From 21f373f9bb7646d13cfbf8d28dd2feeeafd4dcbe Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Sun, 16 Aug 2026 19:53:25 -0700 Subject: [PATCH] fix(ci): correct actions/checkout version comments after v7 bump #130 bumped actions/checkout from v4.3.1 to v7.0.1 in three workflows. Dependabot rewrote the comment correctly in self-review.yml (which already read `# v4.3.1`) but left `# v4` untouched in the two reusable workflows. The result was worse than a stale comment: the annotation claimed v4 while the SHA pointed at v7.0.1. Verified 3d3c42e5 = v7.0.1 and the prior 34e11487 = v4.3.1. Corrects both to `# v7.0.1`. All three checkout pins now agree, and zizmor reports zero ref-version-mismatch findings. This also closes item 3 of #123, which is no longer cosmetic. Dependabot can only maintain a version comment it can parse: precise comments (`# v4.3.1`) get rewritten, vague ones (`# v4`) get skipped and silently go wrong on the next major bump. Keeping these annotations exact is a precondition for the updater added in #128 to work, not a tidiness preference. Note the floating v1/v3 tags still point at 9422220 and do not include the checkout v7 bump, so this does not reach consumers yet. Committed with SKIP=zizmor (human-authorized): the 3 blocking findings are pre-existing items 2 and 4 of #123, unchanged by this commit. Refs #123 Claude-Session: https://claude.ai/code/session_01SimcNSM4P5hpb1dQVejqcF --- .github/workflows/claude-assistant.yml | 2 +- .github/workflows/claude-blocking-review.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/claude-assistant.yml b/.github/workflows/claude-assistant.yml index 0908003..b570864 100644 --- a/.github/workflows/claude-assistant.yml +++ b/.github/workflows/claude-assistant.yml @@ -38,7 +38,7 @@ jobs: id-token: write # required by claude-code-action for internal authentication steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 diff --git a/.github/workflows/claude-blocking-review.yml b/.github/workflows/claude-blocking-review.yml index e4bad53..04258c4 100644 --- a/.github/workflows/claude-blocking-review.yml +++ b/.github/workflows/claude-blocking-review.yml @@ -129,7 +129,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1