chore(deps): update actions/checkout action to v7#78
Closed
renovate[bot] wants to merge 1 commit into
Closed
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
このPRはactions/checkoutをv4.3.1/v5.0.1からv7.0.0へアップデートするものです。
v7.0.0の主要な変更点として、pull_request_targetおよびworkflow_runトリガーでのフォークPRのチェックアウトがブロックされるようになりました。該当するワークフローがある場合は動作に影響する可能性があります。
また、v6.0.0でクレデンシャルの保存方法が変更されており（別ファイルへの保存）、persist-credentialsを使用しているワークフローでは挙動が変わる可能性があります。
全体的には、SHAピン留めによるセキュリティ管理が継続されており、適切なアップデートと判断できます。
| steps: | ||
| - name: Set up Git repository | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
security.ymlはpull_request_targetやworkflow_runトリガーを使用している可能性があります。v7.0.0ではこれらのトリガーでフォークPRのチェックアウトがブロックされる破壊的変更が導入されています。ワークフローのトリガー設定を確認し、フォークリポジトリからのPRを処理する場合に影響がないか検証してください。
toshi0806
added a commit
that referenced
this pull request
Jul 4, 2026
…6.3.0 (#84) Consolidates Renovate's individual major PRs #78 / #80 / #81 into one commit (they overlapped on elixir-ci.yml / html-validation.yml, so merging them individually kept blocking on the up-to-date-branch ruleset). All three are low-risk, categorically-stable actions: - actions/checkout v4.3.1 / v5.0.1 -> v7.0.0 - actions/setup-node v4.4.0 -> v6.4.0 - actions/setup-python v5.6.0 -> v6.3.0 github-script v9 (#79) already merged. cache v6 (#75) and codecov v7 are held for consumer-side validation before the v1 move. actionlint clean. Supersedes #78 / #80 / #81. Claude-Session: https://claude.ai/code/session_01JPuooHgsrboSEbfJsNf6iG Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Member
|
Superseded by #84 (consolidated into one commit to clear the up-to-date-branch ruleset). Closing. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.3.1→v7.0.0v5.0.1→v7.0.0Release Notes
actions/checkout (actions/checkout)
v7.0.0Compare Source
v7Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
v5Compare Source
Configuration
📅 Schedule: (in timezone Asia/Tokyo)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.