chore(deps): update actions/checkout action to v7 - #49
Conversation
|
PR author is in the excluded authors list. |
|
🌊 WAVE BugBot — 6 finding(s)🔴 4 · 🟠 2
severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune |
d874347 to
81adfca
Compare
7bcd388 to
f84d34d
Compare
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔍 Verify the pinned checkout SHA actually corresponds to v7.0.1
All four workflows are now pinned to 3d3c42e5aac5ba805825da76410c181273ba90b1 with a # v7.0.1 comment. The value cannot be validated from the repo alone; a mismatched SHA/tag comment silently defeats the supply-chain intent of pinning. Worth confirming against the upstream tag before merge. Note also that major-version bumps of actions/checkout have previously changed the default Node runtime and default fetch behavior, so confirm the runner images in use support the new version.
Was this helpful? React with 👍 or 👎 to provide feedback.
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔍 _checks.yml is described as a shared/inherited workflow
The header comment says this reusable workflow is the single source of truth mirrored across WAVE repos ("update here, every repo inherits it (no copying = no drift)"). Bumping the pin only in this repo's vendored copy re-introduces drift with wave-av/wave-foundation/.github/workflows/checks.yml; consider updating upstream too.
Was this helpful? React with 👍 or 👎 to provide feedback.
f84d34d to
1142011
Compare
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
1142011 to
deb89c9
Compare
deb89c9 to
6969c18
Compare
ApprovabilityVerdict: Needs human review All changed workflow files are owned by wave-av/core-team, not the PR author (renovate bot). Additionally, unresolved comments raise valid concerns about verifying the pinned SHA and coordinating with upstream shared workflows. The designated code owners should review. No code changes detected at You can customize Macroscope's approvability policy. Learn more. |
6969c18 to
0b4e506
Compare
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🟨 Checkout in the public-repo-guard job leaves the job's GitHub token persisted in the repo clone
The security gate's checkout step (.github/workflows/public-repo-guard.yml:45) omits with: persist-credentials: false, unlike every other checkout in the repo (.github/workflows/lint.yml:17-18, .github/workflows/release.yml:47-48). The credential is written into .git/config, so any script executed later in the job — including the vendored scripts/public-repo-guard/content-policy.sh, which runs on PR-controlled contents — can read and use the token.
Was this helpful? React with 👍 or 👎 to provide feedback.
This PR contains the following updates:
v6.0.3→v7.0.1v5.0.1→v7.0.1v4.3.1→v7.0.1Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.