chore(deps): update actions/checkout action to v7 by renovate[bot] · Pull Request #14 · wave-av/wave-profiles

renovate · 2026-06-19T16:47:56Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v5.0.1` → `v7.0.1`
actions/checkout	action	major	`v6.0.3` → `v7.0.1`
actions/checkout	action	major	`v4.3.1` → `v7.0.1`

Release Notes

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.1.0`

Compare Source

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v6.0.2`

Compare Source

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

`v6.0.1`

Compare Source

Add worktree support for persist-credentials includeIf by @ericsciple in #2327

`v6.0.0`

Compare Source

Persist creds to a separate file by @ericsciple in #2286
Update README to include Node.js 24 support details and requirements by @salmanmkc in #2248

`v5.1.0`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2026-06-19T16:47:59Z

PR author is in the excluded authors list.

changeset-bot · 2026-06-19T16:48:00Z

⚠️ No Changeset found

Latest commit: d68d869

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

wave-bugbot · 2026-06-20T14:54:57Z

🌊 WAVE BugBot — 4 finding(s)

🔴 3 · 🟠 1

🔴 P0 .github/workflows/_checks.yml:23 CWE-862 — Unpinned action tag (@v1 vs commit SHA)
Using a fixed version of an action (e.g., @v4.3.1) instead of a specific commit SHA can lead to vulnerabilities if the action is updated in a way that introduce
🔴 P0 .github/workflows/governance-enforce.yml:23 CWE-862 — Unpinned action tag (@v1 vs commit SHA)
Using a fixed version of an action (e.g., @v4) instead of a specific commit SHA can lead to vulnerabilities if the action is updated in a way that introduces se
🔴 P0 .github/workflows/public-repo-guard.yml:45 CWE-862 — Unpinned action tag (@v1 vs commit SHA)
Using a fixed version of an action (e.g., @93cb6efe18208431cddfb8368fd83d5badbf9bfd) instead of a specific commit SHA can lead to vulnerabilities if the action
🟠 P1 .github/workflows/_checks.yml:23 CWE-426 — Unpinned search_path in SECURITY DEFINER function
The search_path is not pinned, which could allow an attacker to shadow your functions by creating objects in earlier schemas.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

cursor

Risk: low. Cursor Bugbot was not present on this PR; approving a narrow, SHA-pinned actions/checkout v7 bump across CI workflows only. No reviewers assigned.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

devin-ai-integration

Devin Review found 2 potential issues.

devin-ai-integration · 2026-08-14T16:35:30Z

    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1


🔍 Vendored reusable workflow now drifts from its upstream source of truth

_checks.yml documents itself as the executable half of wave-foundation and says the skill gate "mirrors wave-foundation/scripts/validate-skills.py; keep the two in sync" (.github/workflows/_checks.yml:3-6, .github/workflows/_checks.yml:48-50). Bumping the checkout pin only here means this copy no longer matches the upstream shared workflow. Worth confirming the same bump lands in wave-foundation (or that this file is intentionally a local fork) so future syncs don't silently revert the pin.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-14T16:35:31Z

    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1


🟨 Checkout in public-repo-guard leaves git credentials on disk (missing persist-credentials: false)

The updated checkout step in .github/workflows/public-repo-guard.yml:45 is the only checkout in the repo without with: persist-credentials: false; every other checkout (e.g. .github/workflows/_checks.yml:24-25, .github/workflows/governance-enforce.yml:28-30) sets it. Without it, the GITHUB_TOKEN is written into .git/config, so any subsequent step in the job (gitleaks download/extract, apt install, the vendored scripts/public-repo-guard/content-policy.sh) can read and reuse the token.

Was this helpful? React with 👍 or 👎 to provide feedback.

macroscopeapp · 2026-08-14T16:37:16Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a CI-only checkout action upgrade with no customer request-path changes, but it modifies security and governance workflows owned by another team. The public repository guard leaves the checkout token available to subsequent scanning steps, and that unresolved security concern requires human review.

Not approved because:

Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

No code changes detected at c781ced. Prior analysis still applies.

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

codeant-ai · 2026-08-24T03:24:41Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

codeant-ai · 2026-08-27T00:42:35Z