Bump actions/checkout from 6 to 7 - #4638
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughFour GitHub Actions workflow files — Changesactions/checkout v6 → v7 bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.github/workflows/base-image-auto-update.yml (1)
13-13: 🧹 Nitpick | 🔵 TrivialConsider pinning
actions/checkoutto a specific commit SHA for supply-chain integrity.Line 13 uses the mutable tag
@v7. While this isn't a documented requirement in this repository, pinning actions to immutable commit SHAs is a security best practice to prevent unintended changes from action updates.For
actions/checkout@v7, the current commit is:9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0If desired, update to:
- uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7Note: Other workflows in this repository also use mutable action tags, so this pattern may warrant a repository-wide review if supply-chain pinning becomes a requirement.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/base-image-auto-update.yml at line 13, Replace the mutable version tag `@v7` in the `actions/checkout` action with the specific immutable commit SHA to improve supply-chain integrity. Update the line containing `uses: actions/checkout@v7` to use the full commit hash `@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0` instead of the version tag to ensure the action version cannot be changed unexpectedly.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build.yml:
- Line 14: The `actions/checkout@v7` action is using a mutable version tag which
violates security policies. Replace the mutable v7 tag with the specific commit
SHA for v7.0.0 in the `uses` field of the checkout action to pin it to a known,
immutable version. This ensures the workflow always uses the exact version that
was tested and approved, preventing any unintended updates from newer versions
of the tag.
In @.github/workflows/codeql-analysis.yml:
- Line 37: The actions/checkout action on line 37 is currently pinned to a
mutable tag (`@v7`) which creates a security vulnerability. Replace the mutable
tag `@v7` with an immutable commit SHA reference for the actions/checkout action
to ensure the exact version is used and prevent potential supply-chain attacks.
You can find the correct commit SHA by checking the official actions/checkout
repository releases page.
In @.github/workflows/renovate-config-validator.yaml:
- Line 19: Replace the mutable version tag `@v7` in the `actions/checkout`
action with an immutable commit SHA. Change the `uses` line from
`actions/checkout@v7` to `actions/checkout@` followed by a specific commit hash
(for example, a commit SHA like `a5ac7e51b41094c153fa834410f7be9a60bd472b`).
This ensures the workflow always executes the exact verified code and prevents
supply chain vulnerabilities from tag mutation.
---
Nitpick comments:
In @.github/workflows/base-image-auto-update.yml:
- Line 13: Replace the mutable version tag `@v7` in the `actions/checkout`
action with the specific immutable commit SHA to improve supply-chain integrity.
Update the line containing `uses: actions/checkout@v7` to use the full commit
hash `@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0` instead of the version tag to
ensure the action version cannot be changed unexpectedly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 4674fcc8-6054-43a5-a2d1-66cbc7de43ef
📒 Files selected for processing (4)
.github/workflows/base-image-auto-update.yml.github/workflows/build.yml.github/workflows/codeql-analysis.yml.github/workflows/renovate-config-validator.yaml
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v6 | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/build.yml | head -30Repository: RedHatInsights/notifications-backend
Length of output: 1111
🏁 Script executed:
rg 'actions/checkout' .github/workflows/ -nRepository: RedHatInsights/notifications-backend
Length of output: 388
🌐 Web query:
actions/checkout v7 commit SHA GitHub releases
💡 Result:
The actions/checkout action reached version v7.0.0 on June 18, 2026 [1][2]. Regarding the commit SHA for v7.0.0: The pull request that prepared the repository for the v7 release (PR #2464) was merged on June 17, 2026, with the merge commit SHA 1044a6dea927916f2c38ba5aeffbc0a847b1221a [3][4]. This release finalized the migration to ESM and included various dependency updates [1][3]. While tags in GitHub Actions point to specific SHAs, it is standard practice to reference the action by the tag (e.g., uses: actions/checkout@v7) in your workflow files rather than a specific commit SHA [5][6][4]. Using the tag ensures that your workflow automatically receives non-breaking updates and security patches associated with that major version [1][3]. If you require pinning to a specific, immutable commit for strict compliance, you can use the commit SHA associated with the v7.0.0 tag in the GitHub repository's release section [1][2].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v7.0.0
- 2: https://github.com/actions/checkout/releases
- 3: getting ready for checkout v7 release actions/checkout#2464
- 4: actions/checkout@v6.0.3...v7.0.0
- 5: http://github.com/actions/checkout
- 6: https://github.com/actions/checkout/blob/main/README.md
🌐 Web query:
actions/checkout v7 tag exact commit hash GitHub
💡 Result:
The actions/checkout@v7 release was published on June 18, 2026 [1]. To pin this version to an exact commit hash in your GitHub Actions workflow, you can use the following syntax: - uses: actions/checkout@v7.0.0 with: ref: 9c091bb1c2333b2a2491a5477c77c15694272183 The commit hash 9c091bb1c2333b2a2491a5477c77c15694272183 corresponds to the v7.0.0 tag [2]. Using an exact commit hash is a recommended security practice for GitHub Actions to ensure your workflows remain immutable and are not affected by subsequent updates to a major version tag [3]. You can verify the latest commit hashes for any release by checking the official actions/checkout releases page on GitHub [2].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v7.0.0
- 2: https://github.com/actions/checkout/releases
- 3: https://github.com/actions/checkout/
🏁 Script executed:
# Let's also check if there's a renovate.json or similar dependency pinning config in the repo
find . -name "renovate.json" -o -name ".renovaterc" -o -name "renovate.json5" | head -5Repository: RedHatInsights/notifications-backend
Length of output: 96
🏁 Script executed:
cat ./renovate.jsonRepository: RedHatInsights/notifications-backend
Length of output: 352
Pin the checkout action to a specific commit SHA instead of using the mutable v7 tag.
Line 14 uses a mutable version tag which does not comply with pinned-action security policies. Pin this to the commit SHA for v7.0.0.
Suggested change
- uses: actions/checkout@v7
+ uses: actions/checkout@9c091bb1c2333b2a2491a5477c77c15694272183 # v7.0.0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/checkout@v7 | |
| uses: actions/checkout@9c091bb1c2333b2a2491a5477c77c15694272183 # v7.0.0 |
🧰 Tools
🪛 zizmor (1.25.2)
[error] 14-14: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build.yml at line 14, The `actions/checkout@v7` action is
using a mutable version tag which violates security policies. Replace the
mutable v7 tag with the specific commit SHA for v7.0.0 in the `uses` field of
the checkout action to pin it to a known, immutable version. This ensures the
workflow always uses the exact version that was tested and approved, preventing
any unintended updates from newer versions of the tag.
Source: Linters/SAST tools
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v6 | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Check if the workflow file exists and read its content
cat -n .github/workflows/codeql-analysis.yml 2>/dev/null | head -50Repository: RedHatInsights/notifications-backend
Length of output: 2139
🌐 Web query:
actions/checkout v7 release commit SHA github actions
💡 Result:
The actions/checkout v7.0.0 release was published on June 18, 2026 [1]. The commit SHA for the release preparation, which included the version bump to 7.0.0, is 1044a6dea927916f2c38ba5aeffbc0a847b1221a [2][3]. This release (v7.0.0) upgraded the module to ESM, updated various dependencies, and included changes to block checking out fork pull requests for certain workflow triggers [1]. Documentation and usage examples in the repository were updated to reference actions/checkout@v7 accordingly [3].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v7.0.0
- 2: actions/checkout@1044a6d
- 3: getting ready for checkout v7 release actions/checkout#2464
🏁 Script executed:
# Check all actions used in the workflow file to see consistency
grep -n "uses:" .github/workflows/codeql-analysis.ymlRepository: RedHatInsights/notifications-backend
Length of output: 370
Pin actions/checkout by commit SHA.
Line 37 currently references a mutable tag (@v7), which should be replaced with an immutable commit SHA to prevent supply-chain attacks.
Suggested change
- uses: actions/checkout@v7
+ uses: actions/checkout@1044a6dea927916f2c38ba5aeffbc0a847b1221a # v7.0.0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/checkout@v7 | |
| uses: actions/checkout@1044a6dea927916f2c38ba5aeffbc0a847b1221a # v7.0.0 |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 36-37: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 37-37: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql-analysis.yml at line 37, The actions/checkout
action on line 37 is currently pinned to a mutable tag (`@v7`) which creates a
security vulnerability. Replace the mutable tag `@v7` with an immutable commit SHA
reference for the actions/checkout action to ensure the exact version is used
and prevent potential supply-chain attacks. You can find the correct commit SHA
by checking the official actions/checkout repository releases page.
Source: Linters/SAST tools
| TEST_IMAGE: quay.io/konflux-ci/mintmaker-renovate-image:latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Check if the file exists and read its contents
if [ -f ".github/workflows/renovate-config-validator.yaml" ]; then
echo "=== File exists, showing contents: ==="
cat -n ".github/workflows/renovate-config-validator.yaml"
else
echo "File not found"
find .github -name "*.yaml" -o -name "*.yml" | head -20
fiRepository: RedHatInsights/notifications-backend
Length of output: 836
🏁 Script executed:
# Search for other checkout uses in workflows to understand repo's pinning practices
rg "actions/checkout" .github/workflows/ -A 2 -B 1Repository: RedHatInsights/notifications-backend
Length of output: 1161
🌐 Web query:
actions/checkout@v7 commit SHA pin security GitHub Actions
💡 Result:
As of June 22, 2026, actions/checkout v7.0.0 is the latest released version, published on June 18, 2026 [1][2]. Security best practices for GitHub Actions strongly recommend pinning to a full-length commit SHA rather than using tags (like @v7) to prevent supply chain attacks [3][4][5][6]. Tags are mutable, meaning an attacker who gains access to the repository could update a tag to point to malicious code, which would automatically affect all workflows using that tag [6][7]. A commit SHA is immutable, ensuring that your workflow consistently runs the exact, verified code you intended [4][5][6]. To secure your use of actions/checkout, you should: 1. Identify the full-length commit SHA for the specific version you wish to use by viewing the action's release or commit history on GitHub [3][4]. 2. Replace the tag in your workflow file with the SHA: - uses: actions/checkout@<FULL_COMMIT_SHA> # v7.0.0 3. Use a tool like Renovate (with the helpers:pinGitHubActionDigests preset) to automate updates to your pinned SHAs, balancing security with maintenance requirements [6][7]. Additionally, organization administrators can enforce this security posture by enabling the "Enforce SHA pinning" policy in their GitHub organization settings, which will cause any workflows using non-pinned actions to fail [8][6]. Note that actions/checkout v7 includes a new safety feature that refuses to check out fork pull request code by default in certain contexts (pull_request_target and workflow_run) to mitigate "pwn request" vulnerabilities [9].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v7.0.0
- 2: https://github.com/actions/checkout/releases
- 3: https://stackoverflow.com/questions/78903499/how-do-i-pin-an-action-to-a-specific-sha
- 4: https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide
- 5: https://docs.github.com/en/actions/reference/security/secure-use
- 6: https://architecture.lullabot.com/adr/20260505-pin-github-actions-to-hash/
- 7: https://emmer.dev/blog/pin-your-github-actions-to-protect-against-mutability/
- 8: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 9: actions/checkout@v6.0.3...v7.0.0
🏁 Script executed:
# Find the actual commit SHA for actions/checkout@v7
# Check if we can find it through git or from GitHub API
curl -s "https://api.github.com/repos/actions/checkout/git/refs/tags/v7" | jq -r '.object.sha' 2>/dev/null || echo "Could not fetch"Repository: RedHatInsights/notifications-backend
Length of output: 121
🌐 Web query:
actions/checkout v7 commit hash SHA
💡 Result:
The commit hash for the actions/checkout v7.0.0 release is 9c091bb5e3305a41549725f099c0d54a2b97c276 [1][2]. This release was published on 2026-06-18 [1].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v7.0.0
- 2: https://github.com/actions/checkout/releases
Replace mutable checkout tag with an immutable SHA pin.
Line 19 should pin actions/checkout to a specific commit hash instead of @v7. Tags are mutable and vulnerable to supply chain attacks; commit SHAs are immutable and ensure your workflow always runs the exact, verified code.
Suggested change
- - uses: actions/checkout@v7
+ - uses: actions/checkout@9c091bb5e3305a41549725f099c0d54a2b97c276 # v7📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v7 | |
| - uses: actions/checkout@9c091bb5e3305a41549725f099c0d54a2b97c276 # v7 |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 19-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/renovate-config-validator.yaml at line 19, Replace the
mutable version tag `@v7` in the `actions/checkout` action with an immutable
commit SHA. Change the `uses` line from `actions/checkout@v7` to
`actions/checkout@` followed by a specific commit hash (for example, a commit
SHA like `a5ac7e51b41094c153fa834410f7be9a60bd472b`). This ensures the workflow
always executes the exact verified code and prevents supply chain
vulnerabilities from tag mutation.
Source: Linters/SAST tools
1 participant
Bumps actions/checkout from 6 to 7.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit