Skip to content

Bump actions/checkout from 4 to 5 #308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
kernelsam merged 3 commits into from
Nov 17, 2025
Merged

Bump actions/checkout from 4 to 5 #308

kernelsam merged 3 commits into from
Nov 17, 2025

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 13, 2025 •
edited by github-actions bot
Loading

Bumps actions/checkout from 4 to 5.

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

v4.2.2

What's Changed

Full Changelog: actions/checkout@v4.2.1...v4.2.2

v4.2.1

What's Changed

New Contributors

Full Changelog: actions/checkout@v4.2.0...v4.2.1

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

V5.0.0

V4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v4.1.4

v4.1.3

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Resolves #2238
Resolves #2226
Resolves actions/checkout#2226
Resolves actions/checkout#2238
Resolves actions/checkout#1971
Resolves actions/checkout#1977
Resolves actions/checkout#2043
Resolves actions/checkout#2044
Resolves actions/checkout#2194
Resolves actions/checkout#2224
Resolves actions/checkout#2236
Resolves actions/checkout#2237
Resolves actions/checkout#1941
Resolves actions/checkout#1946
Resolves actions/checkout#1924
Resolves actions/checkout#1919
Resolves actions/checkout#1180
Resolves actions/checkout#1777
Resolves actions/checkout#1872
Resolves actions/checkout#1739
Resolves actions/checkout#1697
Resolves actions/checkout#1774
Resolves actions/checkout#1776
Resolves actions/checkout#1732
Resolves actions/checkout#1703
Resolves actions/checkout#1694
Resolves actions/checkout#1696
Resolves actions/checkout#1695
Resolves actions/checkout#1707
Resolves actions/checkout#1692
Resolves actions/checkout#1688
Resolves actions/checkout#1693
Resolves actions/checkout#1643

@dependabot
Bump actions/checkout from 4 to 5
bf156a8 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 13, 2025
@dependabot dependabot bot requested a review from a team as a code owner November 13, 2025 11:04
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 13, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Nov 13, 2025

🤖 Claude PR Review

PR Review Results

This PR updates the GitHub Actions checkout action from v4 to v5. Here's the review against your checklist:

Code Quality

  • ✅ Code follows our style guide - The YAML syntax is correct and follows GitHub Actions conventions
  • ✅ No commented-out code - Clean, no commented code present
  • ✅ Meaningful variable names - N/A for this change (no new variables introduced)
  • ✅ DRY principle followed - N/A for this change (simple version bump)

Testing

  • ❌ Unit tests for new functions - No tests included, but this is a dependency version update
  • ❌ Integration tests for new endpoints - N/A (no new endpoints)
  • ❌ Edge cases covered - N/A for dependency update
  • ❌ Test coverage > 80% - N/A for workflow configuration change

Note: For a GitHub Actions dependency update like this, traditional unit/integration tests don't apply. The workflow itself should be tested by running it in a PR to verify compatibility.

Documentation

  • ❌ README updated if needed - No README update provided. Should document why v5 was chosen
  • ❌ API docs updated - N/A (no API changes)
  • ❌ Inline comments for complex logic - N/A (no complex logic added)
  • ❌ CHANGELOG.md updated - No CHANGELOG update found for this dependency bump

Recommendation: Add a brief note in CHANGELOG about the actions/checkout upgrade.

Security

  • ✅ No hardcoded credentials - All secrets properly referenced via ${{ secrets.* }}
  • ✅ Input validation implemented - N/A for this change
  • ✅ Proper error handling - Existing error handling maintained
  • ✅ No sensitive data in logs - No sensitive data exposed

Additional Observations

What changed: Simple version bump from actions/checkout@v4 to actions/checkout@v5

Why this matters: The actions/checkout v5 update likely includes:

  • Bug fixes and security patches
  • Potential performance improvements
  • Node.js runtime updates

Risks: Low risk change, but should verify:

  • That fetch-depth: 0 parameter remains compatible with v5
  • That the workflow runs successfully with the new version

Overall Assessment: ✅ This is a low-risk maintenance update that follows best practices for keeping dependencies current. The main gaps are documentation-related rather than code quality issues.

Automated review via Claude Code CLI

@github-actions
Copy link
Contributor

github-actions bot commented Nov 13, 2025

🤖 Claude PR Review

I'll review this PR against your team checklist.

PR Review: Update actions/checkout from v4 to v5

Code Quality

  • ✅ Code follows our style guide - YAML syntax is correct and follows GitHub Actions conventions
  • ✅ No commented-out code - Clean diff with no commented code
  • ✅ Meaningful variable names - N/A (dependency version bump only)
  • ✅ DRY principle followed - N/A (single line change)

Testing

  • ⚠️ Unit tests for new functions - N/A (infrastructure change, but workflow should be tested)
  • ⚠️ Integration tests for new endpoints - N/A (no endpoints involved)
  • ⚠️ Edge cases covered - Should verify the workflow runs successfully with v5
  • ⚠️ Test coverage > 80% - N/A (not applicable to workflow files)

Recommendation: The PR should include evidence that the workflow was tested (e.g., successful workflow run with the new version).

Documentation

  • ❌ README updated if needed - Not applicable but migration notes would be helpful
  • ❌ API docs updated - N/A (no API changes)
  • ❌ Inline comments for complex logic - N/A (simple version bump)
  • ❌ CHANGELOG.md updated - MISSING - This dependency update should be documented in CHANGELOG.md

Issue: The CHANGELOG.md should include an entry about updating to actions/checkout@v5.

Security

  • ✅ No hardcoded credentials - None added
  • ✅ Input validation implemented - N/A (GitHub Actions handles this)
  • ✅ Proper error handling - Inherits from the action itself
  • ✅ No sensitive data in logs - No changes affecting logging

Summary

Overall Assessment: ✅ Mostly acceptable with minor improvements needed

Critical Issues: None

Recommendations:

  1. Add CHANGELOG.md entry documenting the dependency update
  2. Verify compatibility - Ensure actions/checkout@v5 is compatible with fetch-depth: 0 parameter (it should be, but worth confirming)
  3. Test evidence - Link to a successful workflow run using v5 in the PR description

Breaking Changes: None expected - actions/checkout@v5 is backward compatible with v4

This is a straightforward dependency update that improves security and performance. The main gap is documentation in the CHANGELOG.

Automated review via Claude Code CLI

@docktermj docktermj self-assigned this Nov 13, 2025
@kernelsam kernelsam assigned kernelsam and unassigned docktermj Nov 13, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Nov 17, 2025

🤖 Claude Code Review

⚠️ No file changes detected - skipping code review.

This PR appears to contain only metadata changes (labels, description, etc.).

@kernelsam kernelsam merged commit 8ebc43a into main Nov 17, 2025
15 checks passed
@kernelsam kernelsam deleted the dependabot/github_actions/actions/checkout-5 branch November 17, 2025 23:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@kernelsam kernelsam

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@docktermj @kernelsam