chore(ci): bump actions/checkout from 6 to 7 - #12
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependabot
dependabot
Bot
added
dependencies
AI AnalysisTechnical Summary of Pull Request: Title: chore(ci): bump actions/checkout from 6 to 7 OverviewThis pull request updates the GitHub Action dependency Technical Requirements and Constraints
This summary was automatically generated by AI to help with triage and may not be 100% accurate. Suggested Labels: security |
karlspace
left a comment
karlspace
left a comment
There was a problem hiding this comment.
Reviewed the v7 changelog carefully because it carries a real behavioural change, not just the usual ESM migration.
The one that matters: actions/checkout#2454 blocks checking out a fork PR under pull_request_target and workflow_run. We do have a workflow_run trigger — pages.yml fires on "📦 Build Image" completion — so I checked that step specifically. It calls actions/checkout with no ref:, so it takes the default branch rather than a PR head, and the new guard does not apply. Our only pull_request_target user was ai-issue-summary.yml, which was removed earlier today.
Scope: .github/workflows/build.yml and .github/workflows/pages.yml, three call sites, all plain checkouts without ref, repository or token overrides.
Rest of the release: ESM migration and dependency bumps — no input or output surface changed.
CI: GitGuardian and AI summary green. As on #13, 📦 Build Image does not run here because build.yml has paths-ignore: .github/**, so this bump is not exercised by CI on the PR. Validating on main with a dispatched build once all three are in.
Related: #13 (cache v6) is merged; #14 (setup-python v7) follows.
1 participant
Bumps actions/checkout from 6 to 7.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)