Update actions/checkout action to v7 by renovate[bot] · Pull Request #23 · https-quantumblockchainai-atlassian-net/ai-auto-train-eip-review-bot

renovate · 2026-06-20T11:56:50Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v4.1.7` → `v7.0.1`

Release Notes

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v7`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.1.0`

Compare Source

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v6.0.2`

Compare Source

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

`v6.0.1`

Compare Source

Add worktree support for persist-credentials includeIf by @ericsciple in #2327

`v6.0.0`

Compare Source

Persist creds to a separate file by @ericsciple in #2286
Update README to include Node.js 24 support details and requirements by @salmanmkc in #2248

`v6`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v5.1.0`

Compare Source

`v5.0.1`

Compare Source

Port v6 cleanup to v5 by @ericsciple in #2301

`v5.0.0`

Compare Source

Update actions checkout to use node 24 by @salmanmkc in #2226

`v5`

Compare Source

Port v6 cleanup to v5 by @ericsciple in #2301

`v4.4.0`

Compare Source

`v4.3.1`

Compare Source

Port v6 cleanup to v4 by @ericsciple in #2305

`v4.3.0`

Compare Source

docs: update README.md by @motss in #1971
Add internal repos for checking out multiple repositories by @mouismail in #1977
Documentation update - add recommended permissions to Readme by @benwells in #2043
Adjust positioning of user email note and permissions heading by @joshmgross in #2044
Update README.md by @nebuk89 in #2194
Update CODEOWNERS for actions by @TingluoHuang in #2224
Update package dependencies by @salmanmkc in #2236

`v4.2.2`

Compare Source

url-helper.ts now leverages well-known environment variables by @jww3 in #1941
Expand unit test coverage for isGhes by @jww3 in #1946

`v4.2.1`

Compare Source

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in #1924

`v4.2.0`

Compare Source

Add Ref and Commit outputs by @lucacome in #1180
Dependency updates by @dependabot- #1777, #1872

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

augmentcode · 2026-06-20T11:58:14Z

🤖 Augment PR Summary

Summary: Updates CI/build/code-scanning workflows to use actions/checkout v7.0.0 (still pinned to an exact commit SHA).
Why: Picks up the latest major release changes and upstream fixes/security improvements in the checkout action.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-06-20T11:58:15Z

    steps:
      - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0


actions/checkout@v7.0.0 now runs as a Node.js action with runs: using: node24; if this repo is executed on GHES/older runners that don’t support Node 24 actions yet, these workflows will start failing at checkout. Other locations where this applies: .github/workflows/ci.yml:15, .github/workflows/codeql-analysis.yml:43

Severity: medium

Other Locations

.github/workflows/ci.yml:15

.github/workflows/codeql-analysis.yml:43

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

entelligence-ai-pr-reviews · 2026-06-20T11:59:43Z

EntelligenceAI PR Summary

This PR bumps the actions/checkout GitHub Action to v7.0.1 across all workflow configurations.

Updated pinned commit hash from 692973e3d937129bcbf40652eb9f2f61becf3332 to 3d3c42e5aac5ba805825da76410c181273ba90b1
Applied to .github/workflows/build.yml, .github/workflows/ci.yml, and .github/workflows/codeql-analysis.yml
Reflects a major version bump (v4 → v7) for improved security, compatibility, and latest fixes

Confidence Score: 5/5 - Safe to Merge

Safe to merge — this PR performs a straightforward version bump of actions/checkout from v4 (pinned commit 692973e3d937129bcbf40652eb9f2f61becf3332) to v7.0.1 (pinned commit 3d3c42e5aac5ba805825da76410c181273ba90b1) across all three workflow files: build.yml, ci.yml, and codeql-analysis.yml. The change is mechanical and consistent, with no logic, configuration, or application code modified. Using a pinned commit hash for the new version maintains the existing security posture of the repository, and no review comments or heuristic issues were identified.

Key Findings:

The commit hash for v7.0.1 (3d3c42e5aac5ba805825da76410c181273ba90b1) is used as a pinned reference in all three workflow files, preserving the supply-chain security practice already established in this repository rather than relying on a mutable tag.
All three affected files (build.yml, ci.yml, codeql-analysis.yml) were reviewed and the change is applied uniformly — no workflow was left on the old v4 hash, eliminating any inconsistency risk.
No application logic, secrets handling, permissions blocks, or environment variables were touched; the diff is limited exclusively to the uses: actions/checkout@<hash> line in each workflow.

augmentcode Bot reviewed Jun 20, 2026

View reviewed changes

Update actions/checkout action to v7

3c83a0f

renovate Bot force-pushed the renovate/actions-checkout-7.x branch from cc18a74 to 3c83a0f Compare July 25, 2026 15:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update actions/checkout action to v7 - #23

Update actions/checkout action to v7#23
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/actions-checkout-7.x

renovate Bot commented Jun 20, 2026 •

edited

Loading

Uh oh!

augmentcode Bot commented Jun 20, 2026

Uh oh!

augmentcode Bot left a comment

Uh oh!

augmentcode Bot Jun 20, 2026 •

edited

Loading

Uh oh!

entelligence-ai-pr-reviews Bot commented Jun 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Configuration

Uh oh!

augmentcode Bot commented Jun 20, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

entelligence-ai-pr-reviews Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

EntelligenceAI PR Summary

Confidence Score: 5/5 - Safe to Merge

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jun 20, 2026 •

edited

Loading

augmentcode Bot Jun 20, 2026 •

edited

Loading

entelligence-ai-pr-reviews Bot commented Jun 20, 2026 •

edited

Loading