Repository navigation
Bump actions/checkout from 6 to 7 - #1510
Merged
Merged
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7
branch
from
October 15, 2026 06:21
3e6b953 to
674df15
Compare
bgentry
approved these changes
Oct 15, 2026
bgentry
left a comment
bgentry
left a comment
Contributor
There was a problem hiding this comment.
🤖 Codex review: Approved after dependency security and compatibility review.
Upgrade
actions/checkout:v6→v7; reviewed head674df15a604ebd904ae83052c69c113c7a632368.- Resolved
v7artifact:3d3c42e5aac5ba805825da76410c181273ba90b1(v7.0.1).
Security review
- Compared exact canonical upstream archives, source, action.yml, lockfiles, and committed main/post bundle. Verified upgraded Actions toolkit registry artifacts against lockfile/registry SHA-512 integrity and checked upstream source/publishing metadata and verified commit signatures.
- Changes are principally ESM/toolkit/Octokit migration, standard-library UUIDs, and more precise Git configuration cleanup. Node24 entrypoints and unsafe-PR protection defaults are unchanged. No new runtime install hook, unexpected secret access, or exfiltration destination was found.
- River changes only three action references.
contents: read, hosted Ubuntu, default repository/ref, andpersist-credentials: falseremain intact. No privileged trigger or unsafe checkout opt-in is added. No blocking supply-chain finding.
Compatibility verification
- Local YAML parse, exact three-reference diff/permissions/input checks, and
git diff --check— passed on this head. - All eight same-head Java workflow jobs passed, including quality/package archives, Java 21/25 SQLite, and Postgres 14–18. Job-step metadata confirms upgraded checkout main and post steps succeeded. Required Go CI checks also passed; hosted CI exercises the actual action runner.
Residual risk
- Undici
6.27.0has residual advisory matches. The newly matching GHSA-3wwx-pv8p-q78v and GHSA-rfgv-xxqx-mfg5 affect WebSocket paths unused by checkout; other matches affect helper/retry paths with no applicable untrusted input found here and also match the previous graph. This approval does not describe the graph as advisory-free. - Committed generated bundles retain upstream build trust and were not independently rebuilt. Major tags are mutable; this review applies to the exact artifact commit above.
Contributor
|
@dependabot rebase |
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7
branch
from
October 15, 2026 06:42
674df15 to
495598c
Compare
Contributor
|
@dependabot rebase |
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7
branch
from
October 15, 2026 06:44
495598c to
f36366f
Compare
bgentry
approved these changes
Oct 15, 2026
bgentry
left a comment
bgentry
left a comment
Contributor
There was a problem hiding this comment.
🤖 Codex review: Approved after dependency security and compatibility review.
Upgrade
actions/checkout:v6→v7; reviewed headf36366f85bea05807ea32260018dedb1be6ec803.- Resolved
v7artifact:3d3c42e5aac5ba805825da76410c181273ba90b1(v7.0.1).
Security review
- Compared exact canonical upstream archives, source, action.yml, lockfiles, and committed main/post bundle. Verified upgraded Actions toolkit registry artifacts against lockfile/registry SHA-512 integrity and checked upstream source/publishing metadata and verified commit signatures.
- Changes are principally ESM/toolkit/Octokit migration, standard-library UUIDs, and more precise Git configuration cleanup. Node24 entrypoints and unsafe-PR protection defaults are unchanged. No new runtime install hook, unexpected secret access, or exfiltration destination was found.
- Reused the exact upstream artifact/source/integrity/advisory evidence from the earlier review after this rebase. Current base
f233f42b6e6f8c23997180e6ab950805f835039cincorporates the separately reviewed and merged Go, Tokio/trybuild, and setup-go upgrades. The current PR delta still changes only three checkout references; local workflow checks were rerun and hosted CI was refreshed for this combined tree. - River changes only three action references.
contents: read, hosted Ubuntu, default repository/ref, andpersist-credentials: falseremain intact. No privileged trigger or unsafe checkout opt-in is added. No blocking supply-chain finding.
Compatibility verification
- Local YAML parse, exact three-reference diff/permissions/input checks, and
git diff --check— passed on this head. - All eight same-head Java workflow jobs passed, including quality/package archives, Java 21/25 SQLite, and Postgres 14–18. Job-step metadata confirms upgraded checkout main and post steps succeeded. Required Go CI checks also passed; hosted CI exercises the actual action runner.
Residual risk
- Undici
6.27.0has residual advisory matches. The newly matching GHSA-3wwx-pv8p-q78v and GHSA-rfgv-xxqx-mfg5 affect WebSocket paths unused by checkout; other matches affect helper/retry paths with no applicable untrusted input found here and also match the previous graph. This approval does not describe the graph as advisory-free. - Committed generated bundles retain upstream build trust and were not independently rebuilt. Major tags are mutable; this review applies to the exact artifact commit above.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 6 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)