Security: add specific file on git

[jeankev]

Hi, thank you for your very practical github action!

I saw in the code that you do a git "add."
this is dangerous for certain workflows which could lead to storing "sensitive" files in previous steps and then add and commit + push in your action

From my point of view it would be cool to add only the changelog (depending on the name options chosen in the call to the github action)?

or to propose a parameter to choose the files to commit yourself?

I don't know.

PS: a simple addition in the gitignore could avoid this kind of error but it avoids errors

[chelsea-codes]

I agree completely.

By default, I would expect the bare minimum files for versioning to be committed, and then use an override if you want to commit all with git add .. Or even better choose the files to add, as was suggested by OP, so that files are added and committed with intention.

[TriPSs]

@chelsea-codes @jeankev an PR would be appreciated.