chore(deps): update actions/checkout action to v7 - #31
Conversation
|
|
PR author is in the excluded authors list. |
6e3669c to
08ec258
Compare
08ec258 to
f78eb17
Compare
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔍 Checkout SHA pin updated consistently, but comment/SHA pairing can't be verified locally
All four actions/checkout pins across .github/workflows/_checks.yml:23,54,114 and .github/workflows/public-repo-guard.yml:45 were updated to the same commit SHA, so the mechanical transformation is complete and consistent. The only unverifiable claim is that 3d3c42e5aac5ba805825da76410c181273ba90b1 actually corresponds to the v7.0.1 tag of actions/checkout — the trailing comment is the sole documentation of that mapping, and a mismatch would silently pin a different (possibly unintended) revision. Worth confirming against the upstream tag before merge.
Was this helpful? React with 👍 or 👎 to provide feedback.
ApprovabilityVerdict: Needs human review Unable to check for correctness in f78eb17. Dependency update to actions/checkout v7.0.1 across CI workflows. Recommending human review because: (1) all changed files are owned by wave-av/streaming-team, not the bot author, and (2) an unresolved comment requests verification that the pinned SHA actually corresponds to the v7.0.1 tag. No code changes detected at You can customize Macroscope's approvability policy. Learn more. |
f78eb17 to
e48d73e
Compare
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔍 Reusable workflow is a vendored copy of wave-foundation — check for drift
The header comment (lines 3-6) declares this file the "one source of truth" living in wave-av/wave-foundation, yet this repo carries its own copy. Bumping the pin here only fixes this repo; the upstream copy and any other consumers still reference the v4.3.1 SHA. Worth confirming the same Renovate bump lands upstream so the copies don't diverge.
Was this helpful? React with 👍 or 👎 to provide feedback.
e48d73e to
5a606c4
Compare
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🟨 Checkout step in the public-repo-guard workflow keeps the job's GitHub token persisted in the checkout
The upgraded checkout step at .github/workflows/public-repo-guard.yml:45 does not set persist-credentials: false, unlike every other checkout in the repo (.github/workflows/_checks.yml:23,54,114). The workflow subsequently downloads and executes a third-party binary (gitleaks) and runs a repo-provided shell script (scripts/public-repo-guard/content-policy.sh), both of which would then run with the job token written into .git/config and available for git push/API use.
Was this helpful? React with 👍 or 👎 to provide feedback.
This PR contains the following updates:
v5.0.1→v7.0.1v4.3.1→v7.0.1Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
v5.1.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.
Note
Update
actions/checkoutto v7.0.1 in CI workflowsBumps the pinned
actions/checkoutcommit hash to v7.0.1 in _checks.yml and public-repo-guard.yml, affecting thechecks,skill-validate,verify-routes, andguardjobs.Macroscope summarized 5a606c4.