From 860ece3dea12726d8e10af68e2670e14edb36a7b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 12:04:43 +0000 Subject: [PATCH] Bump actions/checkout from 5.1.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 5.1.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 6 +++--- .github/workflows/lint.yml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2c7c3f7..0a386b2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,7 +33,7 @@ jobs: # pushed in the 2026 supply-chain attack, and tj-actions spread the same # way. Dependabot's github-actions ecosystem bumps the SHA and keeps the # version comment current. - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # No job in this workflow pushes, so the token has no business # outliving the checkout step. Without this, checkout writes the @@ -76,7 +76,7 @@ jobs: # pushed in the 2026 supply-chain attack, and tj-actions spread the same # way. Dependabot's github-actions ecosystem bumps the SHA and keeps the # version comment current. - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # No job in this workflow pushes, so the token has no business # outliving the checkout step. Without this, checkout writes the @@ -182,7 +182,7 @@ jobs: # pushed in the 2026 supply-chain attack, and tj-actions spread the same # way. Dependabot's github-actions ecosystem bumps the SHA and keeps the # version comment current. - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # No job in this workflow pushes, so the token has no business # outliving the checkout step. Without this, checkout writes the diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index f0d5811..1a5a563 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -17,7 +17,7 @@ jobs: # Pinned to the commit, not the tag -- a moved tag is how the tj-actions # and trivy-action supply-chain attacks spread. Dependabot's # github-actions ecosystem bumps the SHA and keeps the comment current. - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # No job in this workflow pushes, so the token has no business # outliving the checkout step. Without this, checkout writes the @@ -54,7 +54,7 @@ jobs: # Pinned to the commit, not the tag -- a moved tag is how the tj-actions # and trivy-action supply-chain attacks spread. Dependabot's # github-actions ecosystem bumps the SHA and keeps the comment current. - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # No job in this workflow pushes, so the token has no business # outliving the checkout step. Without this, checkout writes the