chore(deps): update actions/checkout action to v7 - #66
Merged
Merged
Conversation
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://delightful-cliff-04b2d4e03-66.westeurope.2.azurestaticapps.net |
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://brave-bay-04f351e03-66.westeurope.4.azurestaticapps.net |
renovate
Bot
force-pushed
the
renovate/actions-checkout-7.x
branch
from
September 3, 2026 12:23
7536dde to
0b03d7d
Compare
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://delightful-cliff-04b2d4e03-66.westeurope.2.azurestaticapps.net |
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://brave-bay-04f351e03-66.westeurope.4.azurestaticapps.net |
renovate
Bot
force-pushed
the
renovate/actions-checkout-7.x
branch
from
September 7, 2026 22:03
0b03d7d to
6edadf8
Compare
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://delightful-cliff-04b2d4e03-66.westeurope.2.azurestaticapps.net |
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://brave-bay-04f351e03-66.westeurope.4.azurestaticapps.net |
This was referenced Sep 8, 2026
renovate
Bot
force-pushed
the
renovate/actions-checkout-7.x
branch
from
September 8, 2026 09:22
6edadf8 to
2a392a9
Compare
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://delightful-cliff-04b2d4e03-66.westeurope.2.azurestaticapps.net |
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://brave-bay-04f351e03-66.westeurope.4.azurestaticapps.net |
Renovate maintains workflow pins and their version comments together; it
does not touch SECURITY-PIPELINE.md. So this branch left the register
describing a policy the workflows no longer follow, and check-supply-chain
said so on the audit run for this pull request:
[register] actions/checkout: workflow pins 3d3c42e5aac5… (v7.0.1) but
SECURITY-PIPELINE.md records only 11d5960a3267… (v4.4.0),
a37ce9120846… (v3.7.0)
Pin truth passed there — Renovate's digest and its rewritten comment agree
with each other and with GitHub. The check was right and the register was
stale, which is exactly the drift it exists to catch.
This is the first exercise of the habit recorded in SECURITY-PIPELINE.md
under "Keeping this register true": the register is updated ON the bump's
branch, before merging, so the check is green on the pull request rather
than only on acc afterwards. Fixing it after the merge would leave the
check red for the whole life of every such pull request and make the step
impossible to promote to blocking, since no bump could present a green
result to merge on.
── Beyond the table row ──
Three passages went stale with it, and a register accurate in its table
while wrong in its prose is still misleading:
"Version currency" claimed the four ropa-site references sit at v3.7.0,
four majors behind. All seven now pin v7.0.1. Rewritten to record what the
gap was and to keep the point it was making — pinned is not current, and a
hash ages silently.
The #66 evidence block in "Keeping this register true" is reframed as the
record of a caught drift rather than a live failure, since this commit is
what resolves it.
The split-pin paragraph described checkout as presently holding two rows.
It no longer does. Rewritten in the past tense, with an added warning not
to collapse such rows to tidy the table: an action at two digests is two
distinct things to verify, and keying by action alone is precisely the bug
fixed upstream in sgort/ttl-editor#86 before this repository could adopt
the check at all.
── Verification ──
npm run check-supply-chain on this branch:
check-supply-chain: 23 pinned reference(s) across 5 action(s)
note: Azure/static-web-apps-deploy@v1 verified against the branch, per
its recorded exception
OK — digests, version comments and the register all agree.
Both orphan-row notes are gone with the rows.
4 tasks
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://delightful-cliff-04b2d4e03-66.westeurope.2.azurestaticapps.net |
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://brave-bay-04f351e03-66.westeurope.4.azurestaticapps.net |
sgort
added a commit
that referenced
this pull request
Sep 8, 2026
… bump
Renovate maintains workflow pins and their version comments together; it
does not touch SECURITY-PIPELINE.md. check-supply-chain reported the gap on
this branch:
[register] actions/setup-node: workflow pins 820762786026… (v7.0.0) but
SECURITY-PIPELINE.md records only 49933ea5288c… (v4.4.0)
note: SECURITY-PIPELINE.md lists actions/setup-node at 49933ea5288c…
(v4.4.0), which no workflow currently uses
Pin truth passed — the digest resolves to the version its comment claims.
Only the register was stale.
Second exercise of the habit recorded under "Keeping this register true":
the register moves on the bump's branch, before merging, so the check is
green on the pull request rather than only on acc afterwards.
Unlike the checkout bump in #66, nothing in the surrounding prose went
stale with it. Two passages were checked and both still hold:
- "Version currency" discusses the node-version INPUT ('22' backend, '20'
frontend), not the action pin, so this bump does not touch it.
- The zizmor.yml comment on the config-validator step says it reuses the
setup-node pin this repository already carries, so Renovate maintains one
digest rather than two. All five references move together, so that
remains true.
Worth stating because it marks the check's limit: it verifies the table,
and nothing verifies the prose around it. #66 needed a human to notice
three stale passages. This one genuinely did not.
This was referenced Sep 8, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.4.0→v7.0.1v3.7.0→v7.0.1Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v6.1.0Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v5.1.0Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.