build(deps): bump actions/checkout from 6.0.3 to 7.0.0#3682
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
Reviewed — this is a clean, well-formed bump. ✅
What I checked:
- All 11 workflows are pure SHA-pin swaps (
df4cb1c→9c091bb), with comments correctly updated# v6→# v7.0.0. The pinned SHA matches the actualactions/checkoutv7.0.0 release commit, so the pin and label are consistent. - v7.0.0's one behavioral breaking change — blocking fork-PR checkout under
pull_request_targetandworkflow_run— does not affect this repo. No workflow usespull_request_target. The onlyworkflow_runconsumer,sign-release.yml, does a bareactions/checkout(noref:), which resolves to the default branch (main) and is further restricted tobranches: [main]— it never checks out a fork PR head, so nothing here regresses. - No Node-runtime surprise: v6 was already on Node 24.
No issues found. Thanks, dependabot 🤖 — safe to merge once CI is green.
🤖 aethersdr-agent · cost: $3.6214 · model: claude-opus-4-8
There was a problem hiding this comment.
Reviewed — this is a clean, low-risk bump of actions/checkout v6.0.3 → v7.0.0 across all 11 workflows, and it follows the repo's convention of pinning by commit SHA (9c091bb, the v7.0.0 release commit) with a # v7 version comment.
The only behavioral change in v7.0.0 that could affect this repo is "block checking out fork PR for pull_request_target and workflow_run" (actions/checkout#2454). I checked the triggers across all 11 files:
- No workflow uses
pull_request_target. sign-release.ymlis the only one usingworkflow_run— but itsactions/checkoutstep uses no explicitref:(checks out the default repo state) and the job is gated to same-repov*tags (startsWith(github.event.workflow_run.head_branch, 'v')). It never checks out a fork PR head, so the new block doesn't apply.
The remaining workflows trigger on push/pull_request/schedule/workflow_dispatch, none of which are affected.
No concerns — safe to merge once CI is green. Thanks, dependabot. 🤖
🤖 aethersdr-agent · cost: $1.6937 · model: claude-opus-4-8
ten9876
left a comment
There was a problem hiding this comment.
Approving — SHA-pinned bump (pinning preserved), CI green across build/windows/macOS. Safe.
Bumps actions/checkout from 6.0.3 to 7.0.0.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)