chore(deps): bump actions/checkout from 4 to 7 - #22
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
srpatcha
left a comment
srpatcha
left a comment
There was a problem hiding this comment.
Review — eBrowser#22 "chore(deps): bump actions/checkout from 4 to 7"
head: 026d4ae author: app/dependabot ci: none ran
Verdict: The bump is a clean tag substitution across 14 workflow files and is
compatible with everything this repo does. But no build or test check has run on it,
and I found the exact reason — the PR's base predates the commit that made CI trigger on
master-targeted PRs. Rebase and it will be verifiable.
Findings
| # | Severity | File:line | Finding | Recommended fix |
|---|---|---|---|---|
| 1 | High | .github/workflows/ci.yml:8 (at base b21abf9c) |
No CI ran on this PR. gh pr checks 22 returns one entry — assign skipping. Root cause, verified: at the PR's base commit b21abf9c, ci.yml's trigger was pull_request: branches: [main], but this PR targets master, so the workflow never matched. master has since been fixed by #20 (bb37c5b, merged 2026-09-01) to branches: [master, main]; the PR is 4 commits behind. A PR that rewrites actions/checkout in every workflow in the repo currently has zero verification behind it. |
Rebase onto origin/master. CI will then trigger and actually exercise the change. Do not merge before that. |
| 2 | High | repo setting: branches/master/protection |
GET /repos/embeddedos-org/eBrowser/branches/master/protection returns required_status_checks: null. Protection requires reviews but requires no passing check, so finding 1 does not block a merge — this PR can land with no check having run at all. CI — eBrowser is also currently failure on master (most recent push run), which likewise blocks nothing. |
Set required status checks on master (Test (Python 3.11) at minimum) with strict: true, so a stale base cannot silently mean "no checks". |
| 3 | Low | all 14 workflow files | Mutable major tag (@v4 → @v7) rather than a SHA pin, while .github/workflows/scorecard.yml runs OpenSSF Scorecard and .github/STANDARDS.md:62 claims it org-wide; Scorecard's Pinned-Dependencies check scores unpinned references. Pre-existing, but this diff touches every uses: line already. |
Pin actions/checkout@<sha> # v7.0.1, or record in STANDARDS.md that tag references are the accepted org position. |
| 4 | Low | (repo-wide) | .github/dependabot.yml is absent from master — Dependabot was disabled org-wide (eDB's eaf4e1c: "config removed here, and alerts plus automated security fixes turned off via the API. 90 open Dependabot PRs"). This PR is an orphan: nothing will rebase it, nothing will supersede it, and closing it will not cause the bump to be re-proposed. The bot's comment about a missing github-actions label is moot. |
Merge it after a rebase, or close it and record actions/checkout@v7 as a manual to-do. |
Compatibility check on the bump itself
v4 → v7 skips two majors. Checked against this repo's workflows:
- v5.0.0 — node24; requires Actions runner ≥
v2.327.1.
grep -rn "self-hosted" .github/workflows/returns nothing; all jobs are GitHub-hosted
(ubuntu-22.04,macos-13,windows-2022,ubuntu-latest), so the floor is met. - v6.0.0 — persists credentials to a separate file rather than git config.
- v7.0.0 — blocks checking out a fork PR under
pull_request_target/workflow_run.
grep -rn "pull_request_target\|workflow_run" .github/workflows/returns nothing.
actions/checkout@v7.0.1 exists (published 2026-07-20). The diff across all 14 files is
exactly two distinct changed strings, - uses: actions/checkout@v4 /
+ uses: actions/checkout@v7, with no other edits.
Architecture conformance
Not applicable in the layering sense — .github/workflows/ only; no #include, import,
link line or manifest dependency, so §5.1 cannot be violated. eBrowser is Tier 5
(Applications) per §21, and §20.1 is explicit that it is "a reference or advanced
application proving platform capability, not a peer pillar of the kernel" — nothing here
changes that. §21.1 untouched.
Proposed changes
- Rebase onto current
mastersoci.yml'spull_request: branches: [master, main]
trigger applies (finding 1). - Configure required status checks on
master(finding 2) — this is the control that
would have caught finding 1 automatically. - Merge once
Test (Python 3.10/3.11/3.12)is green on the rebased head. - Optionally pin to SHAs in the same commit (finding 3).
Findings 1–3 apply identically to eBrowser#21 and #23; they share the base commit.
Not checked
- Whether the bump works. No job has run on this head. The compatibility assessment
above comes from the upstream release notes plus greps of the workflow files, not from
a green run — treat it as reasoning, not evidence. - Whether
masterwould be green after a rebase. The most recentCI — eBrowser
push run onmasterconcludedfailure; I did not read its log, so I do not know
whether a rebased run would fail for reasons unrelated to this bump. - The 14 workflows' own correctness. I confirmed the diff is a pure tag substitution
and did not audit the workflows further. I did note in passing thatci.yml:37and
ci.yml:41carrycontinue-on-error: trueon the ruff and mypy steps, which means
those two checks cannot fail a build — outside this diff, but worth a separate issue.
Automated architecture review of 026d4ae9dadf — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.
1 participant
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)