Bump actions/checkout from 7.0.0 to 7.0.1#77
Conversation
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughUpdated the pinned ChangesCheckout action pin updates
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
a557601 to
bd59f34
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/codeql.yml (1)
24-24: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winSecurity Misconfiguration (CWE-522): Insufficiently Protected Credentials
Make checkout credential persistence explicit across the workflow cohort.
These jobs execute or scan checked-out repository content, yet none opts out of persisted checkout credentials. Add
persist-credentials: falseat each site unless a later step intentionally requires authenticated Git access; verify that Qodana is not running in a privileged pull-request context.
.github/workflows/codeql.yml#L24-L24: addwith: persist-credentials: false..github/workflows/lint.yml#L20-L20: addwith: persist-credentials: false..github/workflows/qodana.yml#L19-L22: add the input alongsiderefandfetch-depth..github/workflows/release-build.yml#L20-L20: addwith: persist-credentials: false..github/workflows/security.yml#L24-L24: addwith: persist-credentials: false..github/workflows/sonar.yml#L19-L21: add the input alongsidefetch-depth.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql.yml at line 24, Add persist-credentials: false to the actions/checkout step in .github/workflows/codeql.yml:24-24, .github/workflows/lint.yml:20-20, .github/workflows/release-build.yml:20-20, and .github/workflows/security.yml:24-24; add the same input alongside ref and fetch-depth in .github/workflows/qodana.yml:19-22 and alongside fetch-depth in .github/workflows/sonar.yml:19-21. Verify Qodana is not running in a privileged pull-request context.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 24: Synchronize the actions/checkout version annotations with the pinned
v7.0.1 SHA. Update the comments at .github/workflows/codeql.yml:24,
.github/workflows/lint.yml:20, .github/workflows/qodana.yml:19,
.github/workflows/release-build.yml:20, .github/workflows/security.yml:24, and
.github/workflows/sonar.yml:19 from v6.0.3 to v7.0.1 without changing the pinned
references.
---
Nitpick comments:
In @.github/workflows/codeql.yml:
- Line 24: Add persist-credentials: false to the actions/checkout step in
.github/workflows/codeql.yml:24-24, .github/workflows/lint.yml:20-20,
.github/workflows/release-build.yml:20-20, and
.github/workflows/security.yml:24-24; add the same input alongside ref and
fetch-depth in .github/workflows/qodana.yml:19-22 and alongside fetch-depth in
.github/workflows/sonar.yml:19-21. Verify Qodana is not running in a privileged
pull-request context.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2c381fe1-e781-4eca-aad6-a57adc3f8206
📒 Files selected for processing (6)
.github/workflows/codeql.yml.github/workflows/lint.yml.github/workflows/qodana.yml.github/workflows/release-build.yml.github/workflows/security.yml.github/workflows/sonar.yml
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3. | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v6.0.3. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Synchronize all checkout version annotations.
The pinned SHA is actions/checkout v7.0.1, but all six comments still say v6.0.3. Update each annotation to v7.0.1 so dependency audits remain accurate. (gitea.dev.zamar.aero)
.github/workflows/codeql.yml#L24-L24: change the annotation to v7.0.1..github/workflows/lint.yml#L20-L20: change the annotation to v7.0.1..github/workflows/qodana.yml#L19-L19: change the annotation to v7.0.1..github/workflows/release-build.yml#L20-L20: change the annotation to v7.0.1..github/workflows/security.yml#L24-L24: change the annotation to v7.0.1..github/workflows/sonar.yml#L19-L19: change the annotation to v7.0.1.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 23-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 6 files
.github/workflows/codeql.yml#L24-L24(this comment).github/workflows/lint.yml#L20-L20.github/workflows/qodana.yml#L19-L19.github/workflows/release-build.yml#L20-L20.github/workflows/security.yml#L24-L24.github/workflows/sonar.yml#L19-L19
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 24, Synchronize the actions/checkout
version annotations with the pinned v7.0.1 SHA. Update the comments at
.github/workflows/codeql.yml:24, .github/workflows/lint.yml:20,
.github/workflows/qodana.yml:19, .github/workflows/release-build.yml:20,
.github/workflows/security.yml:24, and .github/workflows/sonar.yml:19 from
v6.0.3 to v7.0.1 without changing the pinned references.
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
bd59f34 to
3825bab
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/qodana.yml:
- Around line 19-22: Disable checkout credential persistence in both workflows:
add persist-credentials: false to the existing with block for actions/checkout
in .github/workflows/qodana.yml (lines 19-22), and add a with block containing
the same setting to actions/checkout in .github/workflows/security.yml (line
24).
- Line 19: Update the checkout action version comments from v6.0.3 to v7.0.1 in
.github/workflows/qodana.yml:19, .github/workflows/security.yml:24,
.github/workflows/codeql.yml:24, .github/workflows/release-build.yml:20,
.github/workflows/sonar.yml:19, and .github/workflows/lint.yml:20; leave the
pinned SHA unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3f115eba-93fe-45fc-ae99-67dd4c9acc1e
📒 Files selected for processing (6)
.github/workflows/codeql.yml.github/workflows/lint.yml.github/workflows/qodana.yml.github/workflows/release-build.yml.github/workflows/security.yml.github/workflows/sonar.yml
🚧 Files skipped from review as they are similar to previous changes (4)
- .github/workflows/sonar.yml
- .github/workflows/release-build.yml
- .github/workflows/codeql.yml
- .github/workflows/lint.yml
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3. | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v6.0.3. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
set -euo pipefail
printf '\n## qodana.yml\n'
cat -n .github/workflows/qodana.yml | sed -n '1,80p'
printf '\n## security.yml\n'
cat -n .github/workflows/security.yml | sed -n '1,100p'
printf '\n## occurrences of checkout pin/comment\n'
rg -n "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1|v7\.0\.1|v6\.0\.3" .github/workflowsRepository: Insaner1980/dBcheck
Length of output: 4396
🌐 Web query:
actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 v6.0.3 v7.0.1
💡 Result:
The identifier 3d3c42e5aac5ba805825da76410c181273ba90b1 is the specific commit SHA for the v7.0.1 release of the actions/checkout GitHub Action [1][2][3]. v7.0.1 is a valid and released version of actions/checkout [3][4], published on July 20, 2026 [3]. It includes several bug fixes, such as skipping unsafe PR checks when the input is default, trimming ASCII whitespace for branches, and escaping values passed to --unset [3][5]. v6.0.3 is an earlier, distinct release in the v6.x series of the action [4][6], which preceded the major v7 release [4][7]. The v7.x series introduced significant changes, including migrating the action to ESM (ECMAScript Modules) to support newer @actions/* packages and adding a new allow-unsafe-pr-checkout input to mitigate security risks associated with pull_request_target workflows [7].
Citations:
- 1: https://github.com/actions/checkout/commit/
- 2: actions/checkout@9c091bb...3d3c42e
- 3: https://github.com/actions/checkout/releases/tag/v7.0.1
- 4: https://github.com/actions/checkout/releases
- 5: actions/checkout@v7.0.0...v7.0.1
- 6: actions/checkout@v6.0.3...v7.0.0
- 7: https://github.com/marketplace/actions/checkout
Update the checkout version comments to v7.0.1. The pinned SHA is v7.0.1, but the comment still says v6.0.3 in:
.github/workflows/qodana.yml:19.github/workflows/security.yml:24.github/workflows/codeql.yml:24.github/workflows/release-build.yml:20.github/workflows/sonar.yml:19.github/workflows/lint.yml:20
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 19-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 2 files
.github/workflows/qodana.yml#L19-L19(this comment).github/workflows/security.yml#L24-L24
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/qodana.yml at line 19, Update the checkout action version
comments from v6.0.3 to v7.0.1 in .github/workflows/qodana.yml:19,
.github/workflows/security.yml:24, .github/workflows/codeql.yml:24,
.github/workflows/release-build.yml:20, .github/workflows/sonar.yml:19, and
.github/workflows/lint.yml:20; leave the pinned SHA unchanged.
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v6.0.3. | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Sensitive Data Exposure (CWE-522): Insufficiently Protected Credentials
Reachability: External
Disable checkout credential persistence in both workflows.
.github/workflows/qodana.yml#L19-L22: addpersist-credentials: falseunderwith..github/workflows/security.yml#L24-L24: add awithblock containingpersist-credentials: false.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 19-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 2 files
.github/workflows/qodana.yml#L19-L22(this comment).github/workflows/security.yml#L24-L24
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/qodana.yml around lines 19 - 22, Disable checkout
credential persistence in both workflows: add persist-credentials: false to the
existing with block for actions/checkout in .github/workflows/qodana.yml (lines
19-22), and add a with block containing the same setting to actions/checkout in
.github/workflows/security.yml (line 24).
Source: Linters/SAST tools
|
Korvaava PR #87 päivitti kaikki checkout-pinnit versioon 7.0.1, korjasi versiokommentit ja asetti persist-credentials: false. Tämä PR on nyt kokonaan korvattu. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps actions/checkout from 7.0.0 to 7.0.1.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Summary by CodeRabbit