ci(deps): bump actions/checkout from 4 to 7 - #376
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
Warning Your comment is too long (maximum is 65536 characters), so the coverage report was not added. See the job log for how to reduce it. |
47f01f0 to
522b2be
Compare
|
👋 This PR needs a couple of things fixed before OpenHands can review it:
Push an update once this is addressed and this check re-runs automatically. This is an automated check - no AI was used to generate this comment. |
730d104 to
4891651
Compare
4891651 to
6188b38
Compare
all-hands-bot
left a comment
all-hands-bot
left a comment
There was a problem hiding this comment.
This review was posted by an AI agent (OpenHands).
Review: ci(deps): bump actions/checkout from 4 to 7
Scope verified against the workspace — the diff is exactly 6 lines across 6 workflow files, all swapping the actions/checkout ref only (+6 / -6, no other edits). I confirmed this by diffing the fetched base against the head SHA:
.github/workflows/ci.yml:17v5 → v7.github/workflows/ghcr-build.yml:38v4 → v7.github/workflows/issue-readiness-check.yml:69v5 → v7.github/workflows/pr-description-check.yml:36v5 → v7.github/workflows/pypi-release.yml:26v4 → v7.github/workflows/tests.yml:19v5 → v7
Breaking-change check (the reason this is not a routine patch bump)
checkout@v7 (via v6) ships the upstream security hardening that blocks checking out fork PR code in pull_request_target / workflow_run contexts unless allow-unsafe-pr-checkout is set. That directly intersects this repo's own review-facing guidance. I checked every affected workflow's trigger and ref:
pr-description-check.yml(pull_request_target) pinsref: ${{ github.event.pull_request.base.sha }}— a trusted base-branch ref, not the PR head. Correct and unaffected.ghcr-build.ymlispull_request(not_target), so it gets a read-only token and the fork-checkout guard does not apply.ci.yml,tests.yml(pull_request),issue-readiness-check.yml(issues) andpypi-release.yml(pushtags) have no PR-head checkout at all.
No workflow needs allow-unsafe-pr-checkout; none checks out untrusted fork code. The change tightens rather than loosens the trust boundary.
Other compatibility checks
- Node runtime transition: v5 and v7 both run on Node 24, so only the two
v4sites (ghcr-build.yml,pypi-release.yml) actually cross that runtime transition. All workflows useruns-on: ubuntu-24.04. - Credential persistence: no changed workflow consumes checkout's persisted git credentials — the one step that pushes (
pr-artifacts.yml) passes an explicit PAT viatoken:and is untouched by this PR. Nogit-credentials/persist-credentialsreliance was regressed. - Optional inputs are backward compatible:
ref:andtoken:usage here is unchanged between v4/v5 and v7. - Workflow lint/test status at this head:
ci,Run tests, andDockerall reportsuccesson6188b3828c7d2bd94ff73946f878d54014134c90.
No material bugs, security regressions, or design flaws found. The workflow files still parse and the pinned-major convention (AGENTS.md and the GitHub Actions guidance both call for pinned action versions rather than @main) is preserved.
✅ APPROVED
6188b38 to
dabb861
Compare
neubig
left a comment
neubig
left a comment
There was a problem hiding this comment.
Approved: checks are green. This review was created by an AI agent (OpenHands) on behalf of the user.
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dabb861 to
e9d8c07
Compare
all-hands-bot
left a comment
all-hands-bot
left a comment
There was a problem hiding this comment.
This review was posted by an AI agent (OpenHands).
Review: ci(deps): bump actions/checkout from 4 to 7 (re-review at e9d8c07)
This is a re-review after the head moved from 6188b38 to e9d8c07 (rebase onto the current main). I re-diffed the new base f146352 against the new head: the change set is identical — exactly 6 lines across 6 workflow files, and every line swaps the actions/checkout ref only (+6 / -6, no other edit).
.github/workflows/ci.yml:17v5 → v7.github/workflows/ghcr-build.yml:38v4 → v7.github/workflows/issue-readiness-check.yml:69v5 → v7.github/workflows/pr-description-check.yml:36v5 → v7.github/workflows/pypi-release.yml:26v4 → v7.github/workflows/tests.yml:19v5 → v7
Breaking-change check (the reason this is not a routine patch bump)
checkout@v7 (via v6) ships the upstream hardening that blocks checking out fork PR code under pull_request_target / workflow_run unless allow-unsafe-pr-checkout is set. I re-verified every affected workflow's trigger and ref at this head:
pr-description-check.yml(pull_request_target) pinsref: ${{ github.event.pull_request.base.sha }}— a trusted base-branch ref, not the fork head. Correct and unaffected.ghcr-build.ymlis plainpull_request(not_target), so the guard does not apply.ci.yml/tests.yml(pull_request),issue-readiness-check.yml(issues) andpypi-release.yml(pushtags) never check out a PR head.
No workflow requires allow-unsafe-pr-checkout; none consumes untrusted fork code. The bump tightens, not loosens, the trust boundary — consistent with the repo's guidance to keep PR-code execution out of pull_request_target.
Other compatibility checks
- Runtime transition: v5 and v7 both run on Node 24, so only the two
v4sites (ghcr-build.yml,pypi-release.yml) cross that transition. All six workflows run onubuntu-24.04. - Credential persistence: no changed workflow relies on checkout's persisted git credentials. The only push step (
pr-artifacts.yml) passes an explicit PAT viatoken:and is untouched here. - Inputs:
ref:/token:usage is unchanged between v4/v5 and v7.
CI status at this head
Unlike the previous head, the checks for e9d8c07 are still queued (ci, Run tests, Docker) rather than completed. That is an unresolved-CI state, not a change-induced failure — the workflows' trigger/ref semantics are unchanged and none of them is newly blocked. This is a dependabot major bump of a single well-known action; the prior head of the same change set passed ci, Run tests, and Docker. There is no code-level defect to act on.
The repo has no workflow-lint test to run locally; unit tests target the automation service, not .github/workflows, so no meaningful local test applies to this diff.
No material bugs, security regressions, or design flaws found. Pinned-major versioning (@v7, not @main) is preserved.
✅ APPROVED
2 participants
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)