chore(deps): bump actions/checkout from 4 to 7 - #22
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
dependencies
srpatcha
left a comment
srpatcha
left a comment
There was a problem hiding this comment.
Approving, with a caution proportional to the size of the jump.
Verified
actions/checkout v7 exists and is current (latest
v7.0.1). The diff is a pure version-string
change across the workflows.
This is v4 → v7, three majors
Most of this batch moves one major. This one does not, and the intermediate
majors are where behaviour changed — actions/download-artifact in particular
altered artifact naming and matching semantics across v4/v5, so a workflow that
uploads under one name and downloads by pattern can silently retrieve nothing
rather than fail.
The check most likely to catch that is an end-to-end run that uploads and then
downloads an artifact in the same workflow. Worth confirming that path exists
here before merging, because a download that quietly returns zero files produces
a downstream error that looks like anything but a version bump.
The failing checks are not this PR
Lint & Format and Quick Checks fail identically on all five open Dependabot
PRs and on master. Reproduced locally against master:
$ ruff check eosim/
Found 324 errors.
$ ruff format --check eosim/
178 files would be reformatted, 15 files already formatted
Pre-existing, inherited by every PR. Worth fixing separately — a permanently red
check trains people to ignore it — but not a reason to hold this.
Approving because the version is real and the change is mechanical. If anything
in this repository round-trips artifacts between jobs, I would want one green run
of that path before merging rather than after.
srpatcha
left a comment
srpatcha
left a comment
There was a problem hiding this comment.
Review — EoSim#22 "chore(deps): bump actions/checkout from 4 to 7"
head: 2d6b29d author: app/dependabot ci: fail (Lint & Format, Quick Checks — pre-existing on master, not caused by this PR)
Verdict: Safe by inspection, and of the five open EoSim dependabot PRs this is the one with a concrete reason to land: it clears the Node 20 deprecation warning that every EoSim job currently emits. The one breaking change in the v4→v7 range does not apply here, verified below. Same CI-integrity caveats as EoSim#21 — the pipeline this merges under cannot fail.
Findings
| # | Severity | File:line | Finding | Recommended fix |
|---|---|---|---|---|
| 1 | High | .github/workflows/ci.yml:263-278, repo branch protection, .github/workflows/ci.yml:226 | Three pre-existing CI-integrity defects, detailed with evidence in the review of EoSim#21 and identical here: ci-summary is an aggregate gate that cannot fail (if: always(), needs: everything, and no step evaluates needs.*.result — it reported pass on this PR while lint failed and six jobs were skipped); master has required_status_checks: null so nothing gates merge; and the Security Scan job's pip-audit --strict 2>/dev/null || true reports success unconditionally. Not introduced by this diff. |
See EoSim#21 review, "Proposed changes", for the ordered fix. Do not require CI Summary in branch protection until it is capable of failing. |
| 2 | Medium | CI state — Lint & Format, Quick Checks | Both red on pre-existing ruff violations in eosim/ (I001, F401, UP031, N806 across eosim/analysis, eosim/api, eosim/artifacts, eosim/cli, eosim/plugins, eosim/tests), unrelated to this diff. Because test, coverage, validate-platforms, simulator-smoke, docs and build all declare needs: lint, every job that would exercise the 22 changed uses: lines was skipped. A PR that rewrites actions/checkout in nine workflow files has been proven by exactly one thing: that Security Scan and Simulator Smoke — the two jobs with no needs: lint — still check out. |
Land a ruff check --fix / ruff format pass on master first, then re-run this PR so the checkout bump is actually exercised across the matrix, including the macos/windows legs where a checkout regression is most likely to show. |
| 3 | Low | .github/workflows/scorecard.yml:25, .github/workflows/sync-release-branch.yml, .github/workflows/deploy-pages.yml, .github/workflows/codeql.yml, .github/workflows/video-build.yml | Five of the nine touched workflows are schedule/push/tag/workflow_dispatch-triggered only. Their checkout@v7 lines will first execute on a cron tick, a merge to master, or a tag — never on this PR. The blast radius of this bump is wider than what any PR run can cover, even a green one. |
Merge decision only. If you want early signal, workflow_dispatch the scheduled ones once after merge rather than waiting for the Monday 06:00 cron. |
Not a finding, verified as inapplicable. The one genuine breaking change in the v4→v7 range is v6.1.0's safer pull_request_target defaults (github.blog changelog 2026-06-18): checkout of a fork PR head is now blocked under pull_request_target and workflow_run unless allow-unsafe-pr-checkout is set. EoSim uses neither trigger. Verified by grep across every file in git ls-tree origin/master .github/workflows/ — zero hits for pull_request_target, zero for workflow_run. The remaining v5/v6/v7 changes are Node 24 runtime, ESM conversion and dependency bumps, none of which touch the inputs used here; the only with: blocks in the diff are fetch-depth: 0 and ref:, both unchanged across the range.
Positive reason to land this, recorded with evidence. The Lint & Format job log (run 33365422715) ends with:
##[warning]Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5.
actions/checkout@v7 removes half of that. The other half needs the matching actions/setup-python bump, which dependabot has not opened for EoSim — worth opening by hand, since the forcing behaviour is a deprecation grace period, not a permanent state.
Architecture conformance
Conforms. Infrastructure-tier change (master design §21) to a Tier-1 Foundation repository. No source, #include, link line or manifest entry — §5.1 dependency direction untouched. Findings 1-2 bear on §17 and §28 in the same way as EoSim#21, and are already filed as the §28.2 proposal of 2026-09-02 and the §28.3 proposal of 2026-09-03. No new proposal warranted.
Proposed changes
None to the diff. Repository order of operations is in the EoSim#21 review; step 1 (green lint on master) is the prerequisite for this PR having any test evidence at all.
Verification I ran
- Grep over every workflow in
git ls-tree --name-only origin/master .github/workflows/forpull_request_targetandworkflow_run→ zero matches, which is what makes the v6.1.0 breaking change inapplicable. gh run view --job 99404978635 --log-failed(Lint & Format) and--job 99404978392(Quick Checks) → the ruff violations in finding 2,exit code 1, and the Node 20 deprecation warning quoted above.gh api repos/embeddedos-org/EoSim/branches/master/protection→required_status_checks: null.gh pr view 22 --json mergeStateStatus,reviewDecision,mergeable→UNSTABLE APPROVED MERGEABLE.- Read the changed workflows from
origin/masterviagit show, not from the working tree.
Not checked
- Nothing was executed. No workflow ran with
checkout@v7. Every job that would have — the 3×N test matrix, coverage, docs, build — was skipped behindneeds: lint. - I did not verify behaviour on the
macosorwindowsmatrix legs, which is where an ESM/Node 24 checkout change is most likely to surface and where nothing has run. - The local EoSim checkout is dirty (179 modified tracked
.pycfiles) and two commits behindorigin/master; the sync step correctly left it alone and I read everything fromorigin/master. I did not stash, reset or check out anything. - I did not check whether any self-hosted runner is in use; the Node 24 requirement (Actions Runner ≥ 2.327.1) is satisfied by GitHub-hosted runners and unverified for anything else.
Automated architecture review of 2d6b29dff44b — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.
1 participant
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)