Bump actions/checkout from 4 to 7 - #542
Conversation
dependabot
Bot
added
dependencies
blooop
left a comment
blooop
left a comment
There was a problem hiding this comment.
The real breaking change in v7 is
actions/checkout#2454: checkout
now refuses to check out a fork PR's head under pull_request_target or
workflow_run. That is the one thing worth verifying here, since it turns a
working workflow into a hard failure rather than a warning.
Nothing in this repository trips it:
- No workflow uses
pull_request_targetat all. - The one
workflow_runconsumer isconda-publish.yml, and it is scoped
branches: [main]. Itsgithub.event.workflow_run.head_shais therefore
always a commit onmain, never a fork PR head, so the new refusal has no
case to fire on. ci.ymltriggers onpull_request, not_target, which is unaffected.
The Node 24 runtime needs runner v2.327.1+; every runs-on: here is
GitHub-hosted (ubuntu-latest, plus ubuntu-24.04-arm in the
devcontainer-prebuild matrix), so the runner is current by construction. No
self-hosted runner to strand.
Worth noting this bump does more than the title says: the review job in
ci.yml was still on @v4 while everything else had moved to @v6, and
Dependabot has brought the whole set to @v7. That clears the Node 20
deprecation warning that job has been emitting.
Green on this head across ci, e2e, packaging, public-api, rust and
rust-coverage, which is most of the changed call sites actually executing.
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2cad974 to
909458f
Compare
1 participant
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)