fix: use git add --sparse to handle sparse-checkout on orphan branch first run

actions/setup/js/push_repo_memory.cjs

@@ -368,9 +368,16 @@ async function main() {
 
   core.info("Changes detected, committing and pushing...");
 
-  // Stage all changes
+  // Stage all changes.
+  // --sparse: "Allow updating index entries outside of the sparse-checkout cone.
+  // Normally, git add refuses to update index entries whose paths do not fit
+  // within the sparse-checkout cone, since those files might be removed from the
+  // working tree without warning." (git-add(1))
+  // This is required because "git checkout --orphan" can re-activate
+  // sparse-checkout, causing a plain "git add ." to silently skip or reject
+  // files on the first run for a new memory branch.
   try {
-    execGitSync(["add", "."], { stdio: "inherit" });
+    execGitSync(["add", "--sparse", "."], { stdio: "inherit" });
   } catch (error) {
     core.setFailed(`Failed to stage changes: ${getErrorMessage(error)}`);
     return;

actions/setup/js/push_repo_memory.test.cjs

@@ -1057,6 +1057,29 @@ describe("push_repo_memory.cjs - shell injection security tests", () => {
       expect(scriptContent).toContain("fs.rmSync(");
     });
 
+    it("should use git add --sparse to handle sparse-checkout on orphan branch creation", () => {
+      // Regression test for: push_repo_memory fails with sparse-checkout error on first run.
+      //
+      // Root cause: "git checkout --orphan" can re-activate sparse-checkout behaviour.
+      // A plain "git add ." then fails because the files fall outside the sparse-checkout
+      // definition.
+      //
+      // Fix: use "git add --sparse ." so files are staged regardless of whether
+      // sparse-checkout is active.
+
+      const fs = require("fs");
+      const path = require("path");
+
+      const scriptPath = path.join(import.meta.dirname, "push_repo_memory.cjs");
+      const scriptContent = fs.readFileSync(scriptPath, "utf8");
+
+      // Must use "git add --sparse ." to stage files regardless of sparse-checkout state.
+      expect(scriptContent).toContain('"add", "--sparse", "."');
+
+      // Must NOT use plain "git add ." which breaks under sparse-checkout.
+      expect(scriptContent).not.toContain('"add", "."');
+    });
+
     it("should safely handle malicious branch names", () => {
       // Test that malicious branch names would be rejected by git, not executed as shell commands
       const maliciousBranchNames = [