chore(deps): update actions/checkout action to v7 - #32
Conversation
|
PR author is in the excluded authors list. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 |
There was a problem hiding this comment.
🔍 Major-version jump of checkout in templates — verify runner/Node requirements
Templates move from actions/checkout@v4/@v5 straight to a v7 digest. Major bumps of checkout historically changed the bundled Node runtime, which can break self-hosted or older runner images that consumers of these workflow templates may use. All templates here run on ubuntu-latest, so hosted runners are fine, but downstream repos copying these templates onto other runners should be checked. Worth confirming the digest actually corresponds to the v7.0.1 tag before merge, since a mispinned digest silently pins a different commit.
Was this helpful? React with 👍 or 👎 to provide feedback.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Risk: medium. Left a non-blocking comment — Cursor Security Agent completed as skipped, so this is not auto-approved. Human review is needed; @yakimoto is already requested and no additional reviewers were assigned.
Sent by Cursor Approval Agent: Pull Request Router and Approver
ApprovabilityVerdict: Needs human review Dependency update bumping No code changes detected at You can customize Macroscope's approvability policy. Learn more. |
4bda367 to
90a4801
Compare
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 |
There was a problem hiding this comment.
🔍 Template previously used a floating tag; now digest-pinned, which changes consumer update semantics
workflow-templates/moq-draft-drift.yml:26 moved from a floating actions/checkout@v5 to a full digest. That is consistent with helpers:pinGitHubActionDigests in renovate.json, but repos that copy this template and do NOT run Renovate will now be frozen on this exact commit with no automatic patch updates. Worth confirming the template consumers are all Renovate-managed.
Was this helpful? React with 👍 or 👎 to provide feedback.
This PR contains the following updates:
v4→v7v5.0.1→v7.0.1v5→v7Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
v5.1.0Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
v5Compare Source
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.