From 29411ca5285bc73978e0c7b054170a91733dd0bf Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 6 Sep 2026 04:15:31 +0000 Subject: [PATCH] chore(deps): update actions/checkout action to v7 --- .github/workflows/_checks.yml | 6 +++--- .github/workflows/ga-evidence.yml | 2 +- .github/workflows/public-repo-guard.yml | 2 +- .github/workflows/python-lint.yml | 2 +- .github/workflows/python-tests.yml | 2 +- .github/workflows/release-drift.yml | 2 +- .github/workflows/release.yml | 12 ++++++------ .github/workflows/smoke-install.yml | 2 +- 8 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/_checks.yml b/.github/workflows/_checks.yml index 9dd6ea6..2ed2ccc 100644 --- a/.github/workflows/_checks.yml +++ b/.github/workflows/_checks.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Secret scan (fail-closed, allowlist-aware) @@ -51,7 +51,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 @@ -111,7 +111,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: URL convention gate diff --git a/.github/workflows/ga-evidence.yml b/.github/workflows/ga-evidence.yml index 263bb39..678efbd 100644 --- a/.github/workflows/ga-evidence.yml +++ b/.github/workflows/ga-evidence.yml @@ -42,7 +42,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/public-repo-guard.yml b/.github/workflows/public-repo-guard.yml index 719718a..fab8ae5 100644 --- a/.github/workflows/public-repo-guard.yml +++ b/.github/workflows/public-repo-guard.yml @@ -42,7 +42,7 @@ jobs: name: Secrets + content policy runs-on: ubuntu-latest steps: - - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # gitleaks' GitHub Action requires a paid license for organizations; the CLI # itself is MIT-licensed and free. Pin the version AND verify the release diff --git a/.github/workflows/python-lint.yml b/.github/workflows/python-lint.yml index de4adb1..25ada74 100644 --- a/.github/workflows/python-lint.yml +++ b/.github/workflows/python-lint.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml index 41e8587..20126fc 100644 --- a/.github/workflows/python-tests.yml +++ b/.github/workflows/python-tests.yml @@ -37,7 +37,7 @@ jobs: matrix: python-version: ["3.9", "3.12", "3.13"] steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/release-drift.yml b/.github/workflows/release-drift.yml index 9201ffb..907c914 100644 --- a/.github/workflows/release-drift.yml +++ b/.github/workflows/release-drift.yml @@ -40,7 +40,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # need full tag history, not just the push's shallow clone persist-credentials: false diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cfa194a..309999f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -85,7 +85,7 @@ jobs: # checks out whatever triggered the run (the pushed tag, or the branch a # dispatch was run from) -- never the untrusted dispatch input -- and no # step here executes anything from that tree (metadata reads only). - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -146,7 +146,7 @@ jobs: outputs: version: ${{ steps.version.outputs.version }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.resolve-ref.outputs.sha }} persist-credentials: false @@ -161,7 +161,7 @@ jobs: # pinned to the tag's resolved (and ancestry-verified) sha above -- # only the tooling that INSPECTS that tree floats to main. - name: Check out release tooling from the workflow's own ref - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.sha }} sparse-checkout: scripts/release @@ -216,7 +216,7 @@ jobs: id-token: write contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.resolve-ref.outputs.sha }} persist-credentials: false @@ -226,7 +226,7 @@ jobs: # published, so a backfilled tag from before scripts/release/* existed # still finds the helper it needs. - name: Check out release tooling from the workflow's own ref - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.sha }} sparse-checkout: scripts/release @@ -268,7 +268,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.resolve-ref.outputs.sha }} persist-credentials: false diff --git a/.github/workflows/smoke-install.yml b/.github/workflows/smoke-install.yml index 24c10c5..cb721f7 100644 --- a/.github/workflows/smoke-install.yml +++ b/.github/workflows/smoke-install.yml @@ -30,7 +30,7 @@ jobs: matrix: python-version: ["3.9", "3.12", "3.13"] steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false