chore(deps): update actions/checkout action to v7 - #11
Conversation
📝 WalkthroughWalkthroughTwo GitHub Actions workflow files bump the Changesactions/checkout v6 → v7
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 10: The actions/checkout@v7 action uses a mutable version tag which is
vulnerable to tag mutation attacks. Replace the `@v7` tag with a full commit SHA
(pinning to a specific, immutable version). Additionally, add a with clause to
the checkout action and set persist-credentials to false since this workflow
does not perform authenticated git operations and should not keep credentials in
the runner environment.
In @.github/workflows/tag-it.yml:
- Around line 17-19: The actions/checkout action on line 17 is using a tag
reference (`@v7`) instead of a pinned commit SHA, and the persist-credentials
setting is not configured. Replace the tag reference with a specific commit SHA
(following GitHub's security best practices for pinning actions) and add
persist-credentials: false to the with section of the actions/checkout
configuration. Ensure the existing fetch-depth: 0 setting is preserved.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7b9544fd-4314-421a-a3f4-566613d7d5b1
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/tag-it.yml
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/ci.yml | head -20Repository: wozniakpl/claude-chimes
Length of output: 599
🌐 Web query:
GitHub Actions actions/checkout v7 full commit SHA security best practices persist-credentials
💡 Result:
As of June 19, 2026, actions/checkout v7.0.0 has been released [1][2]. Regarding persist-credentials and security best practices: 1. Current Behavior: In recent versions (starting from v6), actions/checkout has improved credential security by storing credentials in a separate file under $RUNNER_TEMP rather than directly in.git/config [3][4]. This change helps prevent accidental leakage through processes that might read the repository's configuration [5]. 2. Best Practice: Despite improvements in how credentials are stored, the security best practice remains to set persist-credentials: false unless your workflow specifically requires performing authenticated git operations (e.g., git push or fetching from private submodules) [6][3]. Setting this to false prevents the GitHub Actions runner from configuring the local git environment with the repository's access token, thereby reducing the risk of unauthorized use if the workflow is compromised [6][7]. 3. Full Commit SHA: While not specific to the persist-credentials input, security best practice for any GitHub Action is to reference the full commit SHA of the action (e.g., actions/checkout@1044a6d) instead of a tag (like @v7) to ensure immutability and prevent supply chain attacks where a tag might be updated to point to malicious code [8][9]. In summary, for maximum security, use the full commit SHA for the action and explicitly set persist-credentials: false if authenticated git commands are not required in subsequent steps of your workflow [6][3].
Citations:
- 1: https://github.com/actions/checkout/releases
- 2: https://github.com/actions/checkout/releases/tag/v7.0.0
- 3: https://github.com/actions/checkout/?tab=readme-ov-file
- 4: https://github.com/actions/checkout
- 5: [security] Escalate concerning default
persist-credentials=trueplease actions/checkout#2312 - 6: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
- 7: Remove
persist-credentialsor change the default tofalseactions/checkout#485 - 8: getting ready for checkout v7 release actions/checkout#2464
- 9: actions/checkout@1044a6d
Pin checkout to full commit SHA and disable credential persistence.
Line 10 uses a mutable tag (@v7) which is vulnerable to tag mutation attacks and keeps credentials in the runner environment by default. Pin to a full commit SHA and set persist-credentials: false since this workflow doesn't perform authenticated git operations.
Suggested change
- - uses: actions/checkout@v7
+ - uses: actions/checkout@1044a6dea927916f2c38ba5aeffbc0a847b1221a
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v7 | |
| - uses: actions/checkout@1044a6dea927916f2c38ba5aeffbc0a847b1221a | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 10-10: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 10-10: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 10, The actions/checkout@v7 action uses a
mutable version tag which is vulnerable to tag mutation attacks. Replace the `@v7`
tag with a full commit SHA (pinning to a specific, immutable version).
Additionally, add a with clause to the checkout action and set
persist-credentials to false since this workflow does not perform authenticated
git operations and should not keep credentials in the runner environment.
Source: Linters/SAST tools
| - uses: actions/checkout@v7 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, find and examine the tag-it.yml workflow file
find . -name "tag-it.yml" -type fRepository: wozniakpl/claude-chimes
Length of output: 98
🏁 Script executed:
# List all workflow files to understand the context
find .github/workflows -name "*.yml" -o -name "*.yaml" 2>/dev/null | head -20Repository: wozniakpl/claude-chimes
Length of output: 121
🏁 Script executed:
# Check the current content of tag-it.yml around lines 17-19
if [ -f ".github/workflows/tag-it.yml" ]; then
echo "=== tag-it.yml content ===" && \
cat -n .github/workflows/tag-it.yml | sed -n '10,25p'
fiRepository: wozniakpl/claude-chimes
Length of output: 586
🏁 Script executed:
# Check the ci.yml workflow to see if it has the hardening applied
cat -n .github/workflows/ci.yml | grep -A 5 -B 5 "actions/checkout"Repository: wozniakpl/claude-chimes
Length of output: 352
🏁 Script executed:
# Verify actions/checkout v7 security best practices and the correct SHA
# First, check if there's any documentation or comments about this in the repo
rg "actions/checkout" -A 3 -B 1Repository: wozniakpl/claude-chimes
Length of output: 49
🏁 Script executed:
# Check if there's a lockfile or any pinned actions in the repo
find . -name "*lock*" -type f | grep -E "\.(json|yaml|yml)" | head -10Repository: wozniakpl/claude-chimes
Length of output: 84
🏁 Script executed:
# Search for any documentation about GitHub Actions pinning
rg "persist-credentials|actions/checkout" -t yml -t yamlRepository: wozniakpl/claude-chimes
Length of output: 95
🌐 Web query:
actions/checkout v7 latest commit SHA GitHub Actions security
💡 Result:
As of June 19, 2026, the latest release of actions/checkout is v7.0.0 [1][2]. The full-length commit SHA for this release is 1044a6dea927916f2c38ba5aeffbc0a847b1221a [3][4]. Security Context and Recommendations: 1. New Security Features in v7: actions/checkout v7 introduces significant security protections by default [5]. It now prevents the checkout of fork pull request code in pull_request_target and workflow_run events (when the latter is triggered by a pull_request* event) [5]. This is intended to mitigate "pwn request" vulnerabilities where malicious fork code is executed in a privileged context [5][6]. If your workflow legitimately requires checking out fork code under these conditions, you must explicitly opt in by adding the allow-unsafe-pr-checkout: true input [5][7]. 2. SHA Pinning: While v7 provides improved protections, GitHub consistently recommends pinning GitHub Actions to their full-length commit SHA to ensure immutability and protect against supply chain attacks [8][9][10]. Pinning prevents an action reference from being retargeted to malicious code if the action repository is compromised [8][11]. 3. Maintaining Pinning: You can continue to use Dependabot to manage updates while using SHA pinning [12][11]. By using a comment in your workflow file (e.g., uses: actions/checkout@1044a6dea927916f2c38ba5aeffbc0a847b1221a # v7.0.0), Dependabot can identify and propose updates to new SHA versions while maintaining the security benefits of the pin [12][11]. 4. Policy Enforcement: Many organizations now enforce SHA pinning via enterprise or organization-level policies [9][12]. Check if your environment has these policies enabled, as using tag-based references (like @v7) may cause workflow failures in such environments [12].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v7.0.0
- 2: https://github.com/actions/checkout/releases
- 3: getting ready for checkout v7 release actions/checkout#2464
- 4: actions/checkout@1044a6d
- 5: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/
- 6: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
- 7: https://github.com/actions/checkout
- 8: https://docs.github.com/en/actions/reference/security/secure-use
- 9: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 10: https://emmer.dev/blog/pin-your-github-actions-to-protect-against-mutability/
- 11: https://safeguard.sh/resources/blog/how-to-pin-github-actions-to-shas-correctly
- 12: https://www.romainlespinasse.dev/posts/github-actions-commit-sha-pinning/
Pin actions/checkout to a specific commit SHA and disable credential persistence.
Line 17 uses an unpinned tag (@v7) and persists credentials by default. Apply SHA pinning for supply chain attack protection and set persist-credentials: false to limit credential exposure while retaining fetch-depth: 0.
Suggested change
- - uses: actions/checkout@v7
+ - uses: actions/checkout@1044a6dea927916f2c38ba5aeffbc0a847b1221a # v7.0.0
with:
fetch-depth: 0
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/checkout@1044a6dea927916f2c38ba5aeffbc0a847b1221a # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 17-19: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/tag-it.yml around lines 17 - 19, The actions/checkout
action on line 17 is using a tag reference (`@v7`) instead of a pinned commit SHA,
and the persist-credentials setting is not configured. Replace the tag reference
with a specific commit SHA (following GitHub's security best practices for
pinning actions) and add persist-credentials: false to the with section of the
actions/checkout configuration. Ensure the existing fetch-depth: 0 setting is
preserved.
Source: Linters/SAST tools
2 participants
This PR contains the following updates:
v6→v7Release Notes
actions/checkout (actions/checkout)
v7.0.0Compare Source
v7Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
Summary by CodeRabbit