Skip to content

ci(deps): bump actions/checkout from 4.3.1 to 7.0.0 - #545

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-7.0.0
Open

ci(deps): bump actions/checkout from 4.3.1 to 7.0.0#545
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-7.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown

Bumps actions/checkout from 4.3.1 to 7.0.0.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
ci(deps): bump actions/checkout from 4.3.1 to 7.0.0
67fc86d 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@34e1148...9c091bb)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 28, 2026
@covenant-talos

covenant-talos Bot commented Jul 28, 2026

Copy link
Copy Markdown

Walkthrough

This Dependabot-driven PR bumps the pinned actions/checkout GitHub Action across all repository workflows from commit 34e1148… (v4.3.1) to 9c091bb… (v7.0.0). The upgrade spans the v5, v6, and v7 major lines, bringing notable changes including Node.js 24 support, persisted-credentials handling via a separate file, SHA-256 repository checkout fixes, and a security hardening that blocks checking out fork PRs for pull_request_target and workflow_run events. Every workflow that previously pinned the v4 commit is updated uniformly; no other inputs or behavior are changed.

Changes

Cohort / File(s) Change Summary
CI workflows: .github/workflows/ci.yml Updates all eight actions/checkout step references to the v7.0.0 commit SHA across changes, quick-checks, security-audit, build, validator, miner, basilica-cli, and Python SDK test jobs.
Release workflows: .github/workflows/release-cli.yml, .github/workflows/release-python-sdk.yml Bumps checkout pin in version-extraction, build, publish, and post-release jobs for CLI and Python SDK release pipelines.
Security scan workflows: .github/workflows/gitleaks.yml, .github/workflows/semgrep.yml Updates checkout action pin in secret-scanning and Semgrep rule-checkout steps, which rely on fetch-depth: 0 and persist-credentials: false.

Estimated review effort: 1/5 (routine Dependabot version bump with uniform pin replacement across workflow files).

Instant overview - a deep technical review follows as a separate comment.

@covenant-talos

covenant-talos Bot commented Jul 28, 2026

Copy link
Copy Markdown

PR #545: ci(deps): bump actions/checkout from 4.3.1 to 7.0.0 (by dependabot[bot])

Summary

Dependabot bumps the SHA-pinned actions/checkout from v4.3.1 (34e11487...) to v7.0.0 (9c091bb2...) at 17 call sites across five workflows (ci.yml, gitleaks.yml, release-cli.yml, release-python-sdk.yml, semgrep.yml). No workflow logic changes. The jump spans three major versions, bringing a hardened credential-storage model (v6: token persisted to a separate file), a Node 24 runtime requirement (v5+), and a security-relevant breaking change in v7: fork-PR checkouts under pull_request_target and workflow_run are now blocked by default.

Architecture

No structural impact. CI configuration only; no application components, flows, or Kubernetes/network surface touched.

Issues Found

CRITICAL Issues (Must Fix Before Merge)

None found.

HIGH Severity Issues (Advised to Fix Before Merge)

None found.

MEDIUM Severity Issues (Optional to Fix Before Merge)

  1. Verify no workflow relies on fork-PR checkout under pull_request_target/workflow_run before merging
    Functional Correctness | MEDIUM | Effort: quick win

    • Why: v7.0.0's headline change (quoted from the PR description release notes) is "block checking out fork pr for pull_request_target and workflow_run ... block checking out fork pr for pull_request_target and workflow_run actions/checkout#2454", and v6.1 notes "[BREAKING] backport allow-unsafe-pr-checkout". If any of the five modified workflows triggers on pull_request_target or workflow_run and checks out a contributor's head SHA, the checkout step will now fail. The diff does not include the on: sections, so I cannot confirm exposure from the diff alone — flagging as uncertain. The failure mode is fail-closed (workflow errors), not silent or unsafe, so CI on this PR should reveal it.
    • How: Run grep -nE "pull_request_target|workflow_run" .github/workflows/*.yml. If a hit exists and that job checks out the PR head, keep the new default block (recommended) or explicitly opt in via the documented input only after a security sign-off.

  2. Confirm Blacksmith runner images support the Node 24 action runtime
    Stability & Availability | MEDIUM | Effort: quick win

    • Why: Since v5.0.0, actions/checkout runs on node24 ("Update actions checkout to use node 24", changelog in PR description), which requires a recent runner. Most jobs here run on blacksmith-32vcpu-ubuntu-2404 (e.g., ci.yml hunks), and semgrep.yml runs checkout inside a container (container: image: semgrep/semgrep:1.170.1@sha256:98c2572f...), where the runner injects the node runtime into the container — making runner version the hard dependency. Uncertain: I cannot inspect Blacksmith image versions from the diff; green CI on this PR resolves it.
    • How: Check that CI on this PR executed actions/checkout successfully on both Blacksmith and container-based jobs; if any step failed with a node-runtime error, update the runner images before merging.

LOW Severity Issues (Minor Improvements)

  1. Update the stale # v4 trailing comments on all 17 bumped lines
    Maintainability & Coherency | LOW | Effort: quick win
    • Why: Every updated line retains the old major-version comment, e.g. in .github/workflows/ci.yml, gitleaks.yml, release-cli.yml, release-python-sdk.yml, semgrep.yml: 
      +      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      The pinned SHA is v7.0.0, so the comment is now misleading for auditors and future reviewers relying on it (this repo clearly uses the comment as the human-readable version, e.g. # v2, # v5 on adjacent pins).
    • How: Rewrite the comment on all occurrences, e.g.: 
      sed -i 's|actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4|actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0|' .github/workflows/*.yml
      Using the full # v7.0.0 (rather than # v7) is preferable for SHA-pinned actions since it records exactly what was reviewed.

Security Review

Surface in this diff: CI/CD supply chain (third-party action pin) and checkout behavior at trust boundaries.

  • Trust boundaries / input validation: Swept. v7 reduces risk by blocking fork-PR checkout under pull_request_target/workflow_run by default (the classic secret-exfiltration vector); residual exposure depends on triggers, covered by MEDIUM finding 1.
  • Secret and key handling: Swept. gitleaks.yml and semgrep.yml already set persist-credentials: false, retained in the diff. The v6 line (skipped by this jump) moved token persistence out of git config into a separate file — a hardening gain inherited here.
  • Supply chain: Swept. The repo's SHA-pinning practice is preserved; the new SHA 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 matches the head commit 9c091bb ("update error wording (#2467)") listed in Dependabot's v7.0.0 commit list, so the pin corresponds to the advertised release.
  • Authn/authz, injection (SQL/shell/template/deserialization), crypto/randomness, DoS: No relevant surface — no workflow permissions, permissions blocks, or step logic changed.

Suggestions for Improvements

  • Consider going straight to v7.0.1: the changelog quoted in the PR description shows it already exists with fixes ("Escape values passed to --unset", "Skip running unsafe pr check if input is default"). A @dependabot rebase/recreate after v7.0.1 is published, or a manual SHA swap, avoids landing on the .0 release.
  • Adopt full-version comments (# v7.0.0) for all SHA-pinned actions as a convention; it makes Dependabot's comment updates reliable and audits unambiguous.

Positive Observations

  • SHA pinning maintained consistently across all 17 call sites — strong supply-chain hygiene for a financial-services codebase.
  • The upgrade is uniformly applied (no straggler versions across workflows), keeping CI coherent.
  • Net security improvement: default fork-PR checkout blocking plus the v6 credential-storage hardening, at zero configuration cost.
  • Dependabot's commit message ci(deps): bump actions/checkout from 4.3.1 to 7.0.0 follows Conventional Commits — no commit-standards violations.

Recommendation and Next Steps

COMMENT — The bump is safe and security-positive, but merge should follow (a) a green CI run proving Blacksmith/container runner compatibility, (b) a quick grep confirming no pull_request_target/workflow_run fork-checkout dependency, and (c) ideally the trivial fix of the 17 stale # v4 comments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants