chore(deps): update actions/checkout action to v7 - #215
Conversation
Deploying dev-blog with
|
| Latest commit: |
cf78a63
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://216b196e.dev-blog-10f.pages.dev |
| Branch Preview URL: | https://renovate-actions-checkout-7.dev-blog-10f.pages.dev |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Reviewed actions/checkout v4 → v7 in .github/workflows/visual.yml against the v5, v6, and v7 breaking changes. No workflow mitigation is required, and this PR should not add allow-unsafe-pr-checkout.
This is the only checkout in the repo. The Visual job uses a default checkout (no custom ref, repository, or token) on push to master and pull_request, running on GitHub-hosted ubuntu-latest.
| Version | Breaking change | Applies here? |
|---|---|---|
| v5 | Action runtime is Node 24; needs Actions Runner ≥ v2.327.1 | No. GitHub-hosted runners already meet this. CI on this PR used runner 2.335.1. |
| v6 | persist-credentials writes to $RUNNER_TEMP instead of .git/config. Docker container actions need runner ≥ v2.329.0. Git commands on the job still work without workflow edits. |
No. No container actions, no later authenticated git steps. |
| v7 | Refuses to check out fork PR code on pull_request_target / workflow_run unless allow-unsafe-pr-checkout: true. |
No. This workflow does not use those triggers, so the new default is a no-op. Leave the flag unset. |
v7 also migrates the action to ESM and bumps internal dependencies. That is an implementation change, not a consumer API change.
CI evidence: Visual snapshot tests succeeded with actions/checkout@v7 (resolved to 9c091bb). Logs show a normal pull_request merge-ref checkout with allow-unsafe-pr-checkout: false.
No follow-up commits are needed for this bump.
Sent by Cursor Automation: Dep review
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
Default actions/checkout@v7 is compatible with this job. The v7 fork-PR guard only fires on pull_request_target / workflow_run; this workflow uses push + pull_request, so do not add allow-unsafe-pr-checkout.
v5 (Node 24 runtime) and v6 (credentials under $RUNNER_TEMP) also do not require workflow changes here: GitHub-hosted ubuntu-latest, no Docker container actions, no later authenticated git steps. CI already passed with this pin.
1 participant
This PR contains the following updates:
v4→v7Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v6.1.0Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v5.1.0Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.