chore(deps)(deps): Bump actions/checkout from 4 to 7 - #550
chore(deps)(deps): Bump actions/checkout from 4 to 7#550dependabot[bot] wants to merge 1 commit into
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Combined the following PRs into one, to save CI runs and avoid the strict-mode rebase cascade: - #551 chore(deps)(deps): Bump actions/setup-python from 5 to 7 - #549 chore(deps)(deps): Bump the actions-minor-and-patch group with 3 updates - #548 chore(deps-dev)(deps-dev): Update gitpython requirement from >=3.1.59 to >=3.1.60 - #547 chore(deps)(deps): Update click requirement from <9.0,>=8.4.2 to >=8.5.0,<9.0 - #546 chore(deps)(deps): Bump the python-minor-and-patch group with 4 updates Skipped (resolve/merge these on their own): - #550 chore(deps)(deps): Bump actions/checkout from 4 to 7 — merge conflict _Opened by the Combine PRs workflow. Close the superseded PRs above once this merges._ --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
256b341 to
e95b8e7
Compare
Supersedes #550. Dependabot proposed `actions/checkout@v4` → `@v7` in `mutation.yml`. That is an improvement in version and a **regression in posture**: every other checkout in this repo is pinned to a full commit SHA, and merging it would have left two pinned to a movable tag. Whoever controls a tag controls what executes in CI, with the repository checked out and the job's secrets in scope — which is what SHA pinning exists to prevent, and which this repo already runs Scorecard over. Pinning them to the SHA the rest of the repo already uses gets the version bump **and** the consistency. ## A third straggler `setup-python@v7`, in the same file, was the last floating ref in the entire repository. It turned up only because fixing the two prompted a sweep for the whole set rather than the two the PR named. ``` before: actions/checkout@v4 ×2 actions/setup-python@v7 ×1 after: 0 floating refs across .github/workflows/ ``` ## The check is a test, not a script Deliberately. This repo has already learned twice that a checker wired to nothing is not a checker — two mutation groups were added to `scripts/mutation_groups.py` and never to the CI matrix, and `check_coverage_omissions.py` sat as a taskipy task nothing invoked. The weakest link in *detect* is the wiring, and `pytest tests/` runs in CI unconditionally, so a test has none to forget. `tests/test_workflow_actions_are_sha_pinned.py` asserts: 1. **no floating ref** anywhere in `.github/workflows/` (local `./` composite actions and `docker://` refs excluded, with the reasons in the file); 2. **one SHA per action across all workflows** — two SHAs for one action means a bump landed in some lanes and not others, leaving a stale version running wherever nobody looked; 3. a **guard-the-guard** check that the glob matched some workflows at all, since a glob matching nothing passes every assertion after it. Each of (1) and (2) was verified by its own plant. Worth noting: the first plant attempt silently did not land (wrong target string) and the suite stayed green — indistinguishable from a test that fails to catch. Re-planted against the real line before trusting either assertion. Co-authored-by: Mudwood Labs <opensource@mudwoodlabs.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Superseded by #562 (merged). Your bump was right about the version and would have regressed the pinning posture: #562 pins both lines to It also caught a third straggler the same sweep turned up: |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)