chore(deps): bump actions/checkout from 6.0.3 to 7.0.0#3138
chore(deps): bump actions/checkout from 6.0.3 to 7.0.0#3138dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
the
dependencies
dependabot
Bot
requested review from
MohammadHaroonAbuomar and
imran-siddique
as code owners
dependabot
Bot
added
the
dependencies
PR Review Summary
Verdict: AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims. |
github-actions
Bot
added
scripts/ci/cd
size/M
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
📦 Dependency diff (SBOM)Comparing main → dependabot/github_actions/actions/checkout-7.0.0. Summary: ➕ 0 added · ➖ 0 removed · 🔄 1 bumped 🔄 Bumped
|
| Package | From | To |
|---|---|---|
| actions/checkout | df4cb1c069e1874edd31b4311f1884172cec0e10 | 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 |
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7.0.0
branch
from
d286389 to
180af9b
Compare
MohammadHaroonAbuomar
left a comment
MohammadHaroonAbuomar
left a comment
There was a problem hiding this comment.
All v7 behavioral changes are compatible with this repo: no pull_request_target or workflow_run workflow checks out the fork head; every runs-on is GitHub-hosted (runner >= 2.329.0); the credential relocation is transparent for the two workflows that git push after checkout.
Holding for one tooling fix: .github/ci/actions.toml:10-11 still pins actions/checkout to the v6.0.3 SHA. policy-engine-ci.yml is generated from that registry, so the Check generated workflows job is red. Please update actions.toml to the v7.0.0 SHA and regenerate. Also two stale comments: docs.yml:39 (# v4) and sbom-diff.yml:48-52 (still says v6.0.3).
imran-siddique
left a comment
imran-siddique
left a comment
There was a problem hiding this comment.
Three issues need to be fixed before this can merge, all already called out by @MohammadHaroonAbuomar. The Check generated workflows CI failure is the clearest signal.\n\nBlocking: .github/ci/actions.toml not updated\n\nLines 10-11 still pin actions/checkout to the v6.0.3 SHA:\n\ntoml\n[checkout]\nuses = "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10"\ncomment = "v6.0.3"\n\n\nThis is the registry the CI generator reads. Until it is updated to 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 / v7.0.0, the generated policy-engine-ci.yml will differ from what is checked in and the Check generated workflows job will stay red.\n\nStale comment: .github/workflows/docs.yml line 39\n\nThe SHA was bumped to the v7.0.0 commit, but the inline comment still says # v4:\n\nyaml\n- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4\n\n\nShould read # v7.0.0.\n\nStale comment and missed bump: .github/workflows/sbom-diff.yml lines 48-65\n\nBoth checkout steps (lines 54 and 61) still reference the old v6.0.3 SHA. The prose comment at lines 48-52 also describes v6.0.3 as "current latest-stable" and would need updating. These steps were not included in the diff at all.\n\nOnce those three items are addressed and Check generated workflows goes green, this is a routine SHA bump with a clean dependency review, no vulnerabilities, and no behavioral impact on this repo (no pull_request_target or workflow_run workflows check out fork heads).
2 participants
Bumps actions/checkout from 6.0.3 to 7.0.0.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)