chore(deps): bump actions/checkout from 4 to 7 - #22
Conversation
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughThe CI workflow updates its repository checkout action from ChangesCI checkout update
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 10: Update the actions/checkout step to set persist-credentials to false,
ensuring the existing uv sync --dev and uv run pytest workflow steps remain
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 841295b5-3462-45ef-a33e-eb387bbd7665
📒 Files selected for processing (1)
.github/workflows/ci.yml
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files .github/workflows/ci.yml
echo '---'
cat -n .github/workflows/ci.ymlRepository: athal7/kb
Length of output: 501
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the workflow and any Git-auth-related steps nearby.
awk 'NR>=1 && NR<=200 {print NR ":" $0}' .github/workflows/ci.yml
echo '--- searches ---'
rg -n "git (push|fetch|pull|clone|submodule)|persist-credentials|checkout@" .github/workflows/ci.yml .github -g '*.yml' -g '*.yaml'Repository: athal7/kb
Length of output: 552
🌐 Web query:
actions/checkout v7 persist-credentials default README release tags
💡 Result:
In actions/checkout v7, the default value for the persist-credentials input remains true [1][2]. When persist-credentials is set to its default (true), the action configures the provided authentication token or SSH key within the local git configuration [1][3]. This allows subsequent git commands executed within your workflow scripts to run with the same authentication credentials [4][5]. The token is removed during the post-job cleanup process to ensure security [1][4]. If you wish to disable this behavior, you can explicitly set persist-credentials to false in your workflow file [1][3]. While the v7 release introduced security hardening—such as refusing to fetch fork pull request code in certain contexts by default (which can be opted out of using the allow-unsafe-pr-checkout input) [6]—the fundamental functionality and default behavior of the persist-credentials input were not changed in this release [2][7].
Citations:
- 1: https://github.com/actions/checkout
- 2: https://github.com/actions/checkout/blob/34e114876b0b11c390a56381ad16ebd13914f8d5/action.yml
- 3: https://github.com/actions/checkout?tab=readme-ov-file
- 4: https://github.com/actions/checkout/blob/main/README.md
- 5: https://www.github.com/actions/checkout
- 6: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/
- 7: https://github.com/actions/checkout/releases/tag/v7.0.0
🌐 Web query:
site:github.com/actions/checkout tags v7 README actions/checkout@v7
💡 Result:
The actions/checkout@v7 release, published on June 18, 2026, is the current major version of the official GitHub Action for checking out repositories [1][2]. Key changes and features in v7 include: Safer fork pull request handling: By default, the action now refuses to check out code from fork pull requests when a workflow is triggered by pull_request_target or workflow_run [3][4]. This change mitigates potential security risks (often called pwn request vulnerabilities) that occur when running untrusted fork code with the base repository's GITHUB_TOKEN and secrets [3][4]. Users can opt in to the previous behavior by setting the new input allow-unsafe-pr-checkout: true [3][4]. Infrastructure and dependency updates: The action has been migrated to ESM (ECMAScript Modules) to maintain compatibility with modern @actions/* package versions [3][4]. Additionally, it includes updates to direct and transitive dependencies to address known security vulnerabilities [3][5]. The README documentation for the repository has been updated to reflect these changes and provides updated usage snippets referencing @v7 [6][5]. Users are encouraged to refer to the official repository's README for the full list of configuration inputs and specific implementation details [3][6].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v7.0.0
- 2: https://github.com/actions/checkout/releases
- 3: https://github.com/actions/checkout/blob/main/README.md
- 4: https://github.com/actions/checkout/
- 5: getting ready for checkout v7 release actions/checkout#2464
- 6: https://github.com/actions/checkout/?tab=readme-ov-file
Disable persisted checkout credentials
actions/checkout@v7 still persists the token by default, and the subsequent uv sync --dev / uv run pytest steps don’t need Git auth. Set persist-credentials: false here unless a later step explicitly requires it.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 10-10: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 10, Update the actions/checkout step to set
persist-credentials to false, ensuring the existing uv sync --dev and uv run
pytest workflow steps remain unchanged.
Source: Linters/SAST tools
|
@jules this dependency bump couldn't auto-merge (major version change, or no CI to verify against) — can you check the changelog/release notes for breaking changes and update any affected code if needed? |
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
165f85f to
3c58400
Compare
1 participant
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)df4cb1cUpdate changelog for v6.0.3 (#2446)Summary by CodeRabbit