json"
+```
+
+---
+
+## Create a release tag without a commit
+
+**Description:** Sometimes you want to tag the current HEAD as a release without committing any files. Use `create_git_tag_only` together with `tag_name` and `tagging_message`.
+
+```yaml
+name: Tag release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to tag (e.g. v1.4.0)"
+        required: true
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          create_git_tag_only: true
+          tag_name: ${{ inputs.version }}
+          tagging_message: "Release ${{ inputs.version }}"
+```
+
+---
+
+## Fail the build instead of pushing changes (drift check)
+
+**Description:** Sometimes you don't want a bot to push fixes — you want to fail the build so the contributor fixes them locally. Use the `changes_detected` output as a check: run the formatter, skip branch checkout/fetch/push, and fail if anything changed.
+
+```yaml
+name: Format check
+
+on: pull_request
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - run: npx prettier --write .
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        id: auto-commit
+        with:
+          skip_checkout: true
+          skip_fetch: true
+          skip_push: true
+
+      - name: Fail if formatting was needed
+        if: steps.auto-commit.outputs.changes_detected == 'true'
+        run: |
+          echo "::error::Code is not formatted. Run 'npx prettier --write .' locally."
+          exit 1
+```
+
+---
+
+## Sign automated commits with GPG
+
+**Description:** If your branch protection rules require signed commits, the bot's commits need to be signed too. Import a GPG key first, then tell the Action to use the key's identity as the commit author.
+
+```yaml
+name: Format (signed)
+
+on: pull_request
+
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.head_ref }}
+
+      - name: Import GPG key
+        id: import-gpg
+        uses: crazy-max/ghaction-import-gpg@v6
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+
+      - run: npx prettier --write .
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "style: apply prettier"
+          commit_user_name: ${{ steps.import-gpg.outputs.name }}
+          commit_user_email: ${{ steps.import-gpg.outputs.email }}
+          commit_author: "${{ steps.import-gpg.outputs.name }} <${{ steps.import-gpg.outputs.email }}>"
+```
+
+See discussion [#334](https://github.com/stefanzweifel/git-auto-commit-action/discussions/334) for background.
+
+---
+
+## Squash automated changes into the previous commit
+
+**Description:** Avoid noisy "apply automatic changes" commits by amending the last commit instead. Useful when the bot fix is trivial and you don't want a separate entry in the history.
+
+> [!CAUTION]
+> Amending rewrites history. Only use this on branches where force-pushing is acceptable (typically PR branches, never `main`).
+
+```yaml
+name: Format (amend)
+
+on: pull_request
+
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 2 # need previous commit for --amend
+
+      - run: npx prettier --write .
+
+      - name: Read previous commit metadata
+        id: last
+        run: |
+          echo "message=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT
+          echo "author=$(git log -1 --pretty='%an <%ae>')" >> $GITHUB_OUTPUT
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: ${{ steps.last.outputs.message }}
+          commit_author: ${{ steps.last.outputs.author }}
+          commit_options: "--amend --no-edit"
+          push_options: "--force"
+          skip_fetch: true
+```
+
+See discussion [#159](https://github.com/stefanzweifel/git-auto-commit-action/issues/159#issuecomment-845347950) for details.

README.md

@@ -11,15 +11,20 @@ By default, the commit is made in the name of "GitHub Actions" and co-authored b
 
 If you want to learn more how this Action works under the hood, check out [this article](https://michaelheap.com/git-auto-commit/) by Michael Heap.
 
+If your use case is not covered by git-auto-commit, you might want to check out the following alternative Actions:
+
+- [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action)
+- [EndBug/add-and-commit](https://github.com/EndBug/add-and-commit)
+
 ## Usage
 
 Adding git-auto-commit to your Workflow only takes a couple lines of code.
 
-1. Set the `contents`-permission of the default GITHUB_TOKEN to `true`. (Required to push new commits to the repository)
+1. Set the `contents`-permission of the default GITHUB_TOKEN to `write`. (Required to push new commits to the repository)
 2. Add the following step at the end of your job, after other steps that might add or change files.
 
 ```yaml
-- uses: stefanzweifel/git-auto-commit-action@v5
+- uses: stefanzweifel/git-auto-commit-action@v7
 ```
 
 Your Workflow should look similar to this example.
@@ -39,15 +44,17 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ github.head_ref }}
+          # Value already defaults to true, but `persist-credentials` is required to push new commits to the repository.
+          persist-credentials: true
 
       # Other steps that change files in the repository go here
       # …
 
       # Commit all changed files back to the repository
-      - uses: stefanzweifel/git-auto-commit-action@v5
+      - uses: stefanzweifel/git-auto-commit-action@v7
 ```
 
 > [!NOTE]
@@ -56,15 +63,14 @@ jobs:
 The following is an extended example with all available options.
 
 ```yaml
-- uses: stefanzweifel/git-auto-commit-action@v5
+- uses: stefanzweifel/git-auto-commit-action@v7
   with:
     # Optional. Commit message for the created commit.
     # Defaults to "Apply automatic changes"
     commit_message: Automated Change
 
-    # Optional. Local and remote branch name where commit is going to be pushed
-    #  to. Defaults to the current branch.
-    #  You might need to set `create_branch: true` if the branch does not exist.
+    # Optional. Remote branch name where commit is going to be pushed to.
+    # Defaults to the current branch.
     branch: feature-123
 
     # Optional. Options used by `git-commit`.
@@ -78,18 +84,23 @@ The following is an extended example with all available options.
     # - https://git-scm.com/docs/gitglossary#Documentation/gitglossary.txt-aiddefpathspecapathspec
     file_pattern: '*.php src/*.js tests/*.js'
 
-    # Optional. Local file path to the repository.
+    # Optional. Relative file path under $GITHUB_WORKSPACE to the repository.
     # Defaults to the root of the repository.
     repository: .
 
     # Optional commit user and author settings
     commit_user_name: My GitHub Actions Bot # defaults to "github-actions[bot]"
     commit_user_email: my-github-actions-bot@example.org # defaults to "41898282+github-actions[bot]@users.noreply.github.com"
-    commit_author: Author <actions@github.com> # defaults to "username <username@users.noreply.github.com>", where "username" belongs to the author of the commit that triggered the run
+    commit_author: Author <actions@github.com> # defaults to "username <numeric_id+username@users.noreply.github.com>", where "numeric_id" and "username" belong to the author of the commit that triggered the run
 
-    # Optional. Tag name being created in the local repository and 
-    # pushed to remote repository and defined branch.
-    tagging_message: 'v1.0.0'
+    # Optional. Tag name to be created in the local repository and
+    # pushed to the remote repository on the defined branch.
+    # If only one of `tag_name` or `tagging_message` is provided, the value of the provided field will be used for both tag name and message.
+    tag_name: 'v1.0.0'
+
+    # Optional. Message to annotate the created tag with.
+    # If only one of `tag_name` or `tagging_message` is provided, the value of the provided field will be used for both tag name and message.
+    tagging_message: 'Codename "Sunshine"'
 
     # Optional. Option used by `git-status` to determine if the repository is
     # dirty. See https://git-scm.com/docs/git-status#_options
@@ -112,12 +123,37 @@ The following is an extended example with all available options.
     # Optional. Skip internal call to `git checkout`
     skip_checkout: true
 
+    # Optional. Skip internal call to `git push`
+    skip_push: true
+
     # Optional. Prevents the shell from expanding filenames.
     # Details: https://www.gnu.org/software/bash/manual/html_node/Filename-Expansion.html
     disable_globbing: true
 
     # Optional. Create given branch name in local and remote repository.
     create_branch: true
+
+    # Optional. Creates a new tag and pushes it to remote without creating a commit.
+    # Skips dirty check and changed files. Must be used in combination with `tag` and `tagging_message`.
+    create_git_tag_only: false
+
+    # Optional. Suppress the security warning emitted when the action runs on a
+    # `pull_request_target` event. See the "Workflow should run in **base** repository"
+    # section below for context before disabling this warning.
+    disable_pull_request_target_trigger_warning: false
+
+    # Optional. Shell snippets to run around each git operation. Each hook
+    # is evaluated in the same bash process as the action — `set -eu` is
+    # in effect, the working directory is your repository, and all
+    # `INPUT_*` env vars are visible. A non-zero exit aborts the action.
+    before_add_hook: ''
+    after_add_hook: ''
+    before_commit_hook: ''
+    after_commit_hook: ''
+    before_tag_hook: ''
+    after_tag_hook: ''
+    before_push_hook: ''
+    after_push_hook: ''
 ```
 
 Please note that the Action depends on `bash`. If you're using the Action in a job in combination with a custom Docker container, make sure that `bash` is installed.
@@ -147,18 +183,20 @@ jobs:
       contents: write
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         ref: ${{ github.head_ref }}
 
     - name: Run php-cs-fixer
       uses: docker://oskarstark/php-cs-fixer-ga
 
-    - uses: stefanzweifel/git-auto-commit-action@v5
+    - uses: stefanzweifel/git-auto-commit-action@v7
       with:
         commit_message: Apply php-cs-fixer changes
 ```
 
+See [EXAMPLES.md](EXAMPLES.md) for more scenarios, including auto-formatting, dependency updates, generated docs, release tagging, drift checks, and GPG-signed commits.
+
 ## Inputs
 
 Checkout [`action.yml`](https://github.com/stefanzweifel/git-auto-commit-action/blob/master/action.yml) for a full list of supported inputs.
@@ -169,13 +207,14 @@ You can use these outputs to trigger other Actions in your Workflow run based on
 
 - `changes_detected`: Returns either "true" or "false" if the repository was dirty and files have changed.
 - `commit_hash`: Returns the full hash of the commit if one was created.
+- `create_git_tag_only`: Returns either "true" or "false" if a tag was created, when `create_git_tag_only` was used.
 
 **⚠️ When using outputs, the step needs to be given an id. See example below.**
 
 ### Example
 
 ```yaml
-  - uses: stefanzweifel/git-auto-commit-action@v5
+  - uses: stefanzweifel/git-auto-commit-action@v7
     id: auto-commit-action #mandatory for the output to show up in ${{ steps }}
     with:
       commit_message: Apply php-cs-fixer changes
@@ -189,6 +228,87 @@ You can use these outputs to trigger other Actions in your Workflow run based on
     run: echo "No Changes!"
 ```
 
+## Hooks
+
+git-auto-commit can run custom shell snippets around each git operation
+it performs. This is useful when you need to prepare or clean up the
+repository as part of the same step — for example, unshallowing a
+shallow clone right before the commit is staged.
+
+Eight optional hooks are available:
+
+| Hook | Runs |
+| ---- | ---- |
+| `before_add_hook` / `after_add_hook` | around `git add` |
+| `before_commit_hook` / `after_commit_hook` | around `git commit` |
+| `before_tag_hook` / `after_tag_hook` | around `git tag` (only when a tag is being created) |
+| `before_push_hook` / `after_push_hook` | around `git push` (skipped when `skip_push: true`) |
+
+Each hook is an inline shell snippet that runs in the same bash process
+as the action. The working directory is your repository, and all
+`INPUT_*` environment variables and standard GitHub Actions env vars are
+visible to the snippet.
+
+### Example
+
+```yaml
+- uses: stefanzweifel/git-auto-commit-action@v7
+  with:
+    before_add_hook: |
+      git fetch --unshallow
+```
+
+Multi-line snippets work via YAML's `|` block scalar:
+
+```yaml
+- uses: stefanzweifel/git-auto-commit-action@v7
+  with:
+    before_commit_hook: |
+      echo "About to commit at $(date)"
+      ./scripts/prepare-commit.sh
+```
+
+### Notes
+
+- A hook only runs when its underlying step actually runs. For example,
+  `before_add_hook`/`after_add_hook` are skipped when the working tree is clean,
+  and `before_push_hook`/`after_push_hook` are skipped when `skip_push: true`.
+- If a hook exits with a non-zero status, the action fails. Append
+  `|| true` to a snippet to ignore its failure.
+- Hooks share environment with the action, so they can read action
+  inputs (e.g. `$INPUT_COMMIT_MESSAGE`) and write to `$GITHUB_OUTPUT`.
+- Snippets run under `set -eu`. Referencing an unset variable aborts the
+  action; use `${VAR:-}` to default an optional variable to empty.
+
+### Security
+
+Hook snippets are evaluated as shell code in the same process as the
+action. Treat them as you would any `run:` step.
+
+> [!CAUTION]
+> **Do not combine hooks with the `pull_request_target` event when the
+> snippet references attacker-controlled GitHub context.** Fields like
+> `${{ github.event.pull_request.title }}`, `${{ github.event.pull_request.body }}`,
+> `${{ github.head_ref }}`, and commit messages from a fork are
+> interpolated into the snippet **before** bash sees it. A malicious PR
+> can inject shell commands that run on your runner with access to your
+> repository secrets. See the [`pull_request_target` section](#workflow-should-run-in-base-repository)
+> for the broader risk and [GitHub's script-injection guidance](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections).
+
+If you need values from PR-controlled context inside a hook, pass them
+via an intermediate env var rather than interpolating them directly into
+the snippet:
+
+```yaml
+- uses: stefanzweifel/git-auto-commit-action@v7
+  env:
+    PR_TITLE: ${{ github.event.pull_request.title }}
+  with:
+    before_commit_hook: |
+      # $PR_TITLE is read as data, not evaluated as code
+      echo "PR: $PR_TITLE"
+```
+
 ## Limitations & Gotchas
 
 The goal of this Action is to be "the Action for committing files for the 80% use case". Therefore, you might run into issues if your Workflow falls into the not supported 20% portion.
@@ -207,11 +327,11 @@ If this Action doesn't work for your workflow, check out [EndBug/add-and-commit]
 
 ### Checkout the correct branch
 
-You must use `action/checkout@v2` or later versions to check out the repository.
+You must use `actions/checkout@v2` or later versions to check out the repository.
 In non-`push` events, such as `pull_request`, make sure to specify the `ref` to check out:
 
 ```yaml
-- uses: actions/checkout@v4
+- uses: actions/checkout@v5
   with:
     ref: ${{ github.head_ref }}
 ```
@@ -229,7 +349,7 @@ You can change this by creating a new [Personal Access Token (PAT)](https://gith
 storing the token as a secret in your repository and then passing the new token to the [`actions/checkout`](https://github.com/actions/checkout#usage) Action step.
 
 ```yaml
-- uses: actions/checkout@v4
+- uses: actions/checkout@v5
   with:
     token: ${{ secrets.PAT }}
 ```
@@ -237,13 +357,13 @@ storing the token as a secret in your repository and then passing the new token
 If you create a personal access token (classic), apply the `repo` and `workflow` scopes.
 If you create a fine-grained personal access token, apply the `Contents`-permissions.
 
-If you work in an organization and don't want to create a PAT from your personal account, we recommend using a [robot account](https://docs.github.com/en/github/getting-started-with-github/types-of-github-accounts) for the token.
+If you work in an organization and don't want to create a PAT from your personal account, we recommend using a [robot account](https://docs.github.com/en/get-started/learning-about-github/types-of-github-accounts) for the token.
 
 ### Prevent Infinite Loop when using a Personal Access Token
 
 If you're using a Personal Access Token (PAT) to push commits to GitHub repository, the resulting commit or push can trigger other GitHub Actions workflows. This can result in an infinite loop.
 
-If you would like to prevent this, you can add `skip-checks:true` to the commit message. See [Skipping workflow runs](https://docs.github.com/en/actions/managing-workflow-runs/skipping-workflow-runs) for details.
+If you would like to prevent this, you can add `skip-checks:true` to the commit message. See [Skipping workflow runs](https://docs.github.com/en/actions/how-tos/manage-workflow-runs/skip-workflow-runs) for details.
 
 ### Change to file is not detected
 
@@ -255,7 +375,7 @@ Does your workflow change a file, but "git-auto-commit" does not detect the chan
 
 If your commit message should span multiple lines, you have to create a separate step to generate the string.
 
-The example below can be used as a starting point to generate a multiline commit meesage. Learn more how multiline strings in GitHub Actions work in the [GitHub documentation](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings).
+The example below can be used as a starting point to generate a multiline commit meesage. Learn more how multiline strings in GitHub Actions work in the [GitHub documentation](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands#multiline-strings).
 
 ```yaml
     # Building a multiline commit message
@@ -275,7 +395,7 @@ The example below can be used as a starting point to generate a multiline commit
     # Quick and dirty step to get rid of the temporary file holding the commit message
     - run: rm -rf commitmessage.txt
 
-    - uses: stefanzweifel/git-auto-commit-action@v5
+    - uses: stefanzweifel/git-auto-commit-action@v7
       id: commit
       with:
         commit_message: ${{ steps.commit_message_step.outputs.commit_message }}
@@ -299,7 +419,7 @@ As git-auto-commit by default does not use **your** username and email when crea
     git_commit_gpgsign: true
 
 - name: "Commit and push changes"
-  uses: stefanzweifel/git-auto-commit-action@v5
+  uses: stefanzweifel/git-auto-commit-action@v7
   with:
      commit_author: "${{ steps.import-gpg.outputs.name }} <${{ steps.import-gpg.outputs.email }}>"
      commit_user_name: ${{ steps.import-gpg.outputs.name }}
@@ -310,15 +430,16 @@ See discussion [#334](https://github.com/stefanzweifel/git-auto-commit-action/di
 
 ### Use in forks from private repositories
 
+
 By default, GitHub Actions doesn't run Workflows on forks from **private** repositories. To enable Actions for **private** repositories enable "Run workflows from pull requests" in your repository settings.
 
-See [this announcement from GitHub](https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/) or the [GitHub docs](https://docs.github.com/en/github/administering-a-repository/disabling-or-limiting-github-actions-for-a-repository#enabling-workflows-for-private-repository-forks) for details.
+See [this announcement from GitHub](https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/) or the [GitHub docs](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks) for details.
 
 
 ### Use in forks from public repositories
 
 > [!NOTE] 
-> This Action technically works with forks. However, please note that the combination of triggers and their options can cause issues. Please read [the documentation](https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows) on which triggers GitHub Actions support.\
+> This Action technically works with forks. However, please note that the combination of triggers and their options can cause issues. Please read [the documentation](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows) on which triggers GitHub Actions support.\
 > Ensure your contributors enable "Allow edits by maintainers" when opening a pull request. ([Learn more](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork)) \
 > \
 > **If you use this Action in combination with a linter/fixer, it's easier if you run the Action on `push` on your `main`-branch.**
@@ -327,17 +448,22 @@ See [this announcement from GitHub](https://github.blog/2020-08-03-github-action
 > Due to limitations of GitHub, this Action currently can't push commits to a base repository, if the fork _lives_ under an organisation. See [github/community#6634](https://github.com/orgs/community/discussions/5634) and [this comment](https://github.com/stefanzweifel/git-auto-commit-action/issues/211#issuecomment-1428849944) for details.
 
 By default, this Action will not run on Pull Requests which have been opened by forks. (This is a limitation by GitHub, not by us.)
-However, there are a couple of ways to use this Actions in Workflows that should be triggered by forked repositories.
+However, there are a couple of ways to use this Action in Workflows that should be triggered by forked repositories.
 
 ### Workflow should run in **base** repository
 
 > [!CAUTION]
 > The following section explains how you can use git-auto-commit in combination with the `pull_request_target` trigger.
 > **Using `pull_request_target` in your workflows can lead to repository compromise as [mentioned](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) by GitHub's own security team. This means, that a bad actor could potentially leak/steal your GitHub Actions repository secrets.**
-> Please be aware of this risk when using `pull_request_target` in your workflows.
+> Please be aware of this risk when using `pull_request_target` in your workflows. See [GitHub's documentation](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target) for more information.
 >
 > If your workflow runs code-fixing tools, consider running the workflow on your default branch by listening to the `push` event or use a third-party tool like [autofix.ci](https://autofix.ci/).
 > We keep this documentation around, as many questions came in over the years, on how to use this action for public forks.
+>
+> To remind users of this risk, git-auto-commit emits a warning annotation whenever it detects it is running on a `pull_request_target` event.
+> If you have evaluated the risk and want to silence the warning, set the `disable_pull_request_target_trigger_warning` input to `true`.
+>
+> **Extra caution if you also use [hooks](#hooks):** hook snippets are evaluated as shell code. Interpolating attacker-controlled fields (PR title/body, branch name, fork commit messages, etc.) directly into a hook input on a `pull_request_target` workflow lets a malicious PR run arbitrary commands on your runner with access to your secrets. Pass such values through an `env:` block and reference them as `$VARS` inside the snippet — see the [Security note in the Hooks section](#security) for an example.
 
 The workflow below runs whenever a commit is pushed to the `main`-branch or when activity on a pull request happens, by listening to the [`pull_request_target`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) event.
 
@@ -362,7 +488,7 @@ jobs:
       contents: write
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         # Checkout the fork/head-repository and push changes to the fork.
         # If you skip this, the base repository will be checked out and changes
@@ -376,7 +502,7 @@ jobs:
     - name: Run php-cs-fixer
       uses: docker://oskarstark/php-cs-fixer-ga
 
-    - uses: stefanzweifel/git-auto-commit-action@v5
+    - uses: stefanzweifel/git-auto-commit-action@v7
 ```
 
 For more information about running Actions on forks, see [this announcement from GitHub](https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/).
@@ -398,7 +524,7 @@ Finally, you have to use `push_options: '--force'` to overwrite the git history
 The steps in your workflow might look like this:
 
 ```yaml
-- uses: actions/checkout@4
+- uses: actions/checkout@v4
   with:
     # Fetch the last 2 commits instead of just 1. (Fetching just 1 commit would overwrite the whole history)
     fetch-depth: 2
@@ -411,7 +537,7 @@ The steps in your workflow might look like this:
     echo "message=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT
     echo "author=$(git log -1 --pretty=\"%an <%ae>\")" >> $GITHUB_OUTPUT
 
-- uses: stefanzweifel/git-auto-commit-action@v5
+- uses: stefanzweifel/git-auto-commit-action@v7
   with:
     commit_author: ${{ steps.last-commit.outputs.author }}
     commit_message: ${{ steps.last-commit.outputs.message }}
@@ -423,6 +549,7 @@ The steps in your workflow might look like this:
 See discussion in [#159](https://github.com/stefanzweifel/git-auto-commit-action/issues/159#issuecomment-845347950) for details.
 
 ## Troubleshooting
+
 ### Action does not push commit to repository
 
 Make sure to [checkout the correct branch](#checkout-the-correct-branch).
@@ -432,14 +559,16 @@ Make sure to [checkout the correct branch](#checkout-the-correct-branch).
 If your Workflow can't push the commit to the repository because of authentication issues,
 please update your Workflow configuration and usage of [`actions/checkout`](https://github.com/actions/checkout#usage).
 
-Updating the `token` value with a Personal Access Token should fix your issues.
+Please note that `persist-credentials` in `actions/checkout` must be set to `true` to push new commits to the repository.
+
+If you still can't push the commit, and you're using branch protection rules or similar features, updating the `token` value with a Personal Access Token should fix your issues.
 
 ### git-auto-commit fails to push commit that creates or updates files in `.github/workflows/`
 
 The default `GITHUB_TOKEN` issued by GitHub Action does not have permission to make changes to workflow files located in `.github/workflows/`.
 To fix this, please create a personal access token (PAT) and pass the token to the `actions/checkout`-step in your workflow. (Similar to [how to push to protected branches](https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#push-to-protected-branches)).
 
-If a PAT does not work for you, you could also create a new GitHub app and use it's token in your workflows. See [this comment in #87](https://github.com/stefanzweifel/git-auto-commit-action/issues/87#issuecomment-1939138661) for details.
+If a PAT does not work for you, you could also create a new GitHub app and use its token in your workflows. See [this comment in #87](https://github.com/stefanzweifel/git-auto-commit-action/issues/87#issuecomment-1939138661) for details.
 
 See [#322](https://github.com/stefanzweifel/git-auto-commit-action/issues/322) for details and discussions around this topic.
 
@@ -454,19 +583,21 @@ If you create a personal access token (classic), apply the `repo` and `workflow`
 If you create a fine-grained personal access token, apply the `Contents`-permissions.
 
 ```yaml
-- uses: actions/checkout@v4
+- uses: actions/checkout@v5
   with:
-    token: ${{ secrets.PAT }}
+    # We pass the "PAT" secret to the checkout action; if no PAT secret is available to the workflow runner (eg. Dependabot) we fall back to the default "GITHUB_TOKEN".
+    token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
 ```
-You can learn more about Personal Access Token in the [GitHub documentation](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token).
+You can learn more about Personal Access Token in the [GitHub documentation](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens).
+
 
 > [!TIP]
 > If you're working in an organisation, and you don't want to create the PAT from your personal account, we recommend using a bot-account for such tokens.
 
-If you go the "force pushes" route, you have to enable force pushes to a protected branch (see [documentation](https://help.github.com/en/github/administering-a-repository/enabling-force-pushes-to-a-protected-branch)) and update your Workflow to use force push like this.
+If you go the "force pushes" route, you have to enable force pushes to a protected branch (see [documentation](https://docs.github.com/en/github/administering-a-repository/enabling-force-pushes-to-a-protected-branch)) and update your Workflow to use force push like this.
 
 ```yaml
-    - uses: stefanzweifel/git-auto-commit-action@v5
+    - uses: stefanzweifel/git-auto-commit-action@v7
       with:
         commit_message: Apply php-cs-fixer changes
         push_options: --force
@@ -486,7 +617,7 @@ See [Issue #227](https://github.com/stefanzweifel/git-auto-commit-action/issues/
 
 ### Custom `file_pattern`, changed files but seeing "Working tree clean. Nothing to commit." in the logs
 
-If you're using a custom `file_pattern` and the Action does not detect the changes made in your worfklow, you're probably running into a globbing issue.
+If you're using a custom `file_pattern` and the Action does not detect the changes made in your workflow, you're probably running into a globbing issue.
 
 Let's imagine you use `file_pattern: '*.md'` to detect and commit changes to all Markdown files in your repository.
 If your Workflow now only updates `.md`-files in a subdirectory, but you have an untouched `.md`-file in the root of the repository, the git-auto-commit Action will display "Working tree clean. Nothing to commit." in the Workflow log.
@@ -496,7 +627,7 @@ This is due to the fact, that the `*.md`-glob is expanded before sending it to `
 To fix this add `disable_globbing: true` to your Workflow.
 
 ```yaml
-- uses: stefanzweifel/git-auto-commit-action@v5
+- uses: stefanzweifel/git-auto-commit-action@v7
   with:
     file_pattern: '*.md'
     disable_globbing: true
@@ -522,10 +653,10 @@ yarn test
 
 ## Versioning
 
-We use [SemVer](http://semver.org/) for versioning. For the versions available, see the [tags on this repository](https://github.com/stefanzweifel/git-auto-commit-action/tags).
+We use [SemVer](https://semver.org/) for versioning. For the versions available, see the [tags on this repository](https://github.com/stefanzweifel/git-auto-commit-action/tags).
 
-We also provide major version tags to make it easier to always use the latest release of a major version. For example, you can use `stefanzweifel/git-auto-commit-action@v5` to always use the latest release of the current major version.
-(More information about this [here](https://help.github.com/en/actions/building-actions/about-actions#versioning-your-action).)
+We also provide major version tags to make it easier to always use the latest release of a major version. For example, you can use `stefanzweifel/git-auto-commit-action@v7` to always use the latest release of the current major version.
+(More information about this [here](https://docs.github.com/en/actions/building-actions/about-actions#versioning-your-action).)
 
 ## Credits
 

UPGRADING.md

@@ -0,0 +1,18 @@
+# Upgrading
+
+## From v6 to v7
+
+The previously removed options `create_branch`, `skip_fetch`, and `skip_checkout` have been reintroduced in git-auto-commit v7. If you had removed these options from your workflows when upgrading to v6, you can now add them back if needed.
+
+Tagging a commit has been reworked. In addition to the existing `tagging_message`-option, a new `tag_name` option has been added. If you were using `tagging_message`, you can continue to do so, but if you want to specify a custom tag name and tag message, you can now use the `tag_name` and `tagging_message` options.
+
+(Specifying a `tagging_message` without a `tag_name` will create a tag with the name and message both set to the value of `tagging_message`.)
+
+## From v5 to v6
+
+The following options have been removed from git-auto-commit and can be removed from your workflows.
+
+- `create_branch` (git-auto-commit no longer switches branches locally during a workflow run)
+- `skip_fetch`
+- `skip_checkout`
+

action.yml

@@ -25,11 +25,11 @@ inputs:
     required: false
     default: ''
   file_pattern:
-    description: File pattern used for `git add`. For example `src/*.js`
+    description: File pattern used for `git add` and the dirty-check (`git status`). Supports multiple space-separated patterns. For example `src/*.js`
     required: false
     default: '.'
   repository:
-    description: Local file path to the git repository. Defaults to the current directory (`.`)
+    description: Relative file path under $GITHUB_WORKSPACE to the git repository. Defaults to the current directory (`.`)
     required: false
     default: '.'
   commit_user_name:
@@ -44,8 +44,12 @@ inputs:
     description: Value used for the commit author. Defaults to the username of whoever triggered this workflow run.
     required: false
     default: ${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com>
+  tag_name:
+    description: Tag name used for creating a new git tag with the commit. Keep this empty, if no tag should be created.
+    required: false
+    default: ''
   tagging_message:
-    description: Message used to create a new git tag with the commit. Keep this empty, if no tag should be created.
+    description: Tagging message used for creating a new git tag with the commit. Keep this empty, if no tag should be created.
     required: false
     default: ''
   push_options:
@@ -64,24 +68,74 @@ inputs:
     description: Skip the call to git-checkout.
     required: false
     default: false
+  skip_push:
+    description: Skip the call to git-push.
+    required: false
+    default: false
   disable_globbing:
     description: Stop the shell from expanding filenames (https://www.gnu.org/software/bash/manual/html_node/Filename-Expansion.html)
+    required: false
     default: false
   create_branch:
     description: Create new branch with the name of `branch`-input in local and remote repository, if it doesn't exist yet.
+    required: false
+    default: false
+  create_git_tag_only:
+    description: Perform a clean git tag and push, without commiting anything
+    required: false
+    default: false
+  before_add_hook:
+    description: Shell snippet to run before `git add`.
+    required: false
+    default: ''
+  after_add_hook:
+    description: Shell snippet to run after `git add`.
+    required: false
+    default: ''
+  before_commit_hook:
+    description: Shell snippet to run before `git commit`.
+    required: false
+    default: ''
+  after_commit_hook:
+    description: Shell snippet to run after `git commit`.
+    required: false
+    default: ''
+  before_tag_hook:
+    description: Shell snippet to run before `git tag` is created.
+    required: false
+    default: ''
+  after_tag_hook:
+    description: Shell snippet to run after `git tag` is created.
+    required: false
+    default: ''
+  before_push_hook:
+    description: Shell snippet to run before `git push`.
+    required: false
+    default: ''
+  after_push_hook:
+    description: Shell snippet to run after `git push`.
+    required: false
+    default: ''
+  disable_pull_request_target_trigger_warning:
+    description: Suppress the security warning emitted when the action runs on a `pull_request_target` event.
+    required: false
     default: false
   internal_git_binary:
     description: Internal use only! Path to git binary used to check if git is available. (Don't change this!)
+    required: false
     default: git
 
+
 outputs:
   changes_detected:
-    description: Value is "true", if the repository was dirty and file changes have been detected. Value is "false", if no changes have been detected.
+    description: Value is "true" if matching changes were detected and committed. Value is "false" if no matching changes were detected or only CRLF changes were staged. Not set in `create_git_tag_only` mode.
   commit_hash:
-    description: Full hash of the created commit. Only present if the "changes_detected" output is "true".
+    description: Full hash of the created commit. Only set when a commit was actually made (i.e. `changes_detected` is "true").
+  create_git_tag_only:
+    description: Set to "true" when the action ran in `create_git_tag_only` mode. Never set to "false".
 
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'index.js'
 
 branding:

entrypoint.sh

@@ -26,29 +26,80 @@ _log() {
     echo "::$level::$message";
 }
 
+_run_hook() {
+    local name=${1}
+    local snippet=${2:-}
+
+    if [ -n "$snippet" ]; then
+        _log "debug" "Running $name";
+        eval "$snippet"
+    fi
+}
+
 _main() {
     _check_if_git_is_available
 
     _switch_to_repository
 
-    if _git_is_dirty || "$INPUT_SKIP_DIRTY_CHECK"; then
+    _check_if_is_git_repository
+
+    _check_if_repository_is_in_detached_state
+
+    _check_for_pull_request_target_trigger
+
+    if "$INPUT_CREATE_GIT_TAG_ONLY"; then
+        _log "debug" "Create git tag only";
+        _set_github_output "create_git_tag_only" "true"
+
+        if [ -n "$INPUT_TAG_NAME" ] || [ -n "$INPUT_TAGGING_MESSAGE" ]; then
+            _run_hook "before_tag_hook" "$INPUT_BEFORE_TAG_HOOK"
+            _tag_commit
+            _run_hook "after_tag_hook" "$INPUT_AFTER_TAG_HOOK"
+        else
+            _tag_commit
+        fi
+
+        if ! "$INPUT_SKIP_PUSH"; then
+            _run_hook "before_push_hook" "$INPUT_BEFORE_PUSH_HOOK"
+        fi
+        _push_to_github
+        if ! "$INPUT_SKIP_PUSH"; then
+            _run_hook "after_push_hook" "$INPUT_AFTER_PUSH_HOOK"
+        fi
+    elif _git_is_dirty || "$INPUT_SKIP_DIRTY_CHECK"; then
 
         _set_github_output "changes_detected" "true"
 
         _switch_to_branch
 
+        _run_hook "before_add_hook" "$INPUT_BEFORE_ADD_HOOK"
         _add_files
+        _run_hook "after_add_hook" "$INPUT_AFTER_ADD_HOOK"
 
         # Check dirty state of repo again using git-diff.
         # (git-diff detects better if CRLF of files changes and does NOT
         # proceed, if only CRLF changes are detected. See #241 and #265
         # for more details.)
         if [ -n "$(git diff --staged)" ] || "$INPUT_SKIP_DIRTY_CHECK"; then
+            _run_hook "before_commit_hook" "$INPUT_BEFORE_COMMIT_HOOK"
             _local_commit
+            _run_hook "after_commit_hook" "$INPUT_AFTER_COMMIT_HOOK"
 
-            _tag_commit
+            if [ -n "$INPUT_TAG_NAME" ] || [ -n "$INPUT_TAGGING_MESSAGE" ]; then
+                _run_hook "before_tag_hook" "$INPUT_BEFORE_TAG_HOOK"
+                _tag_commit
+                _run_hook "after_tag_hook" "$INPUT_AFTER_TAG_HOOK"
+            else
+                _tag_commit
+            fi
 
+            if ! "$INPUT_SKIP_PUSH"; then
+                _run_hook "before_push_hook" "$INPUT_BEFORE_PUSH_HOOK"
+            fi
             _push_to_github
+            if ! "$INPUT_SKIP_PUSH"; then
+                _run_hook "after_push_hook" "$INPUT_AFTER_PUSH_HOOK"
+            fi
         else
             _set_github_output "changes_detected" "false"
 
@@ -86,11 +137,35 @@ _git_is_dirty() {
     gitStatusMessage="$((git status -s $INPUT_STATUS_OPTIONS -- ${INPUT_FILE_PATTERN_EXPANDED:+${INPUT_FILE_PATTERN_EXPANDED[@]}} >/dev/null ) 2>&1)";
     # shellcheck disable=SC2086
     gitStatus="$(git status -s $INPUT_STATUS_OPTIONS -- ${INPUT_FILE_PATTERN_EXPANDED:+${INPUT_FILE_PATTERN_EXPANDED[@]}})";
-    if [ $? -ne 0 ]; then
-        _log "error" "git-status failed with:<$gitStatusMessage>";
+    [ -n "$gitStatus" ]
+}
+
+_check_if_is_git_repository() {
+    if [ -d ".git" ]; then
+        _log "debug" "Repository found.";
+    else
+        _log "error" "Not a git repository. Please make sure to run this action in a git repository. Adjust the `repository` input if necessary.";
         exit 1;
     fi
-    [ -n "$gitStatus" ]
+}
+
+_check_for_pull_request_target_trigger() {
+    if "$INPUT_DISABLE_PULL_REQUEST_TARGET_TRIGGER_WARNING"; then
+        return
+    fi
+
+    if [ "${GITHUB_EVENT_NAME:-}" = "pull_request_target" ]; then
+        _log "warning" "git-auto-commit is running on a 'pull_request_target' event. This trigger can be a security risk: a malicious pull request could potentially exfiltrate your repository secrets. See https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target and the 'pull_request_target' section in the git-auto-commit README (https://github.com/stefanzweifel/git-auto-commit-action#using-the-action-in-a-pull_request_target-workflow) for safer usage. Set 'disable_pull_request_target_trigger_warning: true' to suppress this warning.";
+    fi
+}
+
+_check_if_repository_is_in_detached_state() {
+    if [ -z "$(git symbolic-ref HEAD)" ]
+    then
+        _log "warning" "Repository is in a detached HEAD state. git-auto-commit will likely handle this automatically. To avoid it, check out a branch using the ref option in actions/checkout.";
+    else
+        _log "debug" "Repository is on a branch.";
+    fi
 }
 
 _switch_to_branch() {
@@ -100,6 +175,7 @@ _switch_to_branch() {
     if "$INPUT_SKIP_FETCH"; then
         _log "debug" "git-fetch will not be executed.";
     else
+        _log "debug" "git-fetch will be executed.";
         git fetch --depth=1;
     fi
 
@@ -107,6 +183,7 @@ _switch_to_branch() {
     if "$INPUT_SKIP_CHECKOUT"; then
         _log "debug" "git-checkout will not be executed.";
     else
+        _log "debug" "git-checkout will be executed.";
         # Create new local branch if `create_branch`-input is true
         if "$INPUT_CREATE_BRANCH"; then
             # shellcheck disable=SC2086
@@ -151,18 +228,27 @@ _local_commit() {
 }
 
 _tag_commit() {
+    echo "INPUT_TAG_NAME: ${INPUT_TAG_NAME}"
     echo "INPUT_TAGGING_MESSAGE: ${INPUT_TAGGING_MESSAGE}"
 
-    if [ -n "$INPUT_TAGGING_MESSAGE" ]
-    then
-        _log "debug" "Create tag $INPUT_TAGGING_MESSAGE";
-        git -c user.name="$INPUT_COMMIT_USER_NAME" -c user.email="$INPUT_COMMIT_USER_EMAIL" tag -a "$INPUT_TAGGING_MESSAGE" -m "$INPUT_TAGGING_MESSAGE";
+    if [ -n "$INPUT_TAG_NAME" ] || [ -n "$INPUT_TAGGING_MESSAGE" ]; then
+        INTERNAL_TAG=${INPUT_TAG_NAME:-$INPUT_TAGGING_MESSAGE}
+        INTERNAL_TAGGING_MESSAGE=${INPUT_TAGGING_MESSAGE:-$INPUT_TAG_NAME}
+
+        _log "debug" "Create tag $INTERNAL_TAG: $INTERNAL_TAGGING_MESSAGE"
+        git -c user.name="$INPUT_COMMIT_USER_NAME" -c user.email="$INPUT_COMMIT_USER_EMAIL" tag -a "$INTERNAL_TAG" -m "$INTERNAL_TAGGING_MESSAGE"
     else
-        echo "No tagging message supplied. No tag will be added.";
+        echo "Neither tag nor tag message is set. No tag will be added.";
     fi
 }
 
 _push_to_github() {
+    if "$INPUT_SKIP_PUSH"; then
+        _log "debug" "git-push will not be executed.";
+        return
+    fi
+
+    echo "INPUT_BRANCH value: $INPUT_BRANCH";
 
     echo "INPUT_PUSH_OPTIONS: ${INPUT_PUSH_OPTIONS}";
     _log "debug" "Apply push options ${INPUT_PUSH_OPTIONS}";
@@ -172,8 +258,8 @@ _push_to_github() {
 
     if [ -z "$INPUT_BRANCH" ]
     then
-        # Only add `--tags` option, if `$INPUT_TAGGING_MESSAGE` is set
-        if [ -n "$INPUT_TAGGING_MESSAGE" ]
+        # Only add `--tags` option, if `$INPUT_TAG_NAME` or `$INPUT_TAGGING_MESSAGE` is set
+        if [ -n "$INPUT_TAG_NAME" ] || [ -n "$INPUT_TAGGING_MESSAGE" ]
         then
             _log "debug" "git push origin --tags";
             git push origin --follow-tags --atomic ${INPUT_PUSH_OPTIONS:+"${INPUT_PUSH_OPTIONS_ARRAY[@]}"};

package-lock.json

@@ -0,0 +1,37 @@
+{
+  "name": "git-auto-commit-action",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "devDependencies": {
+        "bats": "^1.13.0",
+        "bats-assert": "ztombol/bats-assert",
+        "bats-support": "ztombol/bats-support"
+      }
+    },
+    "node_modules/bats": {
+      "version": "1.13.0",
+      "resolved": "https://registry.npmjs.org/bats/-/bats-1.13.0.tgz",
+      "integrity": "sha512-giSYKGTOcPZyJDbfbTtzAedLcNWdjCLbXYU3/MwPnjyvDXzu6Dgw8d2M+8jHhZXSmsCMSQqCp+YBsJ603UO4vQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "bats": "bin/bats"
+      }
+    },
+    "node_modules/bats-assert": {
+      "version": "0.3.0",
+      "resolved": "git+ssh://git@github.com/ztombol/bats-assert.git#9f88b4207da750093baabc4e3f41bf68f0dd3630",
+      "dev": true,
+      "peerDependencies": {
+        "bats-support": "git+https://github.com/ztombol/bats-support.git#v0.2.0"
+      }
+    },
+    "node_modules/bats-support": {
+      "version": "0.3.0",
+      "resolved": "git+ssh://git@github.com/ztombol/bats-support.git#004e707638eedd62e0481e8cdc9223ad471f12ee",
+      "dev": true
+    }
+  }
+}

package.json

@@ -1,6 +1,6 @@
 {
   "devDependencies": {
-    "bats": "^1.11.1",
+    "bats": "^1.13.0",
     "bats-assert": "ztombol/bats-assert",
     "bats-support": "ztombol/bats-support"
   },

yarn.lock

@@ -1,16 +0,0 @@
-# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
-# yarn lockfile v1
-
-
-bats-assert@ztombol/bats-assert:
-  version "0.3.0"
-  resolved "https://codeload.github.com/ztombol/bats-assert/tar.gz/9f88b4207da750093baabc4e3f41bf68f0dd3630"
-
-bats-support@ztombol/bats-support:
-  version "0.3.0"
-  resolved "https://codeload.github.com/ztombol/bats-support/tar.gz/004e707638eedd62e0481e8cdc9223ad471f12ee"
-
-bats@^1.11.1:
-  version "1.11.1"
-  resolved "https://registry.yarnpkg.com/bats/-/bats-1.11.1.tgz#e87fa1161d5110ec3a685e2e233f2f2bfb26ebfd"
-  integrity sha512-Dh26FsiLog+wwQeTkboYo2xYj9rUaPEbibUobnYb3G3M9hva/Kby00wrAN9VB9qqGVhl/pYjjt/LVBWwjXlD2A==