chore(deps): update actions/checkout action to v7 - #397
chore(deps): update actions/checkout action to v7#397red-hat-konflux[bot] wants to merge 1 commit into
Conversation
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
WalkthroughThe GitHub Actions workflow file ChangesCI Checkout Action Version Bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~1 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/build-and-test.yml (1)
16-16: ⚡ Quick winAdd
persist-credentials: falseto reduce attack surface.The action currently persists credentials to the runner, increasing the risk if subsequent steps or artifacts are compromised. This is a defense-in-depth best practice, particularly important for workflows involving external dependencies or artifact uploads.
🔒 Proposed improvement: Disable credential persistence
- uses: actions/checkout@v7 + with: + persist-credentials: falseIf subsequent steps require credentials (e.g., for private package access), only enable this where necessary.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-and-test.yml at line 16, Add the parameter persist-credentials: false to the actions/checkout@v7 step configuration. This parameter should be added with a value of false to disable credential persistence on the runner after the checkout operation completes, reducing the security attack surface of the workflow.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-and-test.yml:
- Line 16: The actions/checkout@v7 reference in the workflow file uses a
semantic version tag instead of a commit hash, which violates the security
policy. Replace the `v7` tag with the full commit SHA by visiting the
actions/checkout releases page for version 7, copying the commit hash from the
release tag, and updating the action reference to use the complete commit hash
instead of the semantic version tag.
---
Nitpick comments:
In @.github/workflows/build-and-test.yml:
- Line 16: Add the parameter persist-credentials: false to the
actions/checkout@v7 step configuration. This parameter should be added with a
value of false to disable credential persistence on the runner after the
checkout operation completes, reducing the security attack surface of the
workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 979d7321-ddb3-4bb5-b9fa-fbdb6f12ae99
📒 Files selected for processing (1)
.github/workflows/build-and-test.yml
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
Action reference must be pinned to a commit hash to comply with security policy.
The static analysis tool flags an ERROR: "action is not pinned to a hash (required by blanket policy)". Using a semantic version tag (v7) instead of a full commit hash makes the action vulnerable to tag mutation attacks and violates the repository's documented security requirements.
📌 Proposed fix: Pin action to commit hash
- - uses: actions/checkout@v7
+ - uses: actions/checkout@e2f67f32abdc3755287c92b8e1dfb8f30b7e5786To find the commit hash for actions/checkout@v7, visit the actions/checkout releases page and copy the commit SHA from the release tag.
Alternatively, if your security policy permits semantic versioning, please add an explicit policy exception and document the rationale.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v7 | |
| - uses: actions/checkout@e2f67f32abdc3755287c92b8e1dfb8f30b7e5786 |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 16-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-and-test.yml at line 16, The actions/checkout@v7
reference in the workflow file uses a semantic version tag instead of a commit
hash, which violates the security policy. Replace the `v7` tag with the full
commit SHA by visiting the actions/checkout releases page for version 7, copying
the commit hash from the release tag, and updating the action reference to use
the complete commit hash instead of the semantic version tag.
Source: Linters/SAST tools
This PR contains the following updates:
v6→v7Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.