chore(deps): update actions/checkout action to v7 by renovate[bot] · Pull Request #49 · wave-av/mcp-server

renovate · 2026-06-24T19:51:31Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v6.0.3` → `v7.0.1`
actions/checkout	action	major	`v4.3.1` → `v7.0.1`

Release Notes

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.1.0`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2026-06-24T19:51:35Z

PR author is in the excluded authors list.

changeset-bot · 2026-06-24T19:51:40Z

⚠️ No Changeset found

Latest commit: deb89c9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

wave-bugbot · 2026-06-24T23:40:30Z

🌊 WAVE BugBot — 6 finding(s)

🔴 4 · 🟠 2

🔴 P0 .github/workflows/_checks.yml:23 CWE-89 — Unpinned action tag (@v1)
The action tag uses @v1, which is an overbroad version specifier. This can lead to running a different version of the action than intended.
🔴 P0 .github/workflows/lint.yml:16 CWE-89 — Unpinned action tag (@v1)
The action tag uses @v1, which is an overbroad version specifier. This can lead to running a different version of the action than intended.
🔴 P0 .github/workflows/public-repo-guard.yml:45 CWE-89 — Unpinned action tag (@v1)
The action tag uses @v1, which is an overbroad version specifier. This can lead to running a different version of the action than intended.
🔴 P0 .github/workflows/publish.yml:14 CWE-89 — Unpinned action tag (@v4)
The action tag uses @v4, which is an overbroad version specifier. This can lead to running a different version of the action than intended.
🟠 P1 .github/workflows/_checks.yml:23 CWE-426 — Unpinned search_path in SECURITY DEFINER function
The search_path is not pinned, which could allow an attacker to shadow your functions with malicious ones.
🟠 P1 .github/workflows/public-repo-guard.yml:45 CWE-426 — Unpinned search_path in SECURITY DEFINER function
The search_path is not pinned, which could allow an attacker to shadow your functions with malicious ones.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

devin-ai-integration

Devin Review found 3 potential issues.

devin-ai-integration · 2026-08-01T23:14:41Z

    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1


🔍 _checks.yml is described as a shared/inherited workflow

The header comment says this reusable workflow is the single source of truth mirrored across WAVE repos ("update here, every repo inherits it (no copying = no drift)"). Bumping the pin only in this repo's vendored copy re-introduces drift with wave-av/wave-foundation/.github/workflows/checks.yml; consider updating upstream too.

Was this helpful? React with 👍 or 👎 to provide feedback.

macroscopeapp · 2026-08-13T01:28:57Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR repins actions/checkout across six core-team-owned CI, governance, and release workflows, with no application-code changes. Because it is a major action upgrade affecting release automation and shared workflow consistency, the pinned SHA and upstream synchronization should be verified by the workflow owners.

Not approved because:

Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

devin-ai-integration

Devin Review found 1 new potential issue.

devin-ai-integration · 2026-08-14T17:22:33Z

    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1


🟨 Checkout in the public-repo-guard job leaves the job's GitHub token persisted in the repo clone

The security gate's checkout step (.github/workflows/public-repo-guard.yml:45) omits with: persist-credentials: false, unlike every other checkout in the repo (.github/workflows/lint.yml:17-18, .github/workflows/release.yml:47-48). The credential is written into .git/config, so any script executed later in the job — including the vendored scripts/public-repo-guard/content-policy.sh, which runs on PR-controlled contents — can read and use the token.

Was this helpful? React with 👍 or 👎 to provide feedback.

codeant-ai · 2026-08-26T22:24:36Z