Bump the github-actions-updates group across 1 directory with 4 updates

[dependabot]

Bumps the github-actions-updates group with 4 updates in the / directory: actions/checkout, anthropics/claude-code-action, aws-actions/configure-aws-credentials and ossf/scorecard-action.

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Updates anthropics/claude-code-action from 1.0.178 to 1.0.183

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.183

Full Changelog: anthropics/claude-code-action@v1...v1.0.183

v1.0.182

Full Changelog: anthropics/claude-code-action@v1...v1.0.182

v1.0.181

What's Changed

• fix: share one exchanged WIF credential across spawned Claude processes by @​KeisukeYamashita in anthropics/claude-code-action#1407

New Contributors

• @​KeisukeYamashita made their first contribution in anthropics/claude-code-action#1407

Full Changelog: anthropics/claude-code-action@v1...v1.0.181

v1.0.180

Full Changelog: anthropics/claude-code-action@v1...v1.0.180

v1.0.179

Full Changelog: anthropics/claude-code-action@v1...v1.0.179

Commits

• be7b93b chore: bump Claude Code to 2.1.220 and Agent SDK to 0.3.220
• e0cf66d chore: bump Claude Code to 2.1.219 and Agent SDK to 0.3.219
• 44423bd chore: bump Claude Code to 2.1.218 and Agent SDK to 0.3.218
• b00a341 fix: share one exchanged WIF credential across spawned Claude processes (#1407)
• fa7e2f0 chore: bump Claude Code to 2.1.217 and Agent SDK to 0.3.217
• b76a077 chore: bump Claude Code to 2.1.216 and Agent SDK to 0.3.216
• See full diff in compare view

Updates aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v6.2.3

6.2.3 (2026-07-22)

Bug Fixes

• attach git credentials before Tag Major Version push (#1877) (9ae780b)
• PackedPolicyTooLarge detection in STS tags (#1899) (fa8d6a5)

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

6.2.3 (2026-07-22)

Bug Fixes

• attach git credentials before Tag Major Version push (#1877) (9ae780b)
• PackedPolicyTooLarge detection in STS tags (#1899) (fa8d6a5)

6.2.2 (2026-07-07)

Miscellaneous Chores

• release 6.2.2 (d01d678)

6.2.1 (2026-06-26)

Bug Fixes

• enforce allowed-account-ids on all auth paths (#1847) (4d281fb)

6.2.0 (2026-06-01)

Features

• add additional session tags by default (#1775) (e0ba768)
• add more retry logic and better logging (#1764) (540d0c1)
• add regex validation to role-session-name (#1765) (e354499)
• Allow custom session tags to be passed when assuming a role (#1759) (61f50f6)
• expose run id in STS client user-agent (#1774) (29d1be3)
• support custom STS endpoints (#1762) (8d52d05)

Bug Fixes

• skip credential check on output-env-credentials: false (#1778) (58e7c47)
• assumeRole failing from session tag size too large (#1808) (d6f5dc3)

6.1.3 (2026-05-28)

Bug Fixes

• fix: allow kubelet token symlink in #1805

6.1.2 (2026-05-26)

... (truncated)

Commits

• e6de054 chore(main): release 6.2.3 (#1878)
• ab3b2ba chore: Update dist
• fa8d6a5 fix: PackedPolicyTooLarge detection in STS tags (#1899)
• 42e118a chore(deps-dev): bump markdownlint-cli from 0.49.0 to 0.49.1 (#1896)
• d86ddfc chore: Update dist
• 874aaac chore(deps): bump @​aws-sdk/client-sts from 3.1086.0 to 3.1091.0 (#1892)
• d4341b6 chore: Update dist
• fe51823 chore(deps-dev): bump @​aws-sdk/credential-provider-env (#1894)
• a8be382 chore(deps-dev): bump @​biomejs/biome from 2.5.3 to 2.5.4 (#1893)
• e000376 chore: Update dist
• Additional commits viewable in compare view

Updates ossf/scorecard-action from 2.4.3 to 2.4.4

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.4

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

• log POST failures instead of failing entire action by @​spencerschrock in ossf/scorecard-action#1625

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

Commits

• 2d11466 Bump action tag for v2.4.4 release (#1688)
• 1bd3285 🌱 Bump the docker-images group across 1 directory with 2 updates (#1...
• 913edce 🌱 Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (#1671)
• 0957b8f 🌱 Bump golang.org/x/net from 0.56.0 to 0.57.0 (#1680)
• f0061eb 🌱 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#1687)
• 20ee732 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (#1685)
• 9f295ef 🌱 Bump the github-actions group with 6 updates (#1686)
• 69bf556 🌱 Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 (#1681)
• 94e8b96 🌱 Bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (#1673)
• c7a1b37 🌱 Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (#1675)
• Additional commits viewable in compare view

[mm-cloud-bot]

@dependabot[bot]: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

I understand the commands that are listed here

[mm-cloud-bot]

@dependabot[bot]: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

I understand the commands that are listed here

[mm-cloud-bot]

@dependabot[bot]: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

I understand the commands that are listed here

[mm-cloud-bot]

@dependabot[bot]: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

I understand the commands that are listed here

[mm-cloud-bot]

@dependabot[bot]: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

I understand the commands that are listed here

[mattermost-build]

Hello @dependabot[bot],

Thanks for your pull request! A Core Committer will review your pull request soon. For code contributions, you can learn more about the review process here.

[devinbinnie]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

📝 Walkthrough

Walkthrough

Updates pinned GitHub Actions revisions across CI, E2E, nightly, release, documentation analysis, Scorecards, and versioning workflows. Checkout moves to v7.0.1; selected AWS, Claude, and Scorecards actions also receive patch-version updates.

Changes

Workflow action pin updates

Layer / File(s)	Summary
PR and E2E workflow pins .github/workflows/build-for-pr.yml, .github/workflows/ci.yaml, .github/workflows/codeql-analysis.yml, .github/workflows/compatibility-matrix-testing.yml, .github/workflows/e2e-*.yml	Pinned actions/checkout revisions are updated from v7.0.0 to v7.0.1 across PR, compatibility, CodeQL, and E2E jobs.
Nightly and release workflow pins .github/workflows/nightly-*, .github/workflows/release*.y*ml, .github/workflows/run-release-script.yml	Nightly and release checkout pins move to v7.0.1; AWS credentials pins move from v6.2.2 to v6.2.3 where applicable.
Analysis and versioning workflow pins .github/workflows/docs-impact-review.yml, .github/workflows/scorecards-analysis.yml, .github/workflows/update-latest-version.yml	Documentation analysis, Scorecards, and versioning workflows update their pinned action revisions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• mattermost/desktop#3876: Updates overlapping GitHub Actions checkout pins in workflow files.

Suggested labels: kind/chore

Suggested reviewers: devinbinnie

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the grouped GitHub Actions dependency updates across one directory.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/github-actions-updates-ba3188b015

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-for-pr.yml:
- Line 21: Disable persisted checkout credentials by setting persist-credentials
to false on the affected checkout steps in .github/workflows/build-for-pr.yml at
21, 55, 87, and 146; .github/workflows/ci.yaml at 17, 56, 89, and 147;
.github/workflows/codeql-analysis.yml at 27; and
.github/workflows/e2e-functional-template.yml at 166. Also disable it at
.github/workflows/e2e-functional.yml:323 unless subsequent policy-test steps
require authenticated Git access.

In @.github/workflows/nightly-main.yml:
- Line 32: Update the actions/checkout steps at
.github/workflows/nightly-main.yml:32-32, 68-68, 121-121, 152-152, and 205-207;
.github/workflows/nightly-rainforest.yml:33-33, 79-79, and 126-128;
.github/workflows/release-mas.yaml:30-30; and
.github/workflows/release.yaml:23-23, 44-44, 82-82, 129-129, 185-186, 208-208,
and 238-238. Set persist-credentials to false for each checkout in jobs that
only build, test, or package, while retaining credential persistence only for
checkout steps whose job later performs git push.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9c23af7e-13fb-4f85-85e2-216c5983e695

📥 Commits

Reviewing files that changed from the base of the PR and between 983f4f8 and b8aa5c2.

📒 Files selected for processing (17)

• .github/workflows/build-for-pr.yml
• .github/workflows/ci.yaml
• .github/workflows/codeql-analysis.yml
• .github/workflows/compatibility-matrix-testing.yml
• .github/workflows/docs-impact-review.yml
• .github/workflows/e2e-functional-template.yml
• .github/workflows/e2e-functional.yml
• .github/workflows/e2e-label-cleanup.yml
• .github/workflows/e2e-pr-trigger.yml
• .github/workflows/nightly-builds.yaml
• .github/workflows/nightly-main.yml
• .github/workflows/nightly-rainforest.yml
• .github/workflows/release-mas.yaml
• .github/workflows/release.yaml
• .github/workflows/run-release-script.yml
• .github/workflows/scorecards-analysis.yml
• .github/workflows/update-latest-version.yml

[devinbinnie]

/update-branch

[mattermost-build]

Error trying to update the PR.
Please do it manually.

[devinbinnie]

Closing and we'll let dependabot create a new one when necessary.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml