From 7d839a0af4e4542905f7a6c7a1144d134de7df59 Mon Sep 17 00:00:00 2001 From: Justin Kim Date: Fri, 19 Jun 2026 20:56:43 +0900 Subject: [PATCH] build(deps): bump actions/checkout from 6 to 7 Bumps actions/checkout from v6 to v7 across all workflows. The v7.0.0 breaking change (blocking fork PR checkout for pull_request_target and workflow_run) does not affect this repo, which uses neither trigger. Update the workflow contract tests to pin the new major and forbid the now-stale v6, keeping test_ci_uses_node24_actions and test_wheels_workflow_uses_node24_actions in sync with the bump. Supersedes #169 (dependabot did not update the version-pinning tests). --- .github/workflows/ci.yml | 4 ++-- .github/workflows/docs.yml | 2 +- .github/workflows/nightly.yml | 2 +- .github/workflows/release.yml | 8 ++++---- .github/workflows/wheels.yml | 4 ++-- tests/test_ci_workflow.py | 4 +++- tests/test_wheels_config.py | 3 ++- 7 files changed, 15 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d99f738..5695074 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,7 +13,7 @@ jobs: name: lint runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-python@v6 with: python-version: "3.12" @@ -60,7 +60,7 @@ jobs: # APIs accept them, and the bash pytest step reads this verbatim. WIRELOG_PREFIX: ${{ github.workspace }}/wirelog-install steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-python@v6 with: diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index b732461..1850ba1 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -16,7 +16,7 @@ jobs: build_and_publish: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 - uses: actions/setup-python@v6 diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 6541bfa..6cfb081 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -22,7 +22,7 @@ jobs: test_against_main: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c28e550..3a00003 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,7 +32,7 @@ jobs: os: [ubuntu-24.04, macos-15, windows-2025-vs2026] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 @@ -154,7 +154,7 @@ jobs: os: [ubuntu-24.04, macos-15, windows-2025-vs2026] python: ["3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-python@v6 with: @@ -206,7 +206,7 @@ jobs: build_sdist: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 @@ -315,7 +315,7 @@ jobs: id-token: write # PyPI trusted publishing (OIDC) attestations: write steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index 150253c..4a0acaf 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -30,7 +30,7 @@ jobs: os: [ubuntu-24.04, macos-15, windows-2025-vs2026] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 @@ -155,7 +155,7 @@ jobs: os: [ubuntu-24.04, macos-15, windows-2025-vs2026] python: ["3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-python@v6 with: diff --git a/tests/test_ci_workflow.py b/tests/test_ci_workflow.py index 4b97010..7afce5e 100644 --- a/tests/test_ci_workflow.py +++ b/tests/test_ci_workflow.py @@ -41,10 +41,11 @@ def test_ci_uses_node24_actions(): text = _workflow_text() assert "actions/checkout@v4" not in text assert "actions/checkout@v5" not in text + assert "actions/checkout@v6" not in text assert "actions/setup-python@v5" not in text assert "actions/cache@v4" not in text assert "ilammy/msvc-dev-cmd" not in text - assert "actions/checkout@v6" in text + assert "actions/checkout@v7" in text assert "actions/setup-python@v6" in text assert "actions/cache@v5" in text @@ -55,6 +56,7 @@ def test_all_workflows_use_node24_core_actions(): text = path.read_text(encoding="utf-8") assert "actions/checkout@v4" not in text, path assert "actions/checkout@v5" not in text, path + assert "actions/checkout@v6" not in text, path assert "actions/setup-python@v5" not in text, path assert "actions/cache@v4" not in text, path assert "actions/upload-artifact@v4" not in text, path diff --git a/tests/test_wheels_config.py b/tests/test_wheels_config.py index 8f97bbb..0a6c7ce 100644 --- a/tests/test_wheels_config.py +++ b/tests/test_wheels_config.py @@ -120,8 +120,9 @@ def test_wheels_workflow_uses_node24_actions(): text = _read(".github/workflows/wheels.yml") assert "actions/checkout@v4" not in text assert "actions/checkout@v5" not in text + assert "actions/checkout@v6" not in text assert "actions/setup-python@v5" not in text - assert "actions/checkout@v6" in text + assert "actions/checkout@v7" in text assert "actions/setup-python@v6" in text