Skip to content

Update actions/checkout action to v7 #66

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update actions/checkout action to v7 #66

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/default.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ jobs:
build:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- name: Setup Go

@kimchi-review kimchi-review Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨🔒 Security

The workflow updates actions/checkout to commit 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with the comment # v7. The official actions/checkout action has no v7 release; the current major version is v4. Using a non-existent or unverified major version of a core privileged action that checks out repository source code and handles the GITHUB_TOKEN exposes the build pipeline to severe supply chain compromise, including potential exfiltration of secrets or source code.

💡 Suggestion: Reject this update. Restore the verified pinned SHA for the latest official v4 release (11bd71901bbe5b1630ceea73d27597364c9af683 for v4.2.2) or another officially documented release, confirming the SHA against the actions/checkout GitHub repository.

@kimchi-review kimchi-review Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️🔧 Maintainability

The comment # v7 attached to the new actions/checkout SHA is misleading because it mismatches the official release versioning of the action. A mismatched version comment makes future dependency auditing, security scanning, and Renovate automation unreliable.

💡 Suggestion: If updating is required, ensure the comment accurately reflects the verified major or full semantic version of the pinned commit hash (for example, # v4.2.2).

uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
with:
Expand Down
Loading