ci: bump actions/checkout from 6.0.2 to 6.0.3#19
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughBoth the CI and release GitHub Actions workflows are updated to pin ChangesGitHub Actions Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 42: The checkout step using "uses:
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" in the release
workflow should set persist-credentials: false; update the checkout step in the
build job to include persist-credentials: false so the workflow does not persist
the GITHUB_TOKEN to local git config (keep the same uses reference and add the
persist-credentials key under that step).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: eeebcef4-d2f0-47a3-90eb-a286a49d0738
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/release.yml
|
|
||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify checkout steps missing persist-credentials hardening.
rg -n -C2 'uses:\s*actions/checkout@' .github/workflows \
&& rg -n -C2 'persist-credentials:\s*false' .github/workflowsRepository: gominimal/kittyview
Length of output: 772
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== release.yml around checkout (lines 30-80) ==="
nl -ba .github/workflows/release.yml | sed -n '30,90p'
echo
echo "=== Any artifact handling in release.yml ==="
rg -n "upload-artifact|download-artifact|artifact" .github/workflows/release.yml || true
echo
echo "=== Any other checkout steps with persist-credentials in workflows ==="
rg -n "persist-credentials:" .github/workflows || trueRepository: gominimal/kittyview
Length of output: 174
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== release.yml around checkout (lines 30-80) ==="
awk 'NR>=30 && NR<=80 {print NR ":" $0}' .github/workflows/release.yml
echo
echo "=== Any artifact handling in release.yml ==="
rg -n "upload-artifact|download-artifact|artifact" .github/workflows/release.yml || true
echo
echo "=== Any checkout steps with persist-credentials in workflows ==="
rg -n "persist-credentials:" .github/workflows || trueRepository: gominimal/kittyview
Length of output: 2226
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== release.yml lines 70-160 ==="
awk 'NR>=70 && NR<=160 {print NR ":" $0}' .github/workflows/release.yml
echo
echo "=== Any actions/checkout@ usage in release.yml ==="
rg -n "uses:\s*actions/checkout@" .github/workflows/release.ymlRepository: gominimal/kittyview
Length of output: 1138
Add persist-credentials: false to checkout in the release workflow.
actions/checkout in the build job (line 42) runs before artifact packaging/upload, and it currently doesn’t disable persisting the token to the local git config.
Suggested patch
- - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 42-42: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 42, The checkout step using "uses:
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" in the release
workflow should set persist-credentials: false; update the checkout step in the
build job to include persist-credentials: false so the workflow does not persist
the GITHUB_TOKEN to local git config (keep the same uses reference and add the
persist-credentials key under that step).
Source: Linters/SAST tools
Bumps actions/checkout from 6.0.2 to 6.0.3.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
df4cb1cUpdate changelog for v6.0.3 (#2446)1cce339Fix checkout init for SHA-256 repositories (#2439)900f221fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)0c366fdUpdate changelog (#2357)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit