Bump actions/checkout from 6 to 6.0.2#368
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v6.0.2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Changed
🤖 Cursor Dependency AnalysisSupply-Chain Malware ReviewReviewing the PR diff and upstream changes for supply-chain risk. Summary: This is a normal Dependabot pin from floating Checklist (concise)
Upstream changes (v6.0.1 → v6.0.2): Tag-handling fix ( Scanner vs interpretation: The resolved range Repo usage: Workflows use plain checkout (e.g. Recommendation: Safe to merge from a supply-chain perspective. Optional: pin Compatibility AnalysisReviewing how Compatibility & adoption analysis —
|
| Workflow | Uses | Notable inputs |
|---|---|---|
build.yml |
4 | fetch-depth: 0 |
rust.yml |
4 | defaults |
build-packages.yml |
3 | secondary repo checkout (Chia-Network/mpir_gc_x64, path) |
build-c-libraries.yml |
2 | fetch-depth: 0/1, secondary repo checkout |
build-riscv64.yml |
2 | fetch-depth: 0 |
dependency-cursor-review.yml |
2 | ref (PR head SHA), path, fetch-depth: 0, persist-credentials: false |
check-commit-signing.yml |
1 | fetch-depth: 0 |
codeql-analysis.yml |
1 | fetch-depth: 0 |
dependency-review.yml |
1 | defaults |
Not used anywhere: fetch-tags, submodules, lfs, sparse-checkout, custom token, or post-checkout git tag/git fetch steps.
This PR also pins the version from the floating @v6 tag to explicit @v6.0.2.
2) Intersection with v6.0.1 / v6.0.2 changes
| Upstream change | Relevant to chiavdf? |
|---|---|
v6.0.2 — tag handling / fetch-tags fix |
No — fetch-tags not used; no tag-fetch logic in workflows |
v6.0.2 — orchestration_id in git user-agent |
No — only when ACTIONS_ORCHESTRATION_ID is set (GitHub-internal orchestration) |
v6.0.1 — worktree support for persist-credentials includeIf |
Low — persist-credentials: false is set in 2 jobs; no git worktree usage observed |
All other usage is standard repo checkout (fetch-depth, path, ref, secondary repos). No changed inputs or outputs are relied on in a way that should break.
3) Risks / unknowns
- Very low functional risk — patch release within v6; you were already on the v6 major line (Node 24 runtime, v6 credential behavior).
- Pinning tradeoff —
@v6.0.2is more reproducible than@v6, but won’t auto-pick up future patches (e.g. v6.0.3 SHA-256 fixes) until the next Dependabot bump. Acceptable for CI actions. - No build/test surface — failure mode is limited to workflow checkout steps; existing CI on the PR is the right validation.
- Malware scan “maintainer_drift” for
6→6.0.2is expected version metadata noise for an official GitHub action, not a supply-chain signal.
4) Recommendation: merge
Safe, low-impact patch pin with upstream bug fixes. No usage patterns intersect the changed behavior in a way that suggests regression risk. Merge once CI checks on PR #368 are green.
Malware Scan Summary
- Status: warn
- Warn only mode:
true - Changed upstream files scanned:
11 - Resolution strategy:
tag_range - Changed node/vendor paths:
0 - Changed lockfiles:
0 - Resolved upstream range:
df4cb1c069e1874edd31b4311f1884172cec0e10..de0fac2e4500dabe0009e67214ff5f5447ce83dd - Resolved refs: from=
df4cb1c069e1874edd31b4311f1884172cec0e10to=de0fac2e4500dabe0009e67214ff5f5447ce83dd - Unicode findings (post-allowlist):
0 - Confusable findings (post-allowlist):
0 - IOC findings (post-allowlist):
0 - Heuristic findings (post-allowlist):
124
Top findings
dist/index.js:4365codepoint_decoder ::bytes.push(str.charCodeAt(i));dist/index.js:8273codepoint_decoder ::return "%" + c.charCodeAt(0).toString(16).toUpperCase();dist/index.js:19430codepoint_decoder ::const charCode = attributeValue.charCodeAt(0)dist/index.js:19582codepoint_decoder ::const code = char.charCodeAt(0)dist/index.js:19605codepoint_decoder ::const code = char.charCodeAt(0)dist/index.js:19642codepoint_decoder ::const code = char.charCodeAt(0)dist/index.js:19663codepoint_decoder ::const code = char.charCodeAt(0)dist/index.js:22961codepoint_decoder ::bytes[byte] = binary.charCodeAt(byte)dist/index.js:23870codepoint_decoder ::while (j > i && isHTTPWhiteSpaceCharCode(potentialValue.charCodeAt(j - 1))) --jdist/index.js:23871codepoint_decoder ::while (j > i && isHTTPWhiteSpaceCharCode(potentialValue.charCodeAt(i))) ++idist/index.js:28235codepoint_decoder ::const c = statusText.charCodeAt(i)dist/index.js:28290codepoint_decoder ::if (!isTokenCharCode(characters.charCodeAt(i))) {dist/index.js:29159codepoint_decoder ::assert(input.charCodeAt(i) <= 0xFF)dist/index.js:29723codepoint_decoder ::if (x.charCodeAt(index) > 255) {dist/index.js:29726codepoint_decoder ::index ${index} has a value of ${x.charCodeAt(index)} which is greater than 255.dist/index.js:31976codepoint_decoder ::for (let i = 'A'.charCodeAt(0); i <= 'Z'.charCodeAt(0); i++) {dist/index.js:35166codepoint_decoder ::const code = char.charCodeAt(0)dist/index.js:36416codepoint_decoder ::bytes.push(str.charCodeAt(i));dist/index.js:38112codepoint_decoder ::if (!HEX[str.charCodeAt(i)]) {dist/index.js:38154codepoint_decoder ::switch (path.charCodeAt(i)) {
Bumps actions/checkout from 6 to 6.0.2.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
6d193bfBump braces from 3.0.2 to 3.0.3 (#1777)db0cee9Bump the minor-npm-dependencies group across 1 directory with 4 updates (#1872)b684943Add Ref and Commit outputs (#1180)2d7d9f7Provide explanation for where user email came from (#1869)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Workflow-only dependency pin with no application or build script changes; minor risk is CI checkout/tag behavior differing from the previous floating v6 ref.
Overview
Pins
actions/checkoutfrom the floating@v6tag to@v6.0.2across all GitHub Actions workflows that check out code (build, packages, riscv64, rust, CodeQL, dependency review, commit signing, and dependency Cursor review).Secondary checkouts (e.g.
Chia-Network/mpir_gc_x64and upstream repos in the dependency review job) use the same pinned version. No workflow logic, triggers, or step inputs change—only the action reference for reproducible CI checkouts and upstream v6.0.2 fixes (tag handling, optional orchestration user-agent).Reviewed by Cursor Bugbot for commit bd61cbf. Bugbot is set up for automated code reviews on this repo. Configure here.