Skip to content

chore(deps): bump actions/checkout from 6 to 7.0.0#292

Merged
robertvangor merged 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-7.0.0
Jul 21, 2026
Merged

chore(deps): bump actions/checkout from 6 to 7.0.0#292
robertvangor merged 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-7.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/checkout from 6 to 7.0.0.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump actions/checkout from 6 to 7.0.0
9744aff 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update an action file github_actions Pull requests that update GitHub Actions code major Pull requests with breakable changes labels Jul 21, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 21, 2026 06:03
@dependabot
dependabot Bot requested a review from nurislam03 July 21, 2026 06:03
@dependabot dependabot Bot added the dependencies Pull requests that update an action file label Jul 21, 2026
@dependabot
dependabot Bot requested a review from jyuliya July 21, 2026 06:03
@dependabot dependabot Bot added github_actions Pull requests that update GitHub Actions code major Pull requests with breakable changes labels Jul 21, 2026
@dependabot dependabot Bot mentioned this pull request Jul 21, 2026
Closed
robertvangor
robertvangor approved these changes Jul 21, 2026
View reviewed changes

@robertvangor robertvangor left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved after dependency/vulnerability validation at 9744aff.

@robertvangor
robertvangor merged commit 2f81984 into main Jul 21, 2026
14 of 15 checks passed
@robertvangor
robertvangor deleted the dependabot/github_actions/actions/checkout-7.0.0 branch July 21, 2026 18:19
@github-actions github-actions Bot locked and limited conversation to collaborators Jul 21, 2026
@robertvangor

robertvangor commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Vulnerability validation

  • Scope: Retrospective exact-head validation of the actions/checkout 6 to 7 workflow upgrade after merge
  • PR head: 9744aff73e925634802f39d528e699352dd46ff5
  • Tested head: 9744aff73e925634802f39d528e699352dd46ff5
  • Tested at: 2026-07-22T08:27:48Z

Remediation proof

  • No linked advisory (not-applicable): actions/checkout@v6 in .github/workflows/ci.yaml -> actions/checkout@v7 in the exact head, merge commit, and current main. The one-line workflow diff was checked directly. No manifest or lockfile changed. The exact-head CI run, merge-commit CI run, and later current-main CI run all completed successfully while executing checkout v7.

Changelog and compatibility review

  • actions/checkout 6 -> 7.0.0: Official v7.0.0 notes were reviewed. The major release changes checkout's implementation to ESM, refreshes dependencies, and blocks unsafe fork checkout for pull_request_target/workflow_run. Both v6 and v7 declare the node24 action runtime, while v7's package is ESM and declares Node >=24. This repository uses the standard checkout path with persist-credentials:false; no affected unsafe-fork override or custom action import is present.

Test evidence

  • PASS [REQUIRED] - local / exact-head workflow diff and actionlint: At 9744aff the only change is actions/checkout@v6 -> @v7 in .github/workflows/ci.yaml. actionlint v1.7.7 reported no errors.

  • PASS [REQUIRED] - remote CI / exact-head CI Tests: CI Tests run https://github.com/Staffbase/custom-widgets-examples/actions/runs/29805841419 succeeded on exact head 9744aff, directly exercising checkout v7 before install, build, lint, type-check, and tests. The PR rollup retains one earlier CLA Assistant failure and seven skipped AutoDev jobs, but the same exact head later received successful CLA Assistant and AutoDev results; the functional CI gate was successful.

  • PASS [REQUIRED] - remote CI / merged and downstream main validation: Merge commit 2f81984 passed CI Tests (runs 29856758993 and 29856788440) plus AutoDev 29856759383. Current main 6570eec contains the exact PR head by ancestry and passed CI Tests run 29860741419, providing a later checkout-v7 regression pass.

  • PASS [REQUIRED] - git / merge and current-main ancestry: The merge commit has parents 1fa784e and exact head 9744aff; git merge-base --is-ancestor also confirms that exact head is contained in current main 6570eec.

  • Deployment: PASS (branch-stack): Exact-head AutoDev run 29856760427 and merge-commit AutoDev run 29856759383 succeeded. For custom-widgets-examples this is branch composition evidence, not a Staffbase tenant deployment.

  • Observability: NOT-APPLICABLE: This workflow-only change has no independently deployed runtime service to observe.; soak: not applicable

Remaining gaps

  • No tenant or browser run was performed because this PR only changes the CI checkout action and the task explicitly excluded deployment/browser testing.

Scores and recommendation

  • Importance: 4/10 - This major workflow dependency upgrade improves checkout hardening and dependency currency, but it does not remediate a repository runtime advisory.
  • Tested residual risk: 2/10 - The immutable one-line workflow change passed local syntax validation, exact-head CI that directly executed checkout v7, merge-commit CI, and a later downstream main CI run; only negligible workflow-provider uncertainty remains.
  • Recommendation: Merged and retrospectively well supported; retain the exact-head and downstream CI evidence.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@robertvangor robertvangor robertvangor approved these changes
@nurislam03 nurislam03 Awaiting requested review from nurislam03 nurislam03 is a code owner automatically assigned from Staffbase/product-actions
@jyuliya jyuliya Awaiting requested review from jyuliya jyuliya is a code owner automatically assigned from Staffbase/product-actions

Assignees

No one assigned

Labels

dependencies Pull requests that update an action file github_actions Pull requests that update GitHub Actions code major Pull requests with breakable changes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@robertvangor