From 2ad34f6cb567a6b04911b8d8426ff1b8613812b2 Mon Sep 17 00:00:00 2001 From: Joshua Temple Date: Wed, 10 Jun 2026 11:59:23 -0400 Subject: [PATCH] fix: bump generated checkout pin to v6.0.3 to match committed workflows The generator pinned actions/checkout at v4.3.1 while dependabot had moved the committed self-host workflows to v6.0.3, so regenerating would silently downgrade checkout. Update the built-in pin table to the v6.0.3 SHA the workflows already use. Signed-off-by: Joshua Temple --- internal/generate/action_pins.go | 2 +- internal/generate/merge_queue_test.go | 2 +- internal/generate/validate_check_test.go | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/internal/generate/action_pins.go b/internal/generate/action_pins.go index 1b509b4c..98fcd90e 100644 --- a/internal/generate/action_pins.go +++ b/internal/generate/action_pins.go @@ -35,7 +35,7 @@ type actionPin struct { // repositories at the major tags below; action_pins entries in the manifest // override any of these without code changes. var defaultActionPins = map[string]actionPin{ - actionCheckout: {tag: "v4", sha: "34e114876b0b11c390a56381ad16ebd13914f8d5", shaVersion: "v4.3.1"}, + actionCheckout: {tag: "v6", sha: "df4cb1c069e1874edd31b4311f1884172cec0e10", shaVersion: "v6.0.3"}, actionGithubScript: {tag: "v7", sha: "f28e40c7f34bde8b3046d885e986cb6290c5673b", shaVersion: "v7.1.0"}, actionDownloadArtifact: {tag: "v4", sha: "d3f86a106a0bac45b974a628896c90dbdf5c8093", shaVersion: "v4.3.0"}, actionUploadArtifact: {tag: "v4", sha: "ea165f8d65b6e75b540449e92b4886f43607fa02", shaVersion: "v4.6.2"}, diff --git a/internal/generate/merge_queue_test.go b/internal/generate/merge_queue_test.go index fc324bb5..63c7003d 100644 --- a/internal/generate/merge_queue_test.go +++ b/internal/generate/merge_queue_test.go @@ -83,7 +83,7 @@ func TestMergeQueueGenerator_PinModeSHA(t *testing.T) { content, err := gen.Generate() require.NoError(t, err) - assert.Contains(t, content, "uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5") + assert.Contains(t, content, "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10") assert.NotContains(t, content, "uses: actions/checkout@v4") } diff --git a/internal/generate/validate_check_test.go b/internal/generate/validate_check_test.go index f4fc3eec..8601006a 100644 --- a/internal/generate/validate_check_test.go +++ b/internal/generate/validate_check_test.go @@ -83,7 +83,7 @@ func TestValidateCheckGenerator_PinModeSHA(t *testing.T) { content, err := gen.Generate() require.NoError(t, err) - assert.Contains(t, content, "uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5") + assert.Contains(t, content, "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10") assert.NotContains(t, content, "uses: actions/checkout@v4") }