chore(deps): bump actions/checkout from 4 to 7#20
Conversation
dependabot
Bot
added
dependencies
![eitri-ccl[bot]](https://avatars.githubusercontent.com/u/290581045?s=60&v=4){kind=small}
There was a problem hiding this comment.
🛡️ Eitri — the forge's second smith
🔒 Security scan
Ran semgrep, trivy · scoped to changed files · 0 blocking, 0 total.
No security findings in the changed files. ✅
VERDICT: APPROVE
This is a straightforward, well-scoped dependency bump in a single CI workflow. actions/checkout@v7 is confirmed as the latest stable release (released June 18, 2026), and the security scan is clean. The surrounding workflow is a simple typecheck + build job triggered on push/PR — no pull_request_target or workflow_run triggers, so v7's notable security hardening (blocking fork checkout in those high-privilege contexts) is not a breaking concern here, only a bonus. No pinning inconsistency with the other actions in the file (both pnpm/action-setup and actions/setup-node are already on v4 majors, which is fine independently).
Findings
No blocking issues found.
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7
branch
from
f6106ca to
5ed3492
Compare
There was a problem hiding this comment.
🛡️ Eitri — the forge's second smith
🔒 Security scan
Ran semgrep, trivy · scoped to changed files · 6 blocking, 6 total.
Blocking — must fix:
- 🟠 HIGH [semgrep]
.github/workflows/ci.yml:13— github-actions-mutable-action-tag. GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. - 🟠 HIGH [semgrep]
.github/workflows/ci.yml:14— github-actions-mutable-action-tag. GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. - 🟠 HIGH [semgrep]
.github/workflows/ci.yml:15— github-actions-mutable-action-tag. GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. - 🟠 HIGH [semgrep]
.github/workflows/codeql.yml:24— github-actions-mutable-action-tag. GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. - 🟠 HIGH [semgrep]
.github/workflows/codeql.yml:25— github-actions-mutable-action-tag. GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608. - 🟠 HIGH [semgrep]
.github/workflows/codeql.yml:29— github-actions-mutable-action-tag. GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g.uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
The diff shows a straightforward bump of actions/checkout from v4 to v7. The security scan identified a critical issue: both workflow files use mutable tag references (@v7) instead of pinned commit SHAs. This is a supply-chain attack vector—the tag can be silently repointed by the action owner.
The PR itself technically upgrades to a newer version, but it does NOT address the underlying security requirement: all GitHub Actions must be pinned to their full 40-character commit SHA, not version tags.
VERDICT: REQUEST_CHANGES
This PR upgrades actions/checkout from v4 to v7 but leaves the critical security vulnerability unresolved: both .github/workflows/ci.yml:13 and .github/workflows/codeql.yml:24 use a mutable tag reference (@v7) instead of a pinned commit SHA. GitHub Actions are vulnerable to tag repointing attacks (as seen in trivy-action and kics-github-action compromises). The fix is required before merge.
Findings
.github/workflows/ci.yml:13—actions/checkout@v7uses a mutable tag. Replace with a pinned commit SHA, e.g.actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608(resolve the actual SHA for v7 from the actions/checkout releases page)..github/workflows/codeql.yml:24— Same issue:actions/checkout@v7must be pinned to a full 40-character commit SHA.
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)df4cb1cUpdate changelog for v6.0.3 (#2446)