Skip to content

chore(deps): update actions/checkout action to v7 - #92

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/actions-checkout-7.x
Open

chore(deps): update actions/checkout action to v7#92
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/actions-checkout-7.x

Conversation

@renovate

@renovate renovate Bot commented Aug 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
actions/checkout action major v4 → v7

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

v7.0.0

Compare Source

v6.1.0

Compare Source

v6.0.3

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

v5.1.0

Compare Source

v5.0.1

Compare Source

v5.0.0

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented Aug 29, 2026

Copy link
Copy Markdown
Contributor

Renovate PR Analysis

Update Summary

  • Dependency: actions/checkout
  • Version: v4 → v7
  • Type: major

Release Changes

  • Node 24 as default runtime
  • v7.0.0: Blocks checking out fork PRs for pull_request_target and workflow_run
  • v6.0.0: Persisted credentials to a separate file
  • Multiple dependency and ESLint updates

Breaking Changes

  • v7.0.0 blocks checking out fork PRs for pull_request_target and workflow_run events
  • Node 24 runtime requirement

Code Changes Required

None - current workflow uses checkout on push events (tags), not pull_request_target or workflow_run events.

Security Impact

The v7.0.0 fork PR blocking is a security enhancement to prevent code injection risks in certain event types.

Recommendation

Safe to merge — The breaking change (fork PR blocking) only affects pull_request_target and workflow_run events, which this repo's release workflow doesn't use (it triggers on tag push). GitHub-hosted runners support Node 24.

@github-actions

github-actions Bot commented Aug 29, 2026

Copy link
Copy Markdown
Contributor

Renovate PR Analysis

Update Summary

  • Dependency: actions/checkout
  • Version: v4 → v7
  • Type: major

Release Changes

  • Node 24 as default runtime (requires Actions Runner v2.327.1 or later)
  • Block checking out fork PR for pull_request_target and workflow_run
  • Improved SHA-256 repository support
  • Better tag handling with annotation preservation
  • Worktree support for persist-credentials includeIf
  • ESM module upgrade with dependency updates

Breaking Changes

  • Requires Actions Runner v2.327.1 or later for Node 24 support
  • Block checking out fork PRs when using pull_request_target or workflow_run events (security improvement)
  • Credentials now persisted to separate file (internal change, likely transparent to users)

Code Changes Required

  • Verify Actions Runner version meets v2.327.1+ requirement
  • If using pull_request_target or workflow_run events, review fork checkout behavior
  • No code changes expected for current usage pattern (basic checkout for release workflow)

Security Impact

  • Improved security by blocking fork PR checkouts in pull_request_target/workflow_run events
  • SHA-256 repository support for modern Git security
  • Credential handling improvements

Recommendation

Needs manual review — Major version bump across 3 versions (v4→v7) with Node 24 runtime requirement. Verify GitHub Actions Runner version compatibility before merging. This is a foundational action that affects the entire workflow infrastructure.

@github-actions

github-actions Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Renovate PR Analysis

Update Summary

  • Dependency: actions/checkout
  • Version: v4 → v7
  • Type: major

Release Changes

  • v5: Update to Node 24 runtime
  • v6: Persist creds to a separate file, add worktree support for persist-credentials includeIf
  • v6: Fix checkout init for SHA-256 repositories, fix tag handling
  • v7: Block checking out fork PR for pull_request_target and workflow_run
  • v7: Upgrade module to ESM, trim only ascii whitespace for branch, escape values passed to --unset
  • Bumped @actions/core, @actions/tool-cache, @actions/github, js-yaml, flatted, removed uuid

Breaking Changes

  • v5 requires Node 24 runtime
  • v7 blocks checking out fork PRs for pull_request_target and workflow_run events (security improvement)
  • v7 switches to ESM (no workflow impact)

Code Changes Required

  • Verify Actions Runner version is v2.327.1 or later
  • No workflow changes needed - action inputs remain backward compatible
  • Security improvement: fork PRs blocked for pull_request_target/workflow_run events (intentional behavior change)

Security Impact

  • Improved security: v7 blocks checking out fork PRs for pull_request_target and workflow_run events, preventing potential code execution attacks from untrusted forks
  • Dependency updates include security patches
  • SHA-256 repository support

Recommendation

Safe to merge — GitHub-hosted runners use latest versions by default. Self-hosted runners must be on v2.327.1 or later. The fork PR blocking in v7 is a security feature, not a breaking change for most workflows.

@github-actions

github-actions Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Renovate PR Analysis

Update Summary

  • Dependency: actions/checkout
  • Version: v4 → v7
  • Type: major

Release Changes

  • v7.0.1: Bumped internal dependencies (codeql-action v3→v4, setup-node v4→v6, docker actions), eslint 9, bug fixes (unsafe PR check skip, ASCII whitespace trim, --unset value escaping)
  • v7.0.0: Block checking out fork PR for pull_request_target and workflow_run (security improvement), upgraded to ESM, dependency updates
  • v6.1.0-v6.0.0: Worktree support for persist-credentials includeIf, tag handling fixes, SHA-256 repository support

Breaking Changes

  • None affecting our usage. The checkout action is used in standard checkout mode without pull_request_target or workflow_run triggers

Code Changes Required

  • None. Workflow uses only uses: actions/checkout@v4 which will change to @v7 automatically

Security Impact

  • v7.0.0 blocks checking out fork PRs for pull_request_target and workflow_run, which is a security hardening. This PR does not use those triggers, so no impact

Recommendation

Safe to merge — This is a standard GitHub Actions checkout update with no breaking changes for our usage. The workflow uses basic checkout without any deprecated or advanced features.

@github-actions

github-actions Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Renovate PR Analysis

Update Summary

  • Dependency: actions/checkout
  • Version: v4 → v7
  • Type: major

Release Changes

  • v7.0.1: Bump github/codeql-action, actions/setup-node, docker/build-push-action, docker/login-action, eslint 9, escape values passed to --unset
  • v7.0.0: Block checking out fork PR for pull_request_target and workflow_run, upgrade module to ESM
  • v6.1.0: Various improvements
  • v6.0.0: Persist creds to a separate file
  • v5.0.0: Update to node 24

Breaking Changes

  • Node 24 as default runtime requires Actions Runner v2.327.1 or later
  • Block checking out fork PRs for pull_request_target and workflow_run events
  • Upgrade module to ESM
  • Persist creds to a separate file

Code Changes Required

None - update action version in .github/workflows/release.yml lines 22 and 70

Security Impact

  • v7.0.0 blocks checking out fork PRs for pull_request_target/workflow_run events, which is a security hardening to prevent token compromise from malicious forks
  • This change improves security for repos using pull_request_target or workflow_run triggers
  • TinyRSVP uses this action for tag-triggered releases (not PR-triggered workflows), so the fork-blocking behavior does not affect this repo

Recommendation

Safe to merge — Critical security hardening for fork PR workflows (not applicable here), standard version bump with no code changes required.

@github-actions

github-actions Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Renovate PR Analysis

Update Summary

  • Dependency: actions/checkout
  • Version: v4 → v7
  • Type: major

Release Changes

  • Node 24 as default runtime (requires Actions Runner v2.327.1 or later)
  • v7.0.0: Block checking out fork PR for pull_request_target and workflow_run (security improvement)
  • v6.0.0: Persisted credentials to a separate file
  • v7.0.1: Bump internal dependencies (codeql-action v3→v4, setup-node v4→v6)

Breaking Changes

  • Requires Actions Runner v2.327.1 or later for Node 24 support
  • v7.0.0 blocks checking out fork PRs for pull_request_target and workflow_run events

Code Changes Required

  • Verify Actions Runner version is v2.327.1 or later
  • No workflow changes needed - action inputs remain backward compatible

Security Impact

  • Improved security: v7.0.0 blocks checking out fork PRs for pull_request_target and workflow_run events, preventing potential code execution attacks from untrusted forks
  • This change improves security for repos using pull_request_target or workflow_run triggers

Recommendation

Safe to merge — GitHub-hosted runners use latest versions by default. Self-hosted runners must be on v2.327.1 or later. The fork PR blocking in v7 is a security feature, not a breaking change for most workflows. TinyRSVP uses checkout on push events (tags), not pull_request_target or workflow_run events.

@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

Renovate PR Analysis

Update Summary

  • Dependency: actions/checkout
  • Version: v4 → v7
  • Type: major

Release Changes

  • Node 24 as default runtime (requires Actions Runner v2.327.1 or later)
  • Upgrade to ESM module format
  • v6: Persist creds to a separate file for better security
  • v7: Block checking out fork PR for pull_request_target and workflow_run (security hardening)
  • Multiple bug fixes: SHA-256 repository support, tag handling improvements, worktree support

Breaking Changes

None affecting our usage. The security change (blocking fork PR checkout) only affects workflows using pull_request_target or workflow_run triggers, which our release workflow does not use.

Code Changes Required

None. The workflow at .github/workflows/release.yml:22 and .github/workflows/release.yml:70 uses the action with standard inputs. The fetch-depth: 0 input in step 2 is still supported in v7.

Security Impact

  • Security hardening: v7 blocks checking out fork PRs for pull_request_target and workflow_run triggers, preventing potential code injection attacks
  • Our workflow uses push: tags: triggers, so this change does not affect our security posture
  • This is an infrastructure dependency (GitHub Actions) only used in CI/CD
  • Does not affect application runtime or user-facing security

Recommendation

Safe to merge — This is a GitHub Actions version update with security hardening that does not affect our workflow. GitHub-hosted runners already meet the Actions Runner v2.327.1+ requirement.

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Renovate PR Analysis

Update Summary

  • Dependency: actions/checkout
  • Version: v4 → v7
  • Type: major

Release Changes

  • Block checking out fork PRs for pull_request_target and workflow_run events (security hardening)
  • Upgraded module to ESM and updated dependencies
  • Bumped @actions/core, @actions/tool-cache
  • Removed uuid dependency
  • Updated js-yaml from 4.1.0 to 4.2.0
  • Enhanced error wording
  • Worktree support for persist-credentials includeIf (v6.0.1)
  • SHA-256 repository support (v6.0.3)
  • Tag handling improvements (v6.0.2)

Breaking Changes

  • Fork PR checkout blocking: When using pull_request_target or workflow_run events, the action now blocks checkout of fork PRs. This is a security hardening measure.
  • ESM switch: Internal refactoring, should not affect action usage

Code Changes Required

Review workflow event types: The workflow uses .github/workflows/release.yml:22 and .github/workflows/release.yml:70:

- name: Checkout
  uses: actions/checkout@v4

The workflow triggers on push: tags: only, not on pull_request_target or workflow_run events. Therefore, the fork PR checkout blocking does not affect this workflow.

Security Impact

Highly positive security hardening: This update adds protection against repository hijacking attacks by blocking fork PR checkouts in specific event types. This is a direct security improvement for workflows that use pull_request_target or workflow_run events.

Recommendation

Safe to merge — This is a major version update that includes important security hardening. While the fork PR checkout blocking could affect workflows using pull_request_target or workflow_run events, our release workflow only uses push: tags: events, so it's unaffected. The update also brings SHA-256 support, improved tag handling, and multiple dependency security fixes. No manual changes needed beyond merging.

@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Renovate PR Analysis

Update Summary

  • Dependency: actions/checkout
  • Version: v4 → v7
  • Type: major

Release Changes

Major version v5, v6, v7 and subsequent releases:

  • v5.0.0: Updated to Node 24 runtime
  • v6.0.0: Persist creds to a separate file (credential isolation)
  • v6.0.1-v6.0.3: Worktree support improvements, tag handling fixes
  • v6.1.0: Minor version update
  • v7.0.0: Block checking out fork PR for pull_request_target and workflow_run events
  • v7.0.1: ESLint 9, various dependency updates, skip unsafe PR checks for default inputs, trim ASCII whitespace for branch, escape values passed to --unset

Breaking Changes

Yes, major version with breaking changes:

  • All versions (v5, v6, v7) require Node 24 runtime (requires Actions Runner v2.327.1 or later)
  • v7.0.0: Blocks checking out fork PRs when using pull_request_target or workflow_run events (security hardening)

Code Changes Required

Check your GitHub Actions workflows for:

  1. Actions Runner version compatibility (ensure runners are v2.327.1+)
  2. If using pull_request_target or workflow_run events, be aware that fork PR checkout will be blocked in v7+
  3. Review credential handling changes (v6.0.0) if you rely on credential file location

Current usage: .github/workflows/*.yml files using actions/checkout@v4

Security Impact

Significant security improvements:

  • v7.0.0 blocks checking out fork PRs for pull_request_target and workflow_run events, preventing potential security vulnerabilities where fork PRs could inject malicious code
  • This is a hardening measure that follows security best practices

Recommendation

Needs manual review — Major version bump (v4 → v7) with security hardening in v7.0.0 (blocks fork PR checkout for certain events). Verify that:

  1. Your GitHub Actions Runner version is v2.327.1 or later
  2. Your workflows don't rely on checking out fork PRs via pull_request_target or workflow_run (if they do, this update will break them - which is intentional for security)
  3. Test all workflows after merging, especially those using pull_request_target or workflow_run triggers

Note: The v7.0.0 fork PR checkout block is a security hardening. If you intentionally rely on fork PR checkout for these events, you may need to redesign your workflow approach.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants