chore(deps): update actions/checkout action to v7 - #49
Conversation
|
PR author is in the excluded authors list. |
|
🌊 WAVE BugBot — 6 finding(s)🔴 4 · 🟠 2
severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune |
d874347 to
81adfca
Compare
7bcd388 to
f84d34d
Compare
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔍 Verify the pinned checkout SHA actually corresponds to v7.0.1
All four workflows are now pinned to 3d3c42e5aac5ba805825da76410c181273ba90b1 with a # v7.0.1 comment. The value cannot be validated from the repo alone; a mismatched SHA/tag comment silently defeats the supply-chain intent of pinning. Worth confirming against the upstream tag before merge. Note also that major-version bumps of actions/checkout have previously changed the default Node runtime and default fetch behavior, so confirm the runner images in use support the new version.
Was this helpful? React with 👍 or 👎 to provide feedback.
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔍 _checks.yml is described as a shared/inherited workflow
The header comment says this reusable workflow is the single source of truth mirrored across WAVE repos ("update here, every repo inherits it (no copying = no drift)"). Bumping the pin only in this repo's vendored copy re-introduces drift with wave-av/wave-foundation/.github/workflows/checks.yml; consider updating upstream too.
Was this helpful? React with 👍 or 👎 to provide feedback.
f84d34d to
1142011
Compare
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
1142011 to
deb89c9
Compare
This PR contains the following updates:
v6.0.3→v7.0.1v5.0.1→v7.0.1v4.3.1→v7.0.1Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.