chore(deps): update actions/checkout action to v5.1.0 - #36
Conversation
|
67a1e3b to
20e9cbc
Compare
20e9cbc to
39a3bf8
Compare
|
PR author is in the excluded authors list. |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | ||
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 |
There was a problem hiding this comment.
🔍 Verify the new SHA actually belongs to the v5.1.0 tag
The security value of a SHA pin plus trailing version comment depends on the comment matching reality. The pin changed from 93cb6ef... (v5.0.1) to fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 (labelled v5.1.0); this cannot be validated from the repo alone. Worth a quick confirmation against the upstream actions/checkout tag before merging, since this workflow is the repo's secret-scanning gate.
Was this helpful? React with 👍 or 👎 to provide feedback.
ApprovabilityVerdict: Needs human review Unable to check for correctness in 39a3bf8. Simple dependency update (actions/checkout v5.0.1 → v5.1.0) with verified correct SHA, but the changed workflow file is owned by wave-av/streaming-team per CODEOWNERS, so the designated owners should review this change. No code changes detected at You can customize Macroscope's approvability policy. Learn more. |
39a3bf8 to
408c558
Compare
This PR contains the following updates:
v5.0.1→v5.1.0Release Notes
actions/checkout (actions/checkout)
v5.1.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
Note
Update
actions/checkoutto v5.1.0 in public-repo-guard workflowBumps the pinned
actions/checkoutcommit hash in public-repo-guard.yml from v5.0.1 to v5.1.0.Macroscope summarized 408c558.