Bump actions/checkout from 4.4.0 to 7.0.1 - #5
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7.0.1
branch
2 times, most recently
from
August 29, 2026 17:03
00ceff6 to
bb1fb5d
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7.0.1
branch
from
September 3, 2026 17:07
bb1fb5d to
f36d800
Compare
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.4.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@11d5960...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7.0.1
branch
from
September 4, 2026 15:13
f36d800 to
be1a598
Compare
Author
|
Superseded by #15. |
dependabot
Bot
deleted the
dependabot/github_actions/actions/checkout-7.0.1
branch
September 4, 2026 15:56
karthik1729
added a commit
that referenced
this pull request
Sep 12, 2026
…attach acts on a guess Four ways the agent could lose or mislabel data, from the 2026-09-12 review. A `btrfs receive` that exited 0 was trusted whatever it created: a peer holding the secret could land any name under `snap/` and this node advertised it as held on the next beat — the created names are now compared on both paths and anything but the one asked for is refused and removed. The cleanup of a partial receive was `let _`; a delete that did not land is now part of the error, so a truncated subvolume under the real name is never counted as held. The orphan-snapshot sweep deletes with the uid it decided on, as the volume collector already did. Attaching to a detached volume used an unguarded JSON-patch `add` of the whole `ownerReferences` array, which REPLACES an existing list — two parents attaching at once lost an entry, and the retire sweep could collect a volume a live worktree ran on; the empty arm now tests that the key is absent first. Two more on the environment side. The intercept release read an API error on the Workspace GET as "gone" and left the policy that opens the environment's namespace to that pod in place for good; the error is propagated and the record kept for a retry. And a `Keep` decision (an API blip mid-intercept) counted its workspace as stale, so the policy sweep deleted the grants of an intercept that was still being rendered; a Keep's workspace is in force. The periodic volume collector now asks every parent in the cluster whether it names the volume, the same predicate the event-driven collector uses, rather than this node's parents alone. Review findings #4, #5, #30, #36, #124, #125.
karthik1729
added a commit
that referenced
this pull request
Sep 12, 2026
Review findings #3, #4, #5, #6, #7, #8, #9, #12, #15, #18, #19, #20, #82. No listing here had a ceiling. `_catalog` stat-ed every unmarked image an owner had to answer a page of two; `referrers` read every signature of a subject on every pull of it; `api_refs`, `volumes`, `volumehistory` and `index::list` each answered whatever was there. Each now takes `?n=`, pages with the object store's own start-after where it has one, and says so with a `Link`. `api_files` reads a size only when asked for one, and `check_repo` scans as far as it can act and no further. The ownership map's own bounds: a map write times out inside the lease that authorised it rather than at it, the epoch is re-checked after every bounded write, a prune pass gets one lease TTL as a whole instead of one per entry, `all()` scans without the role lock held, and a clock reading before a compiled-in floor decides nothing at all — it would have read every live lease as expired and granted every repo away from its owner. Also: the three image write routes get a body limit, and a by-tag push hashes sha512 only for an image that actually holds a sha512 manifest. `deepen-not` lists the repo's refs once and resolves a shorthand under git's own prefixes, not by whichever ref happens to end in that name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 4.4.0 to 7.0.1.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)