chore(deps): bump actions/checkout from 6 to 7 - #17
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
WalkthroughAll four GitHub Actions workflow files ( Changesactions/checkout v6 → v7 across all workflows
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 17: The checkout action on lines 17 and 39 uses the mutable tag `@v7`
instead of being pinned to a specific commit SHA, which creates a supply-chain
security risk. Replace both instances of `actions/checkout@v7` with
`actions/checkout@` followed by the full 40-character commit SHA for the v7
release. Additionally, add the `persist-credentials: false` parameter to both
checkout actions since they are read-only operations and do not require
credential persistence in the git config.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d3a0b5d2-c12b-4c24-9671-331d9a94ebb8
📒 Files selected for processing (4)
.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/govulncheck.yml.github/workflows/release.yml
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Checkout references in workflows:"
rg -n 'uses:\s*actions/checkout@' .github/workflows
echo
echo "persist-credentials settings in workflows:"
rg -n 'persist-credentials' .github/workflows || true
echo
echo "Resolving actions/checkout v7 tag via GitHub API..."
ref_json="$(curl -fsSL https://api.github.com/repos/actions/checkout/git/ref/tags/v7)"
obj_type="$(printf '%s' "$ref_json" | jq -r '.object.type')"
obj_url="$(printf '%s' "$ref_json" | jq -r '.object.url')"
if [[ "$obj_type" == "commit" ]]; then
sha="$(printf '%s' "$ref_json" | jq -r '.object.sha')"
else
tag_json="$(curl -fsSL "$obj_url")"
sha="$(printf '%s' "$tag_json" | jq -r '.object.sha')"
fi
echo "Resolved actions/checkout@v7 commit SHA: $sha"Repository: tphakala/go-autotask
Length of output: 668
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Try using git ls-remote to get the v7 tag commit SHA
echo "=== Attempting git ls-remote to resolve v7 commit SHA ==="
git ls-remote --tags https://github.com/actions/checkout | grep -E "refs/tags/v7\$|refs/tags/v7\^" || echo "Direct git ls-remote failed or tag not found"
echo
echo "=== Checking if checkout v7 is documented in GitHub releases ==="
# Alternative: Try to fetch from the web
curl -fsSL -I "https://github.com/actions/checkout/releases/tag/v7" 2>&1 | head -5 || echo "Could not fetch v7 release page"Repository: tphakala/go-autotask
Length of output: 604
🌐 Web query:
actions/checkout v7 commit SHA pinned version GitHub security best practices
💡 Result:
As of June 22, 2026, actions/checkout v7 is the latest release, introduced on June 18, 2026, to address "pwn request" vulnerabilities [1][2][3]. Security Best Practices for v7 and Pinning: 1. Mandatory Pinning: GitHub and industry security standards strongly recommend pinning all GitHub Actions, including actions/checkout, to a full-length commit SHA [4][5][6]. While tags like @v7 are convenient, they are mutable and can be changed by an attacker or through repository compromise [4][7][6]. Pinning to an immutable SHA ensures that your workflow runs only the exact, audited code you expect [4][7]. 2. Recommended Syntax: Use a full-length commit SHA followed by a comment that specifies the version tag for readability and automated dependency management [8][6]. Example: - uses: actions/checkout@<FULL_SHA> # v7.0.0 3. Automated Updates: Pinning to a SHA does not mean manual maintenance. Use automated tools like Dependabot or Renovate. These tools are designed to handle SHA pins, automatically creating pull requests to update the SHA while maintaining your pinning pattern [9][10][6]. 4. Understanding v7 "Safer" Defaults: A major security improvement in v7 is that it now refuses to check out fork pull request code by default when triggered by pull_request_target or workflow_run events [1][11][12]. This prevents common "pwn request" attacks where untrusted code is executed with privileged GITHUB_TOKEN permissions [1][11][3]. - If your workflow legitimately requires checking out fork code (e.g., for certain testing or reporting scenarios), you must explicitly opt-in by setting the input allow-unsafe-pr-checkout: true [1][11][12]. - Note: GitHub has announced that on July 16, 2026, this security enforcement will be backported to all supported major versions of actions/checkout [3][12]. Workflows using floating tags (e.g., @v4) will inherit this behavior automatically, while those pinned to specific SHAs or minor versions will require manual upgrades to benefit from these changes [12]. Summary of Recommendations: - Always pin to the full 40-character commit SHA [4][6]. - Pair the SHA with a version tag in a comment [8][6]. - Use Dependabot or similar tools to manage updates [10][6]. - Review your use of pull_request_target; if you are impacted by the new v7 blocking behavior, evaluate if you can adopt safer patterns before manually opting out [1][12].
Citations:
- 1: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/
- 2: https://github.com/actions/checkout/releases/tag/v7.0.0
- 3: https://undercodenews.com/githubs-new-security-wall-actions-checkout-v7-crushes-the-infamous-pwn-request-attack-threatening-ci-cd-pipelines/
- 4: https://docs.github.com/en/actions/reference/security/secure-use
- 5: https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md
- 6: https://secure-pipelines.com/ci-cd-security/github-actions-security-cheat-sheet/
- 7: https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide
- 8: https://www.jvt.me/posts/2026/04/24/github-actions-tagging/
- 9: chore(deps): update actions/checkout action to v7 seanb4t/engram#172
- 10: https://www.cncf.io/blog/2026/05/04/securing-github-actions-ci-dependencies-recipe-card/
- 11: https://github.com/actions/checkout/
- 12: https://healsecurity.com/github-actions-checkout-update-blocks-workflows-triggered-by-malicious-pull_request_target/
Pin checkout to immutable commit SHA and disable credential persistence.
Lines 17 and 39 use the mutable tag @v7 instead of a pinned commit SHA. GitHub's official security hardening guidance mandates pinning to the full 40-character commit SHA to prevent supply-chain compromise via tag rewriting. Additionally, set persist-credentials: false for read-only checkout operations to avoid unnecessary token retention in local git config.
Suggested patch
- - uses: actions/checkout@v7
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ with:
+ persist-credentials: falseApply the same fix to line 39.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v7 | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 17-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 17, The checkout action on lines 17 and 39
uses the mutable tag `@v7` instead of being pinned to a specific commit SHA,
which creates a supply-chain security risk. Replace both instances of
`actions/checkout@v7` with `actions/checkout@` followed by the full 40-character
commit SHA for the v7 release. Additionally, add the `persist-credentials:
false` parameter to both checkout actions since they are read-only operations
and do not require credential persistence in the git config.
Source: Linters/SAST tools
Bumps actions/checkout from 6 to 7.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit