Repository navigation
chore(ci): bump actions/checkout from 5 to 7 - #1004
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
area: packaging-ci
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v5...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7
branch
from
October 18, 2026 09:58
a0e1f88 to
27c45c0
Compare
1 task done
cemililik
added a commit
that referenced
this pull request
Oct 18, 2026
…oy-pages 5 and pypi-publish 1.14.2 (#1015) ## Summary Five Dependabot GitHub Actions bumps (#1002, #1004, #1005, #1006, #1009) combined into one pull request so they cost one CI round instead of five (each merge makes the others "behind", and branch protection requires an up-to-date branch). Dependabot closes its own pull requests when the same change lands. The individual commits are merged unchanged. ## Review | Action | Change | Checked | |---|---|---| | `pypa/gh-action-pypi-publish` | `1.14.0` → `1.14.2` (SHA pin) | The new pin `dc37677b…` is the commit of tag `v1.14.2` (dereferenced the annotated tag; the old pin is `v1.14.0`'s). The release only updates the action's own dependency tree (Twine 7, pypi-attestations, sigstore): `action.yml` and `requirements/` change, nothing else | | `actions/checkout` | `v5` → `v7` | v6 stores credentials in a separate file; v7 blocks checking out fork PRs under `pull_request_target`/`workflow_run`. This repository uses neither trigger and no workflow pushes with the persisted credentials | | `actions/setup-python` | `v6` → `v7` | ESM migration, and the `pip-install` input is removed; no workflow passes it (`cache: pip` is unaffected) | | `actions/download-artifact` | `v5` → `v8` | Hash mismatches now fail by default and non-zip artifacts are no longer unzipped; our `dist` artifact is a zip uploaded by `upload-artifact@v5`, which `v8` reads | | `actions/deploy-pages` | `v4` → `v5` | Node 24 runtime and polling back-off only | ### Also in this pull request Every `actions/checkout` step now sets `persist-credentials: false` (11 steps in 5 workflows). CodeRabbit flagged it on the bumped lines; the default stores the workflow token in the git configuration of jobs that then run checked-out code, and no job pushes or fetches with it (the assign-on-comment workflow already did this). ### What CI proves, and what it does not This pull request's own CI exercises `checkout` and `setup-python` (`ci.yml`). The other three live in `publish.yml` and `site-deploy.yml`, which run only on a release tag or a push to `main`, so **they are untested until the next release**. All three fail closed: a broken download or deploy step stops before anything reaches PyPI or the site. If you want certainty first, merge everything except `download-artifact` and `pypi-publish` and try them on a release candidate tag. ## Type - [x] CI / dependency ## Testing - CI (lint, validate, tests on Python 3.10–3.13) on this branch; all workflow files parse; `check_ci_failure_masking` and the guard-wiring tests pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Summary by Sourcery Modernize the repository’s GitHub Actions and harden checkout credential handling across automated workflows. Enhancements: - Upgrade GitHub Actions used across CI, publishing, and deployment workflows to their current major versions. - Disable persisted checkout credentials across workflow jobs to reduce unnecessary token exposure. CI: - Update artifact download, PyPI publishing, and Pages deployment actions to newer releases. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Contributor
Author
|
Looks like actions/checkout is up-to-date now, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/github_actions/actions/checkout-7
branch
October 18, 2026 11:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 5 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)