chore(deps): bump actions/checkout from 4 to 7 - #78
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
dependencies
srpatcha
reviewed
Sep 4, 2026
srpatcha
left a comment
srpatcha
left a comment
Member
There was a problem hiding this comment.
Review — eDB#78 "chore(deps): bump actions/checkout from 4 to 7"
head: a4e0aa5 author: app/dependabot ci: green, and partially meaningful — codeql.yml is one of the files changed and its Analyze jobs ran and passed at v7
Verdict: Low risk and the tag is real. Nineteen actions/checkout@v4 → @v7 substitutions across ten workflow files, no other change. I checked the three breaking changes between v4 and v7 against this repo and none of them bites. The gap is that only two of the ten changed workflows actually ran here.
Findings
| # | Severity | File:line | Finding | Recommended fix |
|---|---|---|---|---|
| 1 | Medium | .github/workflows/ci.yml:22,70,92 |
Eight of the ten workflows this PR edits were not executed by it. Notably ci.yml: this branch forks from 5e436bd (2026-08-25), where ci.yml triggers on pull_request: branches: [main], and this PR targets master, which was added to the trigger later in f3b1ab0 and is not in this branch. So the Test (Python …) matrix and Build Python Package never ran, and checks.txt lists only Analyze (Python), CodeQL and assign. release.yml, nightly.yml, weekly.yml, deploy-pages.yml, book-build.yml, video-build.yml and sync-release-branch.yml are tag- or schedule-triggered and were not exercised either — sync-release-branch.yml in particular only ever runs on a v* tag, so a break there surfaces during a release. |
Rebase onto current master so at least ci.yml runs. Sequence after eDB#82, or the matrix dies at pip install -r requirements.txt — a file this repo does not have — and proves nothing about checkout. |
| 2 | Low | .github/workflows/sync-release-branch.yml:33, .github/workflows/* |
Dependabot is editing repo-local copies of workflows that .github/STANDARDS.md lists as inherited org-wide from embeddedos-org/.github (sync-release-branch.yml, check-canon.yml). Shipping a local override is permitted by that document, but bumping it here alone pins one repo's copy ahead of the org template and of the other 18 repos. Over time that is how the "single source of truth" in STANDARDS.md drifts. |
Bump actions/checkout in embeddedos-org/.github and let the inherited copy carry it, or accept the override deliberately and note why it diverges. Not this PR's job to decide — but somebody should. |
Not findings, checked and cleared:
v7exists.actions/checkoutlatest release isv7.0.1;refs/tags/v7resolves to3d3c42e5aac5ba805825da76410c181273ba90b1.- The v7 breaking change does not apply. v5.1/v6.1/v7 block checking out a fork PR ref under
pull_request_targetandworkflow_rununlessallow-unsafe-pr-checkoutis set. Neither trigger appears anywhere in.github/workflows/— grep returns nothing. This is a security tightening the repo gets for free. - The v6 credential change does not apply. v6 persists credentials to a separate file. The one workflow that writes to a protected ref,
sync-release-branch.yml:47-59, does not use the persisted git credential at all — it callsgh api -X PATCH .../git/refs/heads/releasewith an explicitGH_TOKEN: ${{ github.token }}. So the force-update path described in.github/STANDARDS.md("Release model") is unaffected. - The v5 runtime change is satisfied. v5+ requires the Node 24 action runtime; every job here runs on GitHub-hosted
ubuntu-latest/ubuntu-22.04/macos-13/windows-2022, whose runner versions provide it. No self-hosted runner appears in anyruns-on:. fetch-depthandrefinputs are unchanged and still supported —release.yml:135(fetch-depth: 0) andsync-release-branch.yml:36-37(fetch-depth: 1,ref:) both survive the major bumps.
Dependabot's own comment about the missing github-actions label is already on this PR and is not repeated; the config to fix is .github/dependabot.yml.
Architecture conformance
Conforms. CI-tooling change confined to Tier 3 eDB (master design §21, and "Infrastructure" for the workflow files themselves). No source, import, link or manifest-entry change, so §5.1 dependency direction is untouched. .github/STANDARDS.md's release model is preserved — see the sync-release-branch.yml check above — subject to the override-drift note in finding #2.
Proposed changes
None to the diff; it is mechanical and correct. Sequence: land eDB#82, rebase this branch so ci.yml actually runs at v7, then merge. If the org template is going to carry this bump instead (finding #2), decide that before merging, not after.
Verification I ran
gh api repos/actions/checkout/releases→ latest tagsv7.0.1,v6.1.0,v5.1.0,v4.4.0.gh api repos/actions/checkout/git/ref/tags/v7→refs/tags/v7 -> 3d3c42e5aac5ba805825da76410c181273ba90b1. The pinned major exists.- Release notes for v5.1.0 / v6.0.0 / v6.1.0 / v7.0.0 / v7.0.1 read for breaking changes; the three that exist are listed and cleared above.
grep -rn "pull_request_target\|workflow_run" .github/workflows/→ no matches, which is what clears the v7 breaking change.grep -rn -A3 "actions/checkout" .github/workflows/→ the only inputs used anywhere arefetch-depthandref.- Diff content:
grep -E "^[+-]" diff.patch→ 19 changed lines, every one of themactions/checkout@v4→actions/checkout@v7. Nothing else in the patch. Analyze (Python)(run33449896985-series) andCodeQLpassed on this head, andcodeql.ymlis one of the ten files changed — so checkout@v7 is empirically working for at least that workflow.- Trigger claim in finding #1 read from
git show a4e0aa5e:.github/workflows/ci.yml(pull_request: branches: [main]) againstorigin/master'sbranches: [master, main];git merge-base origin/master <head>→5e436bd.
Not checked
- Eight of the ten changed workflows were never executed at v7 — by this PR or by me.
release.ymlandsync-release-branch.ymlonly run on av*tag, so the first real exercise of the release path will be a live release. My clearance of the v6 credential change is read from the workflow source, not from a run. - I did not diff the v4 → v7 action source; the breaking-change assessment comes from the published release notes plus the linked GitHub changelog, not from reading the action.
- The
macos-13legs ofci.ymlcannot be assessed regardless — on the sibling PR eDB#82 they satqueuedfor 45 minutes without starting, on a runner image GitHub has retired. - No claim about self-hosted runners; none are configured today, and this bump would need re-checking if any were added.
Automated architecture review of a4e0aa5e451e — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)