Repository navigation
Bump actions/checkout from 3.7.0 to 7.0.1 - #820
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 3.7.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v3.7.0...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
🚀 Quick Review App CommandsWelcome! Here are the commands you can use in this PR:
|
|
No description provided. |
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
justin808
left a comment
There was a problem hiding this comment.
🤖 Codex · OpenAI · UNKNOWN · UNKNOWN
Code Walkthrough
The repository now pins actions/checkout to the immutable commit for v7.0.1 in every affected workflow, keeping the existing checkout behavior and security options unchanged.
Purpose and behavior
This is a dependency-only workflow update. Every changed checkout step moves from the prior immutable v3 pin to the verified v7.0.1 commit. The workflows still run on ubuntu-latest, retain persist-credentials: false where configured, and do not change permissions or job behavior.
Validation
All exact-head hosted checks are green, including JavaScript, lint, RSpec, demo-fleet smoke, deployment, and automated review. The repository validation seam also completed on the exact head: 59 files inspected with no RuboCop offenses. Public feedback has no review threads or actionable findings.
Risk and rollback
The main compatibility requirement for checkout v7 is a runner supporting Node 24; the hosted runner reported version 2.337.0, above the documented minimum. Rollback is the single workflow-pin revert if an environment-specific runner incompatibility appears.
| Area | Result |
|---|---|
| Workflow pin | Official actions/checkout v7.0.1 commit |
| Exact-head CI | Green |
| Repository validation | Passed |
| Review threads | None |
Scope checked
Reviewed the complete workflow diff, immutable upstream tag mapping, runner compatibility, exact-head checks, and screened public feedback.
Walkthrough for commit e05497c97c21f78ec5e24a91f166975526bec87e. This is a COMMENT, not an approval.
|
No description provided. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
justin808
left a comment
There was a problem hiding this comment.
🤖 Codex · OpenAI · UNKNOWN · UNKNOWN
Code Walkthrough
This dependency-only update pins every affected actions/checkout use to the official immutable commit for v7.0.1. Existing workflow permissions, checkout options, and job behavior remain unchanged.
Refreshed-base validation
GitHub updated the branch onto current master, producing exact head 8981974966dacf09eb92464bb8d076b080102dd2. The repository validation seam passed at that SHA (59 files, no RuboCop offenses). JavaScript CI, lint CI, demo-fleet smoke, deployment, Claude review, and CodeRabbit are green. RSpec initially encountered a renderer-artifact race; its single failed-job rerun passed completely. The newly required smoke / Demo fleet smoke native protection check passed on this exact head.
Risk and rollback
Checkout v7 requires a runner supporting Node 24; GitHub-hosted execution completed successfully. The change is isolated to workflow action pins and can be rolled back by reverting the dependency commit.
| Area | Result |
|---|---|
| Workflow pin | Official actions/checkout v7.0.1 commit |
| Exact-head local validation | Passed |
| Required native check | Passed |
| Full hosted checks | Green after one RSpec rerun |
| Review threads | None before refresh |
Walkthrough for commit 8981974966dacf09eb92464bb8d076b080102dd2. This is a COMMENT, not an approval.
|
No description provided. |
✅ Review App DeletedReview app for PR #820 is deleted |
Bumps actions/checkout from 3.7.0 to 7.0.1.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)