Skip to content

build(deps): bump actions/checkout from 6 to 7#561

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/actions/checkout-7
Open

build(deps): bump actions/checkout from 6 to 7#561
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/actions/checkout-7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 19, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/checkout from 6 to 7.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump actions/checkout from 6 to 7
3c12c96 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 19, 2026
@github-actions

github-actions Bot commented Jun 19, 2026 •
edited
Loading

Copy link
Copy Markdown

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
⚠️ ACTION actionlint 3 1 0 0.24s
❌ ACTION zizmor 3 0 1 0 0.32s
✅ BASH bash-exec 3 0 0 0.24s
✅ BASH shellcheck 3 0 0 0.11s
✅ BASH shfmt 3 0 0 0 0.03s
✅ DOCKERFILE hadolint 1 0 0 0.12s
✅ MARKDOWN markdownlint 1 0 0 0 0.65s
✅ MARKDOWN markdown-table-formatter 1 0 0 0 0.27s
✅ PYTHON bandit 1 0 0 1.39s
✅ PYTHON black 1 0 0 0 1.4s
✅ PYTHON flake8 1 0 0 0.76s
✅ PYTHON isort 1 0 0 0 0.21s
❌ PYTHON mypy 1 2 0 10.01s
⚠️ PYTHON pylint 1 2 0 5.64s
⚠️ PYTHON pyright 1 7 0 2.01s
✅ PYTHON ruff 1 0 0 0 0.03s
⚠️ REPOSITORY checkov yes 4 no 20.56s
⚠️ REPOSITORY devskim yes 1 1 1.7s
✅ REPOSITORY dustilock yes no no 0.02s
✅ REPOSITORY gitleaks yes no no 2.05s
✅ REPOSITORY git_diff yes no no 0.02s
✅ REPOSITORY grype yes no no 55.23s
✅ REPOSITORY kingfisher yes no no 6.41s
❌ REPOSITORY osv-scanner yes 1 no 0.22s
✅ REPOSITORY secretlint yes no no 0.97s
✅ REPOSITORY syft yes no no 2.0s
✅ REPOSITORY trivy yes no no 9.88s
✅ REPOSITORY trivy-sbom yes no no 0.15s
✅ REPOSITORY trufflehog yes no no 4.86s
✅ YAML prettier 6 0 0 0 0.53s
✅ YAML v8r 6 0 0 5.35s
✅ YAML yamllint 6 0 0 0.57s

Detailed Issues

❌ PYTHON / mypy - 2 errors 
Collecting types-requests
  Downloading types_requests-2.33.0.20260518-py3-none-any.whl.metadata (2.2 kB)
Collecting urllib3>=2 (from types-requests)
  Downloading urllib3-2.7.0-py3-none-any.whl.metadata (6.9 kB)
Downloading types_requests-2.33.0.20260518-py3-none-any.whl (21 kB)
Downloading urllib3-2.7.0-py3-none-any.whl (131 kB)
Installing collected packages: urllib3, types-requests

   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0/2 [urllib3]
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2/2 [types-requests]

Successfully installed types-requests-2.33.0.20260518 urllib3-2.7.0
checkers/utils.py:39: error: Incompatible return value type (got "Version", expected "str")  [return-value]
checkers/utils.py:72: error: Incompatible return value type (got "Version", expected "str")  [return-value]
Installing missing stub packages:
/venvs/mypy/bin/python3 -m pip install types-requests


Found 2 errors in 1 file (checked 1 source file)
❌ REPOSITORY / osv-scanner - 1 error 
Scanning dir .
Starting filesystem walk for root: /
End status: 49 dirs visited, 212 inodes visited, 0 Extract calls, 4.825509ms elapsed, 4.825929ms wall time
No package sources found, --help for usage information.
❌ ACTION / zizmor - 1 error 
INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/build.yaml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ZizmorLinter] Zizmor failed to reach the GitHub API.
To allow zizmor to use GITHUB_TOKEN, add the following to your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
⚠️ ACTION / actionlint - 1 error 
.github/workflows/build.yaml:49:9: shellcheck reported issue in this script: SC2044:warning:3:12: For loops over find output are fragile. Use find -exec or a while read loop [shellcheck]
   |
49 |         run: |
   |         ^~~~
⚠️ REPOSITORY / checkov - 4 errors 
dockerfile scan results:

Passed checks: 62, Failed checks: 1, Skipped checks: 0

Check: CKV2_DOCKER_1: "Ensure that sudo isn't used"
	FAILED for resource: /Dockerfile.RUN
	File: /Dockerfile:13-13
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-docker-dont-use-sudo

		13 | RUN apk add bash alpine-conf alpine-sdk ccache cmake coreutils m4 sudo fish

github_actions scan results:

Passed checks: 77, Failed checks: 3, Skipped checks: 0

Check: CKV2_GHA_1: "Ensure top-level permissions are not set to write-all"
	FAILED for resource: on(build packages)
	File: /.github/workflows/build.yaml:0-1
Check: CKV2_GHA_1: "Ensure top-level permissions are not set to write-all"
	FAILED for resource: on(MegaLinter)
	File: /.github/workflows/megalinter.yml:26-27
Check: CKV2_GHA_1: "Ensure top-level permissions are not set to write-all"
	FAILED for resource: on(check package versions for upgrades)
	File: /.github/workflows/check-package-versions.yaml:0-1
⚠️ REPOSITORY / devskim - 1 error 
{"$schema":"https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.6.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"devskim","fullName":"Microsoft DevSkim Command Line Interface","version":"1.0.70+d69541fde7","informationUri":"https://github.com/microsoft/DevSkim/","rules":[{"id":"DS176209","name":"SuspiciousComment","fullDescription":{"text":"Suspicious comment: A \"TODO\" or similar was left in source code, possibly indicating incomplete functionality"},"help":{"text":"A \"TODO\" or similar was left in source code, possibly indicating incomplete functionality","markdown":"Visit [https://github.com/Microsoft/DevSkim/blob/main/guidance/DS176209.md](https://github.com/Microsoft/DevSkim/blob/main/guidance/DS176209.md) for additional guidance on this issue."},"shortDescription":{"text":"A \"TODO\" or similar was left in source code, possibly indicating incomplete functionality"},"defaultConfiguration":{"level":"note"},"helpUri":"https://github.com/Microsoft/DevSkim/blob/main/guidance/DS176209.md","properties":{"precision":"high","problem.severity":"recommendation","DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"id":"DS137138","name":"InsecureUrl","fullDescription":{"text":"Insecure URL: An HTTP-based URL without TLS was detected."},"help":{"text":"Update to an HTTPS-based URL if possible.","markdown":"Update to an HTTPS-based URL if possible. Visit [https://github.com/Microsoft/DevSkim/blob/main/guidance/DS137138.md](https://github.com/Microsoft/DevSkim/blob/main/guidance/DS137138.md) for additional guidance on this issue."},"shortDescription":{"text":"An HTTP-based URL without TLS was detected."},"helpUri":"https://github.com/Microsoft/DevSkim/blob/main/guidance/DS137138.md","properties":{"precision":"high","problem.severity":"warning","DevSkimSeverity":"Moderate","DevSkimConfidence":"High"},"defaultConfiguration":{"level":"warning"}}]}},"versionControlProvenance":[{"repositoryUri":"https://github.com/atlascloud/aports","revisionId":"HIDDEN_BY_MEGALINTER","branch":"dependabot/github_actions/actions/checkout-7"}],"results":[{"ruleId":"DS137138","message":{"text":"Insecure URL"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"entrypoint.sh"},"region":{"startLine":4,"startColumn":12,"endLine":4,"endColumn":41,"charOffset":58,"charLength":29,"snippet":{"text":"http://dl-cdn.alpinelinux.org","rendered":{"text":"http://dl-cdn.alpinelinux.org","markdown":"`http://dl-cdn.alpinelinux.org`"}},"sourceLanguage":"shellscript"}}}],"fixes":[{"description":{"text":"An HTTP-based URL without TLS was detected."},"artifactChanges":[{"artifactLocation":{"uri":"entrypoint.sh"},"replacements":[{"deletedRegion":{"charOffset":58,"charLength":29},"insertedContent":{"text":"https://dl-cdn.alpinelinux.org"}}]}]}],"properties":{"tags":["ThreatModel.Integration.HTTP"],"DevSkimSeverity":"Moderate","DevSkimConfidence":"High"},"level":"warning"},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/build.yaml"},"region":{"startLine":17,"startColumn":26,"endLine":17,"endColumn":30,"charOffset":290,"charLength":4,"snippet":{"text":"TODO","rendered":{"text":"TODO","markdown":"`TODO`"}},"sourceLanguage":"yaml"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS176209","level":"note","message":{"text":"Suspicious comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/check_updates.sh"},"region":{"startLine":22,"startColumn":3,"endLine":22,"endColumn":8,"charOffset":714,"charLength":5,"snippet":{"text":"FIXME","rendered":{"text":"FIXME","markdown":"`FIXME`"}},"sourceLanguage":"shellscript"}}}],"properties":{"tags":["Hygiene.Comment.Suspicious"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}}],"columnKind":"utf16CodeUnits"}]}
⚠️ PYTHON / pylint - 2 errors 
************* Module /action/lib/.automation/.pylintrc
/action/lib/.automation/.pylintrc:1:0: E0015: Unrecognized option found: suggestion-mode (unrecognized-option)
************* Module utils
checkers/utils.py:3:0: E0401: Unable to import 'requests' (import-error)
⚠️ PYTHON / pyright - 7 errors 
checkers/utils.py
  checkers/utils.py:24:14 - error: Cannot access attribute "get" for class "str"
    Attribute "get" is unknown (reportAttributeAccessIssue)
  checkers/utils.py:24:30 - error: Argument of type "Literal['name']" cannot be assigned to parameter "key" of type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" in function "__getitem__"
    Type "Literal['name']" is not assignable to type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]"
      "Literal['name']" is incompatible with protocol "SupportsIndex"
        "__index__" is not present
      "Literal['name']" is not assignable to "slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" (reportArgumentType)
  checkers/utils.py:26:38 - error: Argument of type "Literal['name']" cannot be assigned to parameter "key" of type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" in function "__getitem__"
    Type "Literal['name']" is not assignable to type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]"
      "Literal['name']" is incompatible with protocol "SupportsIndex"
        "__index__" is not present
      "Literal['name']" is not assignable to "slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" (reportArgumentType)
  checkers/utils.py:31:37 - error: Argument of type "Literal['name']" cannot be assigned to parameter "key" of type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" in function "__getitem__"
    Type "Literal['name']" is not assignable to type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]"
      "Literal['name']" is incompatible with protocol "SupportsIndex"
        "__index__" is not present
      "Literal['name']" is not assignable to "slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" (reportArgumentType)
  checkers/utils.py:34:30 - error: Argument of type "Literal['name']" cannot be assigned to parameter "key" of type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" in function "__getitem__"
    Type "Literal['name']" is not assignable to type "SupportsIndex | slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]"
      "Literal['name']" is incompatible with protocol "SupportsIndex"
        "__index__" is not present
      "Literal['name']" is not assignable to "slice[SupportsIndex | None, SupportsIndex | None, SupportsIndex | None]" (reportArgumentType)
  checkers/utils.py:39:12 - error: Type "Version" is not assignable to return type "str"
    "Version" is not assignable to "str" (reportReturnType)
  checkers/utils.py:72:12 - error: Type "Version" is not assignable to return type "str"
    "Version" is not assignable to "str" (reportReturnType)
7 errors, 0 warnings, 0 informations

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_BANDIT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,DOCKERFILE_HADOLINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_DEVSKIM,REPOSITORY_DUSTILOCK,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants