chore(deps): bump actions/checkout from 6.1.0 to 7.0.1 - #26
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.1.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@d23441a...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
masutaka
left a comment
masutaka
left a comment
There was a problem hiding this comment.
Summary
- Package: actions/checkout 6.1.0 → 7.0.1
- Dependency type: CI dependency (GitHub Actions workflow)
- Version change: major
Key findings
- Breaking changes: Yes. v7.0.0 makes checking out fork PR code from
pull_request_target/workflow_runfail by default (actions/checkout#2454). The newallow-unsafe-pr-checkoutinput (default:false) must be explicitly set totrueto allow it. This repository's.github/workflows/ci.ymlonly triggers onpushandpull_request; neitherpull_request_targetnorworkflow_runis used anywhere (verified by grepping the whole repository). No impact. - Security: No linked Dependabot alert (0 open alerts). This is a plain version-update PR, not a security update. That said, the v7.0.0 change itself hardens against "pwn request" attacks, and v7.0.1 escapes values passed to
git config --unset(actions/checkout#2530) — both move in a safer direction. - Supported versions: No change in runner requirements. It still runs on Node.js 24, same as the v6 line. v7 converted the implementation to ESM, but that is internal to the action and does not change anything on the workflow side.
- CI status: shellcheck / actionlint / ghalint / dependency_review all pass. CodeQL (actions) was still pending at review time.
- Cascading updates: None. The diff is a single line (+1 / -1) in
.github/workflows/ci.yml.
Impact
The only change is the pinned SHA for checkout in the shellcheck job at .github/workflows/ci.yml:27, going from d23441a (v6.1.0) to 3d3c42e (v7.0.1). The existing with: persist-credentials: false setting remains valid; v7 does not change its behavior. There is zero impact on application code (the tfupdate-github-actions scripts themselves).
This is the only place in the repository that calls actions/checkout directly. The other jobs go through reusable workflows in masutaka/actions, so they are out of scope for this PR.
I also reviewed the upstream compare (d23441a...3d3c42e, 21 commits). It centers on the new src/unsafe-pr-checkout-helper.ts and its tests, the ESM migration, the eslint 9 migration, and dependency updates — all consistent with the release notes. The dist/index.js diff is large (+31411 / -27705), but that is explainable by the ESM conversion and the swapped bundled dependencies. I found no suspicious URLs, IP addresses, or obfuscated strings added.
The pinned SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 matches the upstream v7.0.1 tag, and the commit signature is verified (reason: valid).
Conclusion
No issues.
Although this is a major version bump, the breaking change is limited to fork PR checkouts from pull_request_target / workflow_run, and this repository uses neither trigger. The diff is a single workflow line, and the pinned SHA matches the upstream tag with a verified signature. Safe to merge once CodeQL finishes.
1 participant
Bumps actions/checkout from 6.1.0 to 7.0.1.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)