chore(deps): update actions/checkout action to v7 - #31
Conversation
|
|
PR author is in the excluded authors list. |
6e3669c to
08ec258
Compare
08ec258 to
f78eb17
Compare
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔍 Checkout SHA pin updated consistently, but comment/SHA pairing can't be verified locally
All four actions/checkout pins across .github/workflows/_checks.yml:23,54,114 and .github/workflows/public-repo-guard.yml:45 were updated to the same commit SHA, so the mechanical transformation is complete and consistent. The only unverifiable claim is that 3d3c42e5aac5ba805825da76410c181273ba90b1 actually corresponds to the v7.0.1 tag of actions/checkout — the trailing comment is the sole documentation of that mapping, and a mismatch would silently pin a different (possibly unintended) revision. Worth confirming against the upstream tag before merge.
Was this helpful? React with 👍 or 👎 to provide feedback.
ApprovabilityVerdict: Needs human review Unable to check for correctness in f78eb17. Dependency update to actions/checkout v7.0.1 across CI workflows. Recommending human review because: (1) all changed files are owned by wave-av/streaming-team, not the bot author, and (2) an unresolved comment requests verification that the pinned SHA actually corresponds to the v7.0.1 tag. No code changes detected at You can customize Macroscope's approvability policy. Learn more. |
f78eb17 to
e48d73e
Compare
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔍 Reusable workflow claims parity with wave-foundation upstream
.github/workflows/_checks.yml is documented as the shared source of truth mirrored from wave-av/wave-foundation ("update here, every repo inherits it (no copying = no drift)"). Bumping the pin only in this repo's local copy re-introduces drift unless the upstream copy is updated too; worth confirming which file is authoritative for this repo.
Was this helpful? React with 👍 or 👎 to provide feedback.
e48d73e to
5a606c4
Compare
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
5a606c4 to
55abb82
Compare
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🟨 Guard workflow checkout keeps the GitHub token persisted in the local git config
The security gate's checkout step (.github/workflows/public-repo-guard.yml:45) does not set persist-credentials: false, unlike every other checkout in the repo (.github/workflows/_checks.yml:25,56,116). The job then downloads and executes a third-party binary (gitleaks) and runs a repo-vendored shell script in the same workspace, both of which can read the persisted GITHUB_TOKEN.
Was this helpful? React with 👍 or 👎 to provide feedback.
This PR contains the following updates:
v5.0.1→v7.0.1v4.3.1→v7.0.1Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
v5.1.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.