Merge pull request #2129 from samdoran/checkout-action-update

LCORE- Update checkout action to v7

Author: tisnik

.github/workflows/build_and_push_release.yaml

@@ -27,7 +27,7 @@ jobs:
           # qemu is required for arm64 builds
           sudo apt install -y buildah qemu-user-static
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # Fetch submodules (required for lightspeed-providers)
           submodules: 'recursive'

.github/workflows/e2e_tests.yaml

@@ -24,7 +24,7 @@ jobs:
       E2E_LLAMA_HOSTNAME: ${{ vars.E2E_LLAMA_HOSTNAME || 'llama-stack' }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # On PR_TARGET → the fork (or same repo) that opened the PR.
           # On push      → falls back to the current repository.
@@ -34,6 +34,11 @@ jobs:
           # On push      → the pushed commit that triggered the workflow.
           ref: ${{ github.event.pull_request.head.ref || github.sha }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 

.github/workflows/e2e_tests_lightspeed_evaluation.yaml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # On PR_TARGET → the fork (or same repo) that opened the PR.
           # On push      → falls back to the current repository.
@@ -30,6 +30,11 @@ jobs:
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Fetch submodules (required for lightspeed-providers)
           submodules: 'recursive'
 
@@ -47,7 +52,7 @@ jobs:
           git log --oneline -5
 
       - name: Checkout lightspeed-Evaluation
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: lightspeed-core/lightspeed-evaluation
           path: lightspeed-evaluation

.github/workflows/e2e_tests_providers.yaml

@@ -49,7 +49,7 @@ jobs:
       E2E_DEFAULT_PROVIDER_OVERRIDE: ${{ matrix.e2e_default_provider }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # On PR_TARGET → the fork (or same repo) that opened the PR.
           # On push      → falls back to the current repository.
@@ -59,6 +59,11 @@ jobs:
           # On push      → the pushed commit that triggered the workflow.
           ref: ${{ github.event.pull_request.head.ref || github.sha }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 

.github/workflows/e2e_tests_rhaiis.yaml

@@ -38,7 +38,7 @@ jobs:
       E2E_DEFAULT_PROVIDER_OVERRIDE: vllm
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # On PR_TARGET → the fork (or same repo) that opened the PR.
           # On push      → falls back to the current repository.
@@ -48,6 +48,11 @@ jobs:
           # On push      → the pushed commit that triggered the workflow.
           ref: ${{ github.event.pull_request.head.ref || github.sha }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 

.github/workflows/radon.yaml

@@ -12,7 +12,7 @@ jobs:
       pull-requests: read
     name: "radon"
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
       - uses: davidslusser/actions_python_radon@v1.0.0
         with:
           src: "src"