Repository navigation
actions/checkout version annotation # v7.0.1 is factually incorrect for the pinned SHA #131
Description
Non-Blocking Review Concern: actions/checkout version annotation # v7.0.1 is factually incorrect for the pinned SHA
Source: pre-push whole-codebase review
Location: .github/workflows/claude-assistant.yml:41
Date: 2026-08-16
What was flagged
The SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 belongs to the actions/checkout v4.x release line, not v7.0.1 (which does not exist for this action). The old annotation # v4 was closer to correct. The pinned SHA is what actually executes, so there is no security or correctness impact — but the misleading comment defeats the purpose of human-readable annotations, which is to let maintainers quickly verify that the SHA is current. The same issue exists at .github/workflows/claude-blocking-review.yml:132. Correct annotation would be something like # v4.2.2 (verify the exact tag against the SHA at https://github.com/actions/checkout/releases).
Context
This issue was automatically created from a non-blocking concern identified
during pre-push whole-codebase review. It was flagged for tracking.
Created by lib-review-issues.sh
Activity
twistedmelonman commentedon Aug 18, 2026
Closing — the annotation is correct, so there is nothing to fix.
The claim is that
# v7.0.1onactions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1is factually wrong. Resolving the tag directly:v7.0.1is a lightweight tag pointing directly at that commit — the annotation matches.Worth recording how this looked wrong at first: querying
repos/actions/checkout/tagsand filtering for the SHA returns nothing unless paginated far enough, which reads as "no tag matches this commit." Thegit/ref/tags/<tag>lookup is authoritative and cheap; the/tagslisting is not, for this purpose.Tracked the broader pattern in smartwatermelon/claude-config#328.