Speed up full-history cache checkouts with bulk ref validation

__test__/composal-cache.test.ts

@@ -233,6 +233,12 @@ test('full history, annotated tags and sparse checkout keep standard Git behavio
   await expect(fs.access(path.join(workspace, 'root-file'))).rejects.toThrow()
 })
 
+test('bulk ref creation rejects invalid names without publishing local refs', async () => {
+  await expect(
+    cache({'refs/heads/main': second, 'refs/heads/invalid..name': first})
+  ).rejects.toThrow('Local checkout cache operation failed')
+})
+
 test('dissociate makes the checkout usable after the mounted cache disappears', async () => {
   const checkout = await cache()
   expect(
@@ -271,7 +277,7 @@ test('cache fetch failure removes its alternate and allows normal GitHub fetchin
 
 test('malformed cached ref metadata cannot write outside the temporary ref database', async () => {
   await expect(
-    cache({'refs/heads/main\ncreate refs/heads/injected': second})
+    cache({[`refs/heads/main ${second}\ncreate refs/heads/injected`]: second})
   ).rejects.toThrow()
   await expect(
     fs.access(path.join(workspace, '.git', 'objects', 'info', 'alternates'))

dist/index.js

@@ -42327,11 +42327,13 @@ class CheckoutCache {
         const refs = { ...manifest.refs, 'refs/composal/target': manifest.object_oid };
         const commands = [];
         for (const [name, value] of Object.entries(refs)) {
-            if (!oid.test(value) || !name.startsWith('refs/'))
+            if (!oid.test(value) ||
+                !name.startsWith('refs/') ||
+                /[\x00-\x20\x7f]/.test(name))
                 throw new Error('Invalid checkout cache ref');
-            run(['check-ref-format', name], localOrigin);
             commands.push(`create ${name} ${value}`);
         }
+        // update-ref validates the complete batch, including every ref name.
         run(['update-ref', '--stdin'], localOrigin, commands.join('\n') + '\n');
         const alternateFile = external_node_path_namespaceObject.join(workspace, '.git', 'objects', 'info', 'alternates');
         let previous = '';

package.json

@@ -1,6 +1,6 @@
 {
   "name": "composal-checkout",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Composal Git checkout action",
   "type": "module",
   "main": "lib/main.js",

src/composal-cache.ts

@@ -183,11 +183,15 @@ export class CheckoutCache {
     const refs = {...manifest.refs, 'refs/composal/target': manifest.object_oid}
     const commands: string[] = []
     for (const [name, value] of Object.entries(refs)) {
-      if (!oid.test(value) || !name.startsWith('refs/'))
+      if (
+        !oid.test(value) ||
+        !name.startsWith('refs/') ||
+        /[\x00-\x20\x7f]/.test(name)
+      )
         throw new Error('Invalid checkout cache ref')
-      run(['check-ref-format', name], localOrigin)
       commands.push(`create ${name} ${value}`)
     }
+    // update-ref validates the complete batch, including every ref name.
     run(['update-ref', '--stdin'], localOrigin, commands.join('\n') + '\n')
     const alternateFile = path.join(
       workspace,