chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 - #46
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1#46dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
Thermos review (PR #46 @ c26ffa5)
1 HIGH finding — Dependabot bumped generated release.yml checkout pins to actions/checkout v7.0.1, but left the cargo-dist source of truth in dist-workspace.toml on v7.0.0. Security and code-quality passes agree.
Summary
- Supply-chain pin
3d3c42e5aac5ba805825da76410c181273ba90b1matchesactions/checkouttagv7.0.1(verified). - Manual workflows (
ci.yml,publish-*.yml) are fine SHA+comment bumps. [dist.github-action-commits]."actions/checkout"still pins9c091bb…(# v7.0.0), sodist planrejects the regenerated workflow. Release run 30861587227 already fails withrelease.yml has out of date contents(exit 255) and would block tag releases after merge — the same failure class PR #35 introducedgithub-action-commitsto prevent.
Fix
Update dist-workspace.toml:
"actions/checkout" = "3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1Keep release.yml aligned (already on that SHA), then confirm dist plan is green.
No other medium+ findings. No prior automation threads.
Sent by Cursor Automation: Find vulnerabilities
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 |
There was a problem hiding this comment.
HIGH — cargo-dist checkout pin SoT desync (release-blocking)
This generated file was bumped to actions/checkout@3d3c42e… (v7.0.1), but [dist.github-action-commits]."actions/checkout" in dist-workspace.toml still pins 9c091bb… (v7.0.0).
Impact: dist plan fails with release.yml has out of date contents (run 30861587227, exit 255). Same gate would block tag Release after merge.
Evidence: dist plan wants all five checkouts reverted to 9c091bb…. PR #35 added github-action-commits specifically so workflow-only Dependabot bumps do not break this.
Fix: Set the SoT pin to 3d3c42e5aac5ba805825da76410c181273ba90b1 (# v7.0.1) in dist-workspace.toml and keep release.yml in sync.
Bumps actions/checkout from 7.0.0 to 7.0.1.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)