chore(deps): bump actions/checkout from 4 to 7 - #8
Conversation
dependabot
Bot
added
dependencies
|
@dependabot rebase |
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
9787c55 to
5aec313
Compare
|
Local review (the bot cannot run on dependabot events — no secrets): 1-line actions major bump; every usage in this repo pins explicit, stable inputs (checkout: defaults only; setup-node: node-version 20 + npm cache; setup-java: temurin/17; upload/download-artifact: plain name+path single-artifact pair, landing in the same batch so the pair stays consistent). Publish workflows are tag-triggered, so CI here does not exercise them — residual risk accepted, recoverable by re-tag. No Critical/Medium. |
…p-java to v5 (#43) * chore(deps): bump actions/checkout to v7, upload-artifact to v7, setup-java to v5 Replicates dependabot #8/#9/#11, which the branch ruleset blocks from merging (bot-authored PRs never receive the Copilot review the copilot_code_review rule waits for). Same review rationale as noted on those PRs: every usage pins explicit stable inputs; the upload/download-artifact pair stays consistent (download@v8 landed via #7); publish workflows are tag-triggered so the residual risk surfaces only at the next release and is recoverable by re-tag. * Review Medium: match the artifact pair at v8, fail release on empty dist upload-artifact goes v8 (not v7) so the tag-only upload/download pair shares a major, and the GitHub release step now fails when dist/*.zip matches nothing instead of silently publishing a release without the plugin. * upload-artifact back to v7 — v8 does not exist for the upload action The upload/download majors are simply offset (upload latest is v7, download latest is v8, both on the shared v4+ artifact backend), which is exactly the pairing dependabot proposed. fail_on_unmatched_files stays: an empty dist/ must fail the release.
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)