chore(deps): bump actions/checkout from 4 to 7 - #136
Conversation
dependabot
Bot
added
dependencies
|
@jules this dependency bump couldn't auto-merge (major version change, or no CI to verify against) — can you check the changelog/release notes for breaking changes and update any affected code if needed? |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe CI workflow updates ChangesCI checkout updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 18-20: Update the actions/checkout step in the test job to set
persist-credentials to false alongside fetch-depth, matching the release job
configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: d22e6320-f982-43ef-89a5-f936f718d4c8
📒 Files selected for processing (1)
.github/workflows/ci.yml
| - uses: actions/checkout@v7 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow with line numbers.
sed -n '1,120p' .github/workflows/ci.yml | cat -n
# Show all actions/checkout usages in the repo.
rg -n "actions/checkout@" .github/workflows -SRepository: athal7/opencode-devcontainers
Length of output: 3624
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow with line numbers.
sed -n '1,140p' .github/workflows/ci.yml | cat -n
# Show all actions/checkout usages in the repo.
rg -n "actions/checkout@" .github/workflows -SRepository: athal7/opencode-devcontainers
Length of output: 3624
Disable checkout credentials in the test job.
npm ci and npm test run repository/dependency-controlled code, so leaving GITHUB_TOKEN in .git/config is unnecessary exposure. Add persist-credentials: false here, as in the release job.
Proposed fix
- uses: actions/checkout@v7
with:
fetch-depth: 0
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 18-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 18 - 20, Update the actions/checkout
step in the test job to set persist-credentials to false alongside fetch-depth,
matching the release job configuration.
Source: Linters/SAST tools
|
@dependabot recreate |
github-actions
Bot
added
bug
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
9d1372f to
f23cbe0
Compare
1 participant
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Summary by CodeRabbit