Skip to content

Bump actions/checkout from 7.0.0 to 7.0.1 #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

Bump actions/checkout from 7.0.0 to 7.0.1 #77

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v6.0.3.

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Synchronize all checkout version annotations.

The pinned SHA is actions/checkout v7.0.1, but all six comments still say v6.0.3. Update each annotation to v7.0.1 so dependency audits remain accurate. (gitea.dev.zamar.aero)

  • .github/workflows/codeql.yml#L24-L24: change the annotation to v7.0.1.
  • .github/workflows/lint.yml#L20-L20: change the annotation to v7.0.1.
  • .github/workflows/qodana.yml#L19-L19: change the annotation to v7.0.1.
  • .github/workflows/release-build.yml#L20-L20: change the annotation to v7.0.1.
  • .github/workflows/security.yml#L24-L24: change the annotation to v7.0.1.
  • .github/workflows/sonar.yml#L19-L19: change the annotation to v7.0.1.
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 23-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 6 files
  • .github/workflows/codeql.yml#L24-L24 (this comment)
  • .github/workflows/lint.yml#L20-L20
  • .github/workflows/qodana.yml#L19-L19
  • .github/workflows/release-build.yml#L20-L20
  • .github/workflows/security.yml#L24-L24
  • .github/workflows/sonar.yml#L19-L19
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codeql.yml at line 24, Synchronize the actions/checkout
version annotations with the pinned v7.0.1 SHA. Update the comments at
.github/workflows/codeql.yml:24, .github/workflows/lint.yml:20,
.github/workflows/qodana.yml:19, .github/workflows/release-build.yml:20,
.github/workflows/security.yml:24, and .github/workflows/sonar.yml:19 from
v6.0.3 to v7.0.1 without changing the pinned references.


- name: Set up JDK 21
uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0.
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v6.0.3.

- name: Set up JDK 21
uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0.
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/qodana.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
name: Qodana Analysis (non-blocking AGP 9.3 risk)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v6.0.3.

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

set -euo pipefail

printf '\n## qodana.yml\n'
cat -n .github/workflows/qodana.yml | sed -n '1,80p'

printf '\n## security.yml\n'
cat -n .github/workflows/security.yml | sed -n '1,100p'

printf '\n## occurrences of checkout pin/comment\n'
rg -n "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1|v7\.0\.1|v6\.0\.3" .github/workflows

Repository: Insaner1980/dBcheck

Length of output: 4396

🌐 Web query:

actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 v6.0.3 v7.0.1

💡 Result:

The identifier 3d3c42e5aac5ba805825da76410c181273ba90b1 is the specific commit SHA for the v7.0.1 release of the actions/checkout GitHub Action [1][2][3]. v7.0.1 is a valid and released version of actions/checkout [3][4], published on July 20, 2026 [3]. It includes several bug fixes, such as skipping unsafe PR checks when the input is default, trimming ASCII whitespace for branches, and escaping values passed to --unset [3][5]. v6.0.3 is an earlier, distinct release in the v6.x series of the action [4][6], which preceded the major v7 release [4][7]. The v7.x series introduced significant changes, including migrating the action to ESM (ECMAScript Modules) to support newer @actions/* packages and adding a new allow-unsafe-pr-checkout input to mitigate security risks associated with pull_request_target workflows [7].

Citations:

Update the checkout version comments to v7.0.1. The pinned SHA is v7.0.1, but the comment still says v6.0.3 in:

  • .github/workflows/qodana.yml:19
  • .github/workflows/security.yml:24
  • .github/workflows/codeql.yml:24
  • .github/workflows/release-build.yml:20
  • .github/workflows/sonar.yml:19
  • .github/workflows/lint.yml:20
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 19-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 2 files
  • .github/workflows/qodana.yml#L19-L19 (this comment)
  • .github/workflows/security.yml#L24-L24
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/qodana.yml at line 19, Update the checkout action version
comments from v6.0.3 to v7.0.1 in .github/workflows/qodana.yml:19,
.github/workflows/security.yml:24, .github/workflows/codeql.yml:24,
.github/workflows/release-build.yml:20, .github/workflows/sonar.yml:19, and
.github/workflows/lint.yml:20; leave the pinned SHA unchanged.

with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
fetch-depth: 0
Comment on lines +19 to 22

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Sensitive Data Exposure (CWE-522): Insufficiently Protected Credentials

Reachability: External

Disable checkout credential persistence in both workflows.

  • .github/workflows/qodana.yml#L19-L22: add persist-credentials: false under with.
  • .github/workflows/security.yml#L24-L24: add a with block containing persist-credentials: false.
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 19-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 2 files
  • .github/workflows/qodana.yml#L19-L22 (this comment)
  • .github/workflows/security.yml#L24-L24
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/qodana.yml around lines 19 - 22, Disable checkout
credential persistence in both workflows: add persist-credentials: false to the
existing with block for actions/checkout in .github/workflows/qodana.yml (lines
19-22), and add a with block containing the same setting to actions/checkout in
.github/workflows/security.yml (line 24).

Source: Linters/SAST tools

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v6.0.3.

- name: Set up JDK 21
uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0.
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:
container:
image: semgrep/semgrep:1.162.0@sha256:9349edbadf90c3f3c0c3f55867625354e89680e6fa10d9034042af52fdb0e0d0
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v6.0.3.
- run: >
semgrep scan
--error
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/sonar.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v6.0.3.
with:
fetch-depth: 0

Expand Down
Loading