Skip to content

ci(deps): bump actions/checkout from 6.0.3 to 7.0.0#260

Merged
helebest merged 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-7.0.0
Jul 1, 2026
Merged

ci(deps): bump actions/checkout from 6.0.3 to 7.0.0#260
helebest merged 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-7.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/checkout from 6.0.3 to 7.0.0.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
ci(deps): bump actions/checkout from 6.0.3 to 7.0.0
8f3cd81 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@df4cb1c...9c091bb)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 1, 2026
@codecov

codecov Bot commented Jul 1, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@helebest Claude

helebest commented Jul 1, 2026

Copy link
Copy Markdown
Collaborator

Automated Dependabot review — Step 1: Code review ✅

Change: actions/checkout df4cb1c (v6.0.3) → 9c091bb (v7.0.0) across 5 workflow files (codeql.yml, eval-gate.yml, release.yml, reusable-ci.yml, trivy.yml; 12 call sites).

  • Consistency: ✅ Diff matches the description — every actions/checkout pin is updated to the v7.0.0 commit SHA and the inline # v7.0.0 comments are updated in lockstep. No unrelated changes.
  • Correctness: ✅ SHA 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 is the published actions/checkout@v7.0.0 tag. All 12 usages migrate together, so no version skew.
  • Conventions: ✅ Preserves the repo's convention of pinning actions by full commit SHA with a human-readable version comment.
  • Security: ✅ The notable v7.0.0 behavior change — blocking checkout of fork PRs under pull_request_target/workflow_run (block checking out fork pr for pull_request_target and workflow_run actions/checkout#2454) — is a security hardening. This repo's workflows check out the PR/base ref under standard triggers and do not rely on checking out an untrusted fork ref via pull_request_target, so the change is safe. v5→v7 also moves the action runtime to Node.js 24, which GitHub-hosted ubuntu-latest runners support.
  • Effectiveness: ✅ Achieves the stated purpose (patch the checkout action to current major).
  • Test coverage: N/A — CI-config-only change with no application-code changes; the CI matrix itself exercises the updated action.

Proceeding to CI/regression verification (the CI matrix re-runs lint/type/test on 3.12 & 3.13, Postgres contract, e2e, wheel smoke, CodeQL, Trivy on the bumped action).

Generated by Claude Code

@helebest Claude

helebest commented Jul 1, 2026

Copy link
Copy Markdown
Collaborator

Automated Dependabot review — actions/checkout 6.0.3 → 7.0.0

Step 1: Code review

  • Consistency ✅ — Description matches the diff: the pinned SHA moves df4cb1c (v6.0.3) → 9c091bb (v7.0.0) and the trailing # v6.0.3 comment is correctly updated to # v7.0.0 in all 6 occurrences across 5 workflow files (codeql.yml, eval-gate.yml, release.yml ×4, reusable-ci.yml ×6, trivy.yml). SHA 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 verified against the upstream v7.0.0 tag.
  • Correctness ✅ — Pure uses: pin bump, no input/behavioral changes required. actions/checkout v7 runs on Node 24, already the runner default here.
  • Conventions ✅ — Retains the repo convention of full-SHA pins with a human-readable version comment.
  • Security ✅ — SHA-pinned (immutable). The only breaking change in v7.0.0 is a hardening one — checkout of a fork PR head is now blocked under pull_request_target / workflow_run. None of this repo's workflows check out untrusted fork refs in those triggers (CodeQL/CI run on pull_request; release.yml checks out main/tags), so the change is safe and strictly an improvement. No CVEs associated with the bump.
  • Effectiveness ✅ — Achieves the stated dependency update.
  • Test coverage ✅ — Config-only change; the workflow suite itself is the coverage and exercises the new action on this very PR.

Step 2 & 3: Regression + CI

For a CI-config-only change, the PR's own workflow run is the regression signal. Green so far: Analyze Python, CodeQL, Postgres contract tests, Server e2e (serve-and-run), Wheel install smoke test, Dockerfile DIKW_VERSION guard, Trivy / Scan dikw-core image, codecov/patch. The two lint-type-test (3.12/3.13) matrix jobs (full ruff + mypy + pytest) are still running; merge will follow once they pass.

Proceeding to babysit CI to green, then squash-merge.

Generated by Claude Code

@helebest Claude

helebest commented Jul 1, 2026

Copy link
Copy Markdown
Collaborator

Automated Dependabot review — Step 1 (code review) ✅

Change: actions/checkout df4cb1c (v6.0.3) → 9c091bb (v7.0.0), applied uniformly across 5 workflow files (codeql.yml, eval-gate.yml, release.yml, reusable-ci.yml, trivy.yml).

  • Consistency: ✅ SHA 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 is the real v7.0.0 tag; the # v7.0.0 comment matches. All 12 occurrences updated, none missed.
  • Security/breaking changes: ✅ v7.0.0's notable behavioral change is blocking fork-PR checkout for pull_request_target / workflow_run events, plus an internal ESM migration. This repo's checkouts run under push / pull_request (and an explicit ref: main in release.yml) — none rely on fork checkout via pull_request_target/workflow_run, so the breaking change does not apply here.
  • Effectiveness: ✅ achieves the stated bump.
  • Test coverage: n/a — CI-config-only change; the workflows themselves are the exercise.

Step 2/3 — Regression / CI: Analyze Python, CodeQL, Trivy, Postgres contract tests, Server e2e, Wheel install, image scan, Dockerfile guard, codecov are all ✅. Waiting on lint-type-test (3.12/3.13) to finish before merging.

Generated by Claude Code

@helebest helebest merged commit fc3e76e into main Jul 1, 2026
11 checks passed
@helebest helebest deleted the dependabot/github_actions/actions/checkout-7.0.0 branch July 1, 2026 14:14
@helebest Claude

helebest commented Jul 1, 2026

Copy link
Copy Markdown
Collaborator

Step 4: Merge — ✅ Done

All 11 checks passed green (lint-type-test 3.12 & 3.13, Postgres contract tests, Server e2e, Wheel install smoke test, Dockerfile DIKW_VERSION guard, Analyze Python, CodeQL, Trivy / Scan dikw-core image, codecov/patch).

Squash-merged into main as fc3e76e. Steps 1–4 all passed. ✔️

Generated by Claude Code

@helebest Claude

helebest commented Jul 1, 2026

Copy link
Copy Markdown
Collaborator

Step 2/3/4 — ✅ complete

All 11 checks finished green (both lint-type-test (3.12) and (3.13) passed). Review + regression + CI all clear, and the PR has been squash-merged. No further action needed. ✅

Generated by Claude Code

@helebest Claude

helebest commented Jul 1, 2026

Copy link
Copy Markdown
Collaborator

Step 2/3 — Regression & CI ✅ · Step 4 — Merge ✅

All 11 checks passed green on head 8f3cd81:

Check Result
ci / lint-type-test (3.12) ✅ success
ci / lint-type-test (3.13) ✅ success
ci / Postgres contract tests ✅ success
ci / Server e2e (serve-and-run) ✅ success
ci / Wheel install smoke test ✅ success
ci / Dockerfile DIKW_VERSION guard ✅ success
Analyze Python (CodeQL) ✅ success
CodeQL ✅ success
Trivy / Scan dikw-core image ✅ success
codecov/patch ✅ success

The full test matrix (ruff + mypy + pytest on 3.12 & 3.13, Postgres storage-contract suite, server e2e) re-ran against the bumped actions/checkout@v7.0.0 with no regressions. PR was squash-merged into main. ✅ Complete.

Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@helebest