chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 - #48
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.4.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@11d5960...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
gaochangw
left a comment
gaochangw
left a comment
There was a problem hiding this comment.
Reviewed head: fb33136
Verified the pinned commit matches the signed upstream v7.0.1 release and reviewed the v5–v7 migration notes. All nine calls use supported inputs. The protected-path job retains fetch-depth: 0. Workflows do not use the privileged fork-checkout patterns rejected by v7 or authenticated Git inside container actions. Hosted runners support Node 24 and the new credential storage. No actionable findings in this diff.
Validation: full PR CI passed, including Python 3.10–3.13 tests, default installations on Linux/macOS/Windows, frontend type/lint/unit/build/browser checks, distribution validation, and the documentation build. Workflow YAML, commit pinning, and updated action inputs were also checked locally.
Upstream reference: https://github.com/actions/checkout/releases/tag/v7.0.1
This is an automated code review recorded through the repository administrator account, not an independent human approval.
gaochangw
left a comment
gaochangw
left a comment
There was a problem hiding this comment.
Reviewed head: 8743ebd
Resolved the conflicts with the newly merged Python/uv action updates by retaining both the new checkout pin and all current-main action versions. Verified the resulting tree is exactly current main plus the nine checkout v7.0.1 pin replacements across five workflow files. No unrelated content was changed, and protected-path fetch-depth: 0 remains intact.
The upstream compatibility review in the previous comment still applies. YAML parsing, exact-tree comparison, and git diff --check passed. Fresh CI is running on this integration commit; merge remains contingent on passing checks.
This is an automated code review recorded through the repository administrator account, not an independent human approval.
1 participant
Bumps actions/checkout from 4.4.0 to 7.0.1.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)