✕
Skip to content

Bump actions/checkout from 6 to 7 - #75

Merged
yellow5 merged 1 commit into
developfrom
dependabot/github_actions/actions/checkout-7
Aug 19, 2026
Merged

Bump actions/checkout from 6 to 7#75
yellow5 merged 1 commit into
developfrom
dependabot/github_actions/actions/checkout-7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps actions/checkout from 6 to 7.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 22, 2026
@sm-dependabot-review

sm-dependabot-review Bot commented Aug 10, 2026

Copy link
Copy Markdown

🤖 Automated major-upgrade review — generated by the dependabot-major-review skill.

✅ Safe to Merge: actions/checkout 6 → 7

The single v7 breaking change only affects pull_request_target and workflow_run workflows checking out fork code. This repo has neither trigger, and all four checkout steps are bare uses: with no inputs and no consumed outputs. Ten CI jobs and the security scan already ran green on v7 at this commit.

Breaking Changes Reviewed (4 in actions/checkout 7.0.0)

  1. ✅ Fork PR checkout blocked for pull_request_target and workflow_run (block checking out fork pr for pull_request_target and workflow_run actions/checkout#2454)
    • Evidence: The only behavioral break in the v7.0.0 release notes. v7 refuses to check out fork PR code from those two triggers unless the new allow-unsafe-pr-checkout: true is set. Searched every workflow: grep -rnE 'pull_request_target|workflow_run|workflow_call' .github/ returned NONE. Read all four workflow files — ci.yml, linting.yml, security.yml trigger on pull_request (branches: develop); coverage.yml triggers on push (branches: develop). No fork-code-in-trusted-context pattern exists here.
    • Verdict: Does not affect this repo — the guarded triggers are not used anywhere.
  2. ✅ New input allow-unsafe-pr-checkout (default false)
    • Evidence: Diffed the action contract directly: action.yml at tag v6.0.3 vs v7.0.1 differs by exactly one hunk (100a101,109) — the addition of allow-unsafe-pr-checkout, default false. No input was removed or renamed; the outputs block (ref, commit) is byte-identical.
    • Verdict: Purely additive with a safe default. Nothing to opt into.
  3. ✅ Action internals migrated to ESM; bundled deps updated (@actions/core, @actions/tool-cache, js-yaml, flatted; uuid removed)
    • Evidence: Listed in v7.0.0 release notes (upgrade module to esm and update dependencies actions/checkout#2463, #2459, #2460, #2461, #2462). These are changes inside the action's own dist/index.js bundle, not to its public interface — confirmed by the empty inputs/outputs diff above. The v7 runs already succeeded on this PR's head commit, exercising that bundle in practice.
    • Verdict: Internal to the action; no consumer-facing surface.
  4. ✅ Runner / Node runtime requirements
    • Evidence: The runs: block is unchanged between v6.0.3 and v7.0.1 (using: node24, main: dist/index.js, post: dist/index.js) — node24 landed back in v5.0.0, not this major. All four workflows use runs-on: ubuntu-latest; the failing-job log shows the hosted image resolving to ubuntu-24.04, and every job downloaded and ran actions/checkout@v7 (SHA 9c091bb) without a runtime complaint.
    • Verdict: No new runner or Node requirement. No self-hosted runners in play.

Required Changes

None — no code changes needed.

CI Status

  • 11 of 12 checks green on this commit, all of them having run actions/checkout@v7: 9 CI matrix jobs (Ruby 3.3/3.4/4.0 x rails-7.2/8.0/8.1) and the Bearer security scan. The one red check — Linting / 'Verify Code' — is UNRELATED to this upgrade: bundle exec standardrb reports a single style offense at spec/support/helpers/sms_campaign_payload.rb:76 (Layout/IndentationWidth: Use 2 not 4 spaces). Read the log and the source: the PR touches only .github/workflows/*.yml and never that helper, so the offense is pre-existing on develop. Checkout itself succeeded in that job before the linter ran. Note that coverage.yml is push-on-develop only, so it was not exercised by this PR's CI — but its checkout step is byte-identical in shape to the three that were.

Transitive Dependencies

  • No conflicts. The repo defines no composite action (find -name 'action.y*ml' → none) and no reusable workflow (workflow_call → none), so nothing downstream inherits this bump. No workflow reads checkout's outputs (grep -rnE 'steps\.[a-zA-Z0-9_-]+\.outputs' .github/workflows/ → NONE). The three actions that run after checkout — ruby/setup-ruby@v1, bearer/bearer-action@v2, paambaati/codeclimate-action@v9.0.0 — consume the checked-out workspace, not checkout's API, and all three passed on v7 in this run.

Recommendation

Merge the upgrade. Every v7 breaking change was enumerated from the official release notes and verified against the action.yml contract diff, and none reaches this repo. The red Linting check is a pre-existing StandardRB indentation offense in spec/support/helpers/sms_campaign_payload.rb:76 that this PR neither caused nor can fix — fix it separately (bundle exec standardrb --fix) on develop, or merge this PR past it deliberately. Do not read the red check as a signal about actions/checkout v7.

Reviewed at head commit 55e054d.

🤖 Generated with Claude Code

@sm-dependabot-review sm-dependabot-review Bot added the major-review:reviewed Automated major-upgrade review posted label Aug 10, 2026
@yellow5

yellow5 commented Aug 19, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot
Bump actions/checkout from 6 to 7
154f695 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions/checkout-7 branch from 55e054d to 154f695 Compare August 19, 2026 16:05
@yellow5
yellow5 merged commit f352ef9 into develop Aug 19, 2026
8 checks passed
@yellow5
yellow5 deleted the dependabot/github_actions/actions/checkout-7 branch August 19, 2026 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yellow5 yellow5 yellow5 approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code major-review:reviewed Automated major-upgrade review posted

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@yellow5