ci: bump actions/checkout to v7 and action-shellcheck to 2.0.0 - #11
Merged
Conversation
sathvikkumar-octo
approved these changes
Aug 19, 2026
Both were years stale because Dependabot for github-actions was removed in #8. actions/checkout v3 (v4 in tests.yml) -> v7; ludeeus/action-shellcheck 1.1.0 -> 2.0.0, which also clears the class of transient failure seen on 2026-08-12 where 1.1.0 could not fetch its shellcheck binary ("tar: Error is not recoverable"). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
NickJosevski
force-pushed
the
nj/bump-github-actions
branch
from
August 19, 2026 06:25
5ad13cd to
20b95de
Compare
NickJosevski
force-pushed
the
nj/bump-github-actions
branch
from
August 19, 2026 07:40
20b95de to
f7ff7b7
Compare
NickJosevski
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Dependabot for
github-actionswas removed in #8 during the 2022 malware-campaign investigation, so these pins have been frozen for years.actions/checkouttests.yml)ludeeus/action-shellcheckThe shellcheck bump also clears the class of failure seen on the 2026-08-12 nightly, where 1.1.0 couldn't fetch its shellcheck binary (
tar: Error is not recoverable).Scope
Pins only — 6+/6− across the three workflows. No behaviour change. Verified by CI passing on this branch, which exercises both bumped actions.
The third stale action,
google-github-actions/release-please-action(whose repo is archived), was originally in this PR and is now #16. It was split out because migrating it is not a pin bump — v4 removed thecommandinput and moved configuration into a config file — and it carries an ordering constraint around the release manifest. Keeping this PR to the safe half means it can merge whenever.🤖 Generated with Claude Code