chore(deps-major): update actions/checkout action to v7.0.0#91
Merged
Conversation
📝 WalkthroughWalkthroughAll eight GitHub Actions workflow files are updated to replace Changesactions/checkout v7.0.0 bump across all workflows
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release.yml (1)
106-111:⚠️ Potential issue | 🟠 MajorAdd
persist-credentials: falseto checkout steps in publish jobs for consistent credential minimization.The
publish-testpypiandpublish-pypijobs currently omitpersist-credentials: falsein their checkout steps, while thereleasejob already implements this security best practice. Add this configuration to both remaining jobs at lines 106-111 and 173-178.Suggested patch
- name: 📥 Checkout repository uses: actions/checkout@v7.0.0 with: ref: master fetch-depth: 1 + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 106 - 111, The publish-testpypi and publish-pypi jobs are missing the persist-credentials security configuration in their checkout steps. Add persist-credentials: false to the with section of the actions/checkout@v7.0.0 action in both jobs to ensure consistent credential minimization across all workflow jobs, matching the configuration already present in the release job. This should be added at lines 106-111 for the publish-testpypi job and at lines 173-178 for the publish-pypi job.Source: Linters/SAST tools
🧹 Nitpick comments (1)
.github/workflows/build-draft-fix-image.yml (1)
41-43: Addpersist-credentials: falseto checkout step.This workflow does not require git credentials after checkout; disabling credential persistence reduces the attack surface by preventing the token from being available during the Docker build context.
Suggested patch
- name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-draft-fix-image.yml around lines 41 - 43, The checkout step in the workflow does not disable credential persistence, which leaves git credentials available during the Docker build context and increases the attack surface. Add the with parameter persist-credentials set to false to the actions/checkout step to prevent the credentials from being persisted after the checkout is complete, since this workflow does not require git credentials after the initial checkout operation.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/auto-merge.yml:
- Line 242: The `actions/checkout` action is pinned to a mutable version tag
(v7.0.0) which weakens supply-chain security guarantees. Replace the version tag
with a full commit SHA to ensure the exact version of the action is used. Look
for the line with `uses: actions/checkout@v7.0.0` and replace the mutable tag
reference with the corresponding full commit SHA for that release version.
In @.github/workflows/ci.yml:
- Line 45: The actions/checkout workflow step uses a mutable version tag `@v7.0.0`
which does not follow pinning best practices for CI security. Replace all six
instances of actions/checkout@v7.0.0 (found at lines 45, 66, 94, 125, 160, and
193 in the CI workflow file) with the full commit SHA for the v7.0.0 release of
actions/checkout to ensure immutable dependency pinning. Update each occurrence
of "uses: actions/checkout@v7.0.0" to use the specific commit hash instead of
the mutable tag.
- Around line 44-48: Update all checkout steps (identified by uses:
actions/checkout@v7.0.0) to use the latest stable version v4 instead, and add
persist-credentials: false to the with block of each checkout step. This applies
to all occurrences of the checkout action across the workflow file at the
specified line ranges. The persist-credentials: false setting is a security best
practice that prevents accidental credential leakage in workflows that handle
artifacts or logs.
In @.github/workflows/release.yml:
- Line 70: The actions/checkout step is referencing a non-existent version tag
`@v7.0.0` which will cause runtime failures. Update all three checkout steps in
the workflow (appearing at lines 70, 107, and 174) to use the latest stable
version v6.0.3 pinned to its commit SHA instead of the version tag. This will
prevent silent upstream drift and ensure the workflow uses a known, valid
version of the checkout action.
In @.github/workflows/sync-wiki.yml:
- Around line 31-33: In the "Checkout repository" step, replace the
actions/checkout reference from v7.0.0 with a pinned full commit SHA and add the
persist-credentials: false parameter to the uses statement. This hardens the
workflow by using a specific immutable commit hash instead of a mutable version
tag and disables credential persistence to reduce the attack surface.
In @.github/workflows/test-release.yml:
- Line 70: Replace the tag reference in the actions/checkout step with its
corresponding full commit SHA to prevent mutable ref drift. Instead of using
actions/checkout@v7.0.0, use the complete commit hash (in the format
actions/checkout@<full-sha>) that corresponds to that version tag to ensure the
workflow always uses an immutable reference.
---
Outside diff comments:
In @.github/workflows/release.yml:
- Around line 106-111: The publish-testpypi and publish-pypi jobs are missing
the persist-credentials security configuration in their checkout steps. Add
persist-credentials: false to the with section of the actions/checkout@v7.0.0
action in both jobs to ensure consistent credential minimization across all
workflow jobs, matching the configuration already present in the release job.
This should be added at lines 106-111 for the publish-testpypi job and at lines
173-178 for the publish-pypi job.
---
Nitpick comments:
In @.github/workflows/build-draft-fix-image.yml:
- Around line 41-43: The checkout step in the workflow does not disable
credential persistence, which leaves git credentials available during the Docker
build context and increases the attack surface. Add the with parameter
persist-credentials set to false to the actions/checkout step to prevent the
credentials from being persisted after the checkout is complete, since this
workflow does not require git credentials after the initial checkout operation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 81654709-6be1-433e-bee4-bb62432759fb
📒 Files selected for processing (8)
.github/workflows/auto-merge.yml.github/workflows/build-draft-fix-image.yml.github/workflows/ci.yml.github/workflows/issue-triage.lock.yml.github/workflows/release.yml.github/workflows/renovate.yml.github/workflows/sync-wiki.yml.github/workflows/test-release.yml
ff-renovate
Bot
force-pushed
the
deps/actions-checkout-7.x
branch
from
June 18, 2026 20:04
a5c7147 to
064c9f7
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-draft-fix-image.yml:
- Around line 41-43: The checkout action step named "Checkout" that uses
actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 does not disable
credential persistence. Add the `persist-credentials: false` parameter to the
checkout action to prevent unnecessarily keeping git credentials in the
environment after checkout, since the workflow only performs a Docker image
build and push with no authenticated git operations after this step.
In @.github/workflows/renovate.yml:
- Around line 75-77: In the checkout step using actions/checkout@v7, replace the
mutable version reference `@v7` with a pinned immutable SHA commit hash to ensure
the exact version is always used. Additionally, add persist-credentials: false
to the step configuration to disable credential persistence, since this workflow
only requires read access and does not perform any authenticated git operations.
This hardens the workflow by reducing security attack surface and ensuring
reproducibility.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 7ba1cd58-2542-4016-afc2-e1bf36224063
📒 Files selected for processing (8)
.github/workflows/auto-merge.yml.github/workflows/build-draft-fix-image.yml.github/workflows/ci.yml.github/workflows/issue-triage.lock.yml.github/workflows/release.yml.github/workflows/renovate.yml.github/workflows/sync-wiki.yml.github/workflows/test-release.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/issue-triage.lock.yml
fulviofreitas
approved these changes
Jun 19, 2026
Contributor
Author
|
🎉 This PR is included in version 3.18.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v6→v7v6.0.3→v7.0.0Release Notes
actions/checkout (actions/checkout)
v7.0.0Compare Source
v7Compare Source
This PR has been generated by Mend Renovate.