chore(deps): update actions/checkout action to v7 - #32
Conversation
|
PR author is in the excluded authors list. |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 |
There was a problem hiding this comment.
🔍 Major-version jump of checkout in templates — verify runner/Node requirements
Templates move from actions/checkout@v4/@v5 straight to a v7 digest. Major bumps of checkout historically changed the bundled Node runtime, which can break self-hosted or older runner images that consumers of these workflow templates may use. All templates here run on ubuntu-latest, so hosted runners are fine, but downstream repos copying these templates onto other runners should be checked. Worth confirming the digest actually corresponds to the v7.0.1 tag before merge, since a mispinned digest silently pins a different commit.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
Risk: medium. Left a non-blocking comment — Cursor Security Agent completed as skipped, so this is not auto-approved. Human review is needed; @yakimoto is already requested and no additional reviewers were assigned.
Sent by Cursor Approval Agent: Pull Request Router and Approver
ApprovabilityVerdict: Not approved Macroscope's review found this PR not approvable — This PR updates checkout across active workflows and shared templates from several older major versions to v7, changing the action runtime and downstream template update semantics. The changes are mechanically small, but all affected files are owned by another maintainer and unresolved concerns remain about copied-template runner compatibility and digest verification. Not approved because:
Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more. |
4bda367 to
90a4801
Compare
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 |
There was a problem hiding this comment.
🔍 Template previously used a floating tag; now digest-pinned, which changes consumer update semantics
workflow-templates/moq-draft-drift.yml:26 moved from a floating actions/checkout@v5 to a full digest. That is consistent with helpers:pinGitHubActionDigests in renovate.json, but repos that copy this template and do NOT run Renovate will now be frozen on this exact commit with no automatic patch updates. Worth confirming the template consumers are all Renovate-managed.
Was this helpful? React with 👍 or 👎 to provide feedback.
90a4801 to
ad05fb0
Compare
|
Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI. |
ad05fb0 to
435bc8c
Compare
|
Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI. |
435bc8c to
e312c5e
Compare
|
Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI. |
This PR contains the following updates:
v4→v7v5.0.1→v7.0.1v6.0.3→v7.0.1Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v6.1.0Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v5.1.0Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.