steps:
    - name: Checkout repository
      uses: actions/checkout@v2
      with:
        # We must fetch at least the immediate parents so that if this is
        # a pull request then we can checkout the head.
        fetch-depth: 2

    # If this run was triggered by a pull request event, then checkout
    # the head of the pull request instead of the merge commit.

[GOOS:windows] replace '\n' '\r\n' .svn-log
cmp stdout .svn-log

-- .checkout/.git-log --
ab9f66b (HEAD -> master) add pkg
7f800d2 (origin/master, origin/HEAD) README
-- .checkout/p1/p1.go --
package p1
-- .checkout/pkg/pkg.go --
package pkg
const Message = "code not in git-README-only"
-- .checkout/README --
README
-- .checkout/p1/p1.go --
package p1
-- .checkout/.svn-log --
<?xml version="1.0" encoding="UTF-8"?>
<log>

 Distribution Url: $gradleBin
Download Location: $f.absolutePath
Expected checksum: 'bad'
  Actual checksum: '$distributionHash'
""".trim())
    }

    private String getGradleBin() {
        "${server.uri}/gradle-bin.zip"
    }

    String getDistributionHash() {

import org.apache.maven.api.services.ChecksumAlgorithmService;
import org.apache.maven.api.services.ChecksumAlgorithmServiceException;
import org.eclipse.aether.spi.connector.checksum.ChecksumAlgorithmFactory;
import org.eclipse.aether.spi.connector.checksum.ChecksumAlgorithmFactorySelector;

import static org.apache.maven.internal.impl.Utils.nonNull;

@Named
@Singleton

name: 'Dependency Review'
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout Repository'
        uses: actions/checkout@v4
      - name: 'Dependency Review'

      - name: Checkout repository for nightly (skipped for releases)
        if: ${{ github.event_name == 'schedule' }}
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          ref: 'nightly'
      - name: Checkout repository
        if: ${{ github.event_name == 'push' }}
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

                        // file...we'll try again with the MD5 checksum.
                        try {
                            verifyChecksum(md5ChecksumObserver, destination, temp, remotePath, ".md5", wagon);
                        } catch (ChecksumFailedException e) {
                            // if we also fail to verify based on the MD5 checksum, and the checksum transfer/read

svn log --xml

[GOOS:windows] replace '\n' '\r\n' .svn-log
cmp stdout .svn-log

-- .checkout/git-README-only/pkg/pkg.go --
package pkg
const Message = "code not in git-README-only"
-- .checkout/git-README-only/README --
README
-- .checkout/.git-log --
ab9f66b (HEAD -> master) add pkg
7f800d2 (origin/master, origin/HEAD) README
-- .checkout/pkg.go --
package p

import "vcs-test.swtch.com/go/test1-svn-git/git-README-only/pkg"

at 2022-02-02T14:19:44-05:00
git branch 'v1.0.0'
git branch 'v2.0.0'
git checkout 'v1.0.0'
cp v1/pkg/pkg.go pkg/pkg.go
git commit -a -m 'pkg: start developing toward v1.0.0'

at 2022-02-03T10:53:13-05:00
git branch 'v3.0.0-devel'
git checkout 'v3.0.0-devel'
git checkout v0.1.0 pkg/pkg.go
git commit -a -m 'pkg: remove panic'
git tag v4.0.0-beta.1

git checkout main

git show-ref --tags --heads
cmp stdout .git-refs

  - On artifact bar-1.0.jar (org:bar:1.0) in repository 'maven': expected a 'sha1' checksum of 'also invalid' but was '${getChecksum(bar, "sha1")}'
  - On artifact foo-1.0.jar (org:foo:1.0) in repository 'maven': expected a 'sha1' checksum of 'invalid' but was '${getChecksum(foo, "sha1")}'
  - On artifact foo-1.0.pom (org:foo:1.0) in repository 'maven': expected a 'sha1' checksum of 'invalid' but was '${getChecksum(foo, "sha1", "pom")}'