Skip to content

build(deps): bump actions/checkout from 6 to 7#25

Merged
steipete merged 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-7
Jun 19, 2026
Merged

build(deps): bump actions/checkout from 6 to 7#25
steipete merged 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 19, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/checkout from 6 to 7.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 19, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner June 19, 2026 07:23
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 19, 2026
@clawsweeper

clawsweeper Bot commented Jun 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex review: needs maintainer review before merge. Reviewed June 19, 2026, 3:33 AM ET / 07:33 UTC.

Summary
The PR bumps five actions/checkout references from v6 to v7 across CI, CodeQL, Crabbox Hydrate, and secret scanning workflows.

Reproducibility: not applicable. this is a dependency maintenance PR, not a bug report. Validation comes from the PR diff, upstream action metadata, and successful workflow checks.

Review metrics: 3 noteworthy metrics.

  • Checkout refs updated: 5 changed across 4 workflows. This confirms the PR covers every current actions/checkout@v6 reference under .github/workflows.
  • Hosted checks: 6 successful, 0 failing. The GitHub-hosted CI, CodeQL, and secret-scan paths that ran for the PR all completed successfully.
  • Manual workflow touched: 1 workflow_dispatch self-hosted workflow. Crabbox Hydrate depends on a self-hosted runner, so normal status checks do not prove that changed path.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Run the manually dispatched Crabbox Hydrate workflow once if maintainers require self-hosted runner proof before merging.

Risk before merge

  • The manually dispatched, self-hosted Crabbox Hydrate workflow is changed but is not represented in the PR status checks; if that lane is release-critical, maintainers should run it once before merge.

Maintainer options:

  1. Smoke Crabbox Hydrate (recommended)
    Dispatch the Crabbox Hydrate workflow against this head if maintainers want direct proof for the self-hosted runner path.
  2. Merge On Hosted Checks
    Accept the residual manual-workflow gap and merge based on the successful CI, CodeQL, and secret-scan checks.

Next step before merge

  • [P2] No code repair is needed; the remaining action is a maintainer choice about whether to smoke the manual self-hosted workflow before merge.

Security
Cleared: The diff only updates the official actions/checkout major tag in existing workflows and does not broaden permissions, secrets access, scripts, or action identities.

Review details

Best possible solution:

Merge the narrow dependency bump once maintainers accept the unrun Crabbox Hydrate path or smoke that workflow on a disposable self-hosted runner.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency maintenance PR, not a bug report. Validation comes from the PR diff, upstream action metadata, and successful workflow checks.

Is this the best way to solve the issue?

Yes: the PR is the narrowest maintainable way to update the dependency, and the current workflows do not use the pull_request_target or workflow_run modes affected by checkout v7's new fork-checkout guard.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 94bbcd72fa6f.

Label changes

Label changes:

  • add P3: This is a low-risk GitHub Actions dependency maintenance PR with passing hosted checks and no product-code change.
  • add merge-risk: 🚨 automation: The diff changes checkout behavior in a manually dispatched self-hosted workflow that the PR status checks did not exercise.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot PR, so the contributor real-behavior proof gate does not apply; the successful workflow checks are supplemental validation.

Label justifications:

  • P3: This is a low-risk GitHub Actions dependency maintenance PR with passing hosted checks and no product-code change.
  • merge-risk: 🚨 automation: The diff changes checkout behavior in a manually dispatched self-hosted workflow that the PR status checks did not exercise.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot PR, so the contributor real-behavior proof gate does not apply; the successful workflow checks are supplemental validation.
Evidence reviewed

What I checked:

  • Repository policy read: AGENTS.md was read fully and its crawlkit validation/release guidance was considered while reviewing this workflow-only dependency update. (AGENTS.md:1, 94bbcd72fa6f)
  • Current main still uses checkout v6: Current main has five actions/checkout@v6 references across the workflow files, so the requested bump is not already implemented on main. (.github/workflows/ci.yml:15, 94bbcd72fa6f)
  • PR diff is narrow and complete: The branch changes only four workflow files, replacing all five checkout@v6 uses with checkout@v7. (.github/workflows/ci.yml:15, 3c44b35f72ad)
  • PR checks passed: GitHub reports CI test, windows-test, CodeQL analyze, and secret-scan checks as successful on the PR head. (3c44b35f72ad)
  • Upstream action contract checked: actions/checkout v7 action.yml still runs on node24 and adds allow-unsafe-pr-checkout defaulting false; the crawlkit workflows do not use pull_request_target or workflow_run triggers. (.github/workflows/ci.yml:3, 3c44b35f72ad)
  • Workflow provenance inspected: History shows the current workflow set was recently rewritten by steipete, while earlier CI, security scanning, and Crabbox workflow setup came from vincentkoc. (.github/workflows/ci.yml:15, 94bbcd72fa6f)

Likely related people:

  • steipete: Commit 94bbcd7 introduced the current workflow set and git blame points the present checkout references to that commit. (role: recent area contributor; confidence: high; commits: 94bbcd72fa6f; files: .github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/crabbox-hydrate.yml)
  • vincentkoc: Earlier history introduced the original CI/CodeQL workflows, verified secret scanning, Crabbox hydrate setup, and related workflow hardening. (role: automation feature owner; confidence: high; commits: 1489d1d83adb, ae16f4d2a0bd, 9bed7076b4b5; files: .github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/crabbox-hydrate.yml)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. labels Jun 19, 2026
@dependabot @steipete
build(deps): bump actions/checkout from 6 to 7
86692c5 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@steipete
steipete force-pushed the dependabot/github_actions/actions/checkout-7 branch from 3c44b35 to 86692c5 Compare June 19, 2026 08:03
@steipete
steipete merged commit 7ebd469 into main Jun 19, 2026
6 checks passed
@steipete
steipete deleted the dependabot/github_actions/actions/checkout-7 branch June 19, 2026 08:05
@steipete

steipete commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Landed as 7ebd469a3337c6e4ec8d1f4e1bad39e438d7af1e.

Proof: rebased onto current main; CI test and windows-test, CodeQL, and both secret scans passed. Autoreview found no actionable issues. Reviewed the checkout v7 fork-credential restriction; these workflows use ordinary push, pull_request, or workflow_dispatch triggers, so that breaking case does not apply.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete