Skip to content

build(deps): bump the github group across 1 directory with 3 updates #1313

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

build(deps): bump the github group across 1 directory with 3 updates #1313

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,14 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v6.0.2
- uses: actions/checkout@v7.0.1

- uses: actions/setup-node@v6.4.0
- uses: actions/setup-node@v7.0.0
with:
node-version: 20.x

- name: Cache Node.js modules
uses: actions/cache@v5
uses: actions/cache@v6
with:
path: '**/node_modules'
key: ${{ runner.OS }}-node-${{ hashFiles('**/yarn.lock') }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/npm-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,8 @@ jobs:
publish:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/setup-node@v6.4.0
- uses: actions/checkout@v7.0.1
- uses: actions/setup-node@v7.0.0
with:
node-version: '24'
registry-url: 'https://registry.npmjs.org'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/sync_kds_roadmap_statuses.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,10 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v6.0.2
uses: actions/checkout@v7.0.1

- name: Set up Node.js
uses: actions/setup-node@v6.4.0
uses: actions/setup-node@v7.0.0
with:
node-version: '20'

Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,13 @@ jobs:
if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/checkout@v7.0.1
- name: Use Node.js
uses: actions/setup-node@v6.4.0
uses: actions/setup-node@v7.0.0
with:
node-version: '20.x'
- name: Cache Node.js modules
uses: actions/cache@v5
uses: actions/cache@v6
with:
path: '**/node_modules'
key: ${{ runner.OS }}-node-${{ hashFiles('**/yarn.lock') }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/update_changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
steps:

- name: Checkout repository
uses: actions/checkout@v6.0.2
uses: actions/checkout@v7.0.1
with:
ref: ${{ github.event.pull_request.base.ref }}
fetch-depth: 0
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/update_project_items_on_release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,10 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v6.0.2
uses: actions/checkout@v7.0.1

- name: Set up Node.js
uses: actions/setup-node@v6.4.0
uses: actions/setup-node@v7.0.0
with:
node-version: '20'

Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/visual_tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,12 +42,12 @@ jobs:
steps:
- name: Checkout code from PR
if: github.event.pull_request.merged == false
uses: actions/checkout@v6.0.2
uses: actions/checkout@v7.0.1

@rtibblesbot rtibblesbot Aug 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

blocking: checkout v7 refuses this checkout. Event is pull_request_target (line 4), ref is the fork PR head SHA (line 47), and contributors work from forks — all three guard conditions in src/unsafe-pr-checkout-helper.ts hold, so the step throws and Percy never runs.

The existing mitigation for the pwn-request risk here is environment: percy_tests (lines 32–39) gating PERCY_TOKEN. If that's considered sufficient, opt back in explicitly:

        with:
          ref: ${{ github.event.pull_request.head.sha }}
          allow-unsafe-pr-checkout: true

See gh.io/securely-using-pull_request_target — the flag is a deliberate acknowledgement, so confirm the percy_tests environment has required reviewers configured first.

(The "Checkout code from target branch" step below is fine — base.ref is a branch name, so the guard returns early.)

with:
ref: ${{ github.event.pull_request.head.sha }}
- name: Checkout code from target branch
if: github.event.pull_request.merged == true
uses: actions/checkout@v6.0.2
uses: actions/checkout@v7.0.1
with:
ref: ${{ github.event.pull_request.base.ref }}
- name: Set PERCY_BRANCH to target branch
Expand All @@ -56,11 +56,11 @@ jobs:
# to be associated with the target branch
run: echo "PERCY_BRANCH=${{ github.event.pull_request.base.ref }}" >> $GITHUB_ENV
- name: Use Node.js
uses: actions/setup-node@v6.4.0
uses: actions/setup-node@v7.0.0
with:
node-version: '20.x'
- name: Cache Node.js modules
uses: actions/cache@v5
uses: actions/cache@v6
with:
path: '**/node_modules'
key: ${{ runner.OS }}-node-${{ hashFiles('**/yarn.lock') }}
Expand Down Expand Up @@ -91,7 +91,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code from PR
uses: actions/checkout@v6.0.2
uses: actions/checkout@v7.0.1

@rtibblesbot rtibblesbot Aug 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

blocking: Same v7 guard failure, and this one is the riskier of the two — no environment gate, and it runs github-script with secrets.GITHUB_TOKEN.

This job only needs ./.github/githubUtils.js (lines 103, 110); it never uses PR content. Drop the ref: so it checks out the base repo — isDefaultCheckout short-circuits before the assertion, and no opt-in flag is needed:

      - name: Checkout base repo for helper scripts
        uses: actions/checkout@v7.0.1

This is the pattern update_changelog.yml already uses.

with:
ref: ${{ github.event.pull_request.head.sha }}
- name: Define comment body
Expand Down
Loading