build(deps): bump actions/checkout from 4 to 7#244
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
WalkthroughAll Changesactions/checkout version bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/commands.yml:
- Line 12: The actions/checkout step uses a mutable tag (`@v7`) instead of a
pinned commit SHA, and lacks the persist-credentials configuration required for
security hardening. Replace the `uses: actions/checkout@v7` with a full commit
SHA in the format `uses: actions/checkout@<FULL_COMMIT_SHA>` and add
`persist-credentials: false` as a new parameter in the with section to ensure
immutable deployment and disable credential persistence.
In @.github/workflows/release.yaml:
- Line 17: The release workflow has two instances of actions/checkout@v7 (at
lines 17 and 72) that present security risks due to using version tags instead
of full SHAs and allowing default credential persistence. Replace both
`actions/checkout@v7` with the full SHA-pinned version and add
`persist-credentials: false` to each checkout step to disable credential
persistence and mitigate supply-chain and token-exposure risks.
In @.github/workflows/test.yaml:
- Line 15: All five checkout action steps using actions/checkout@v7 at lines 15,
31, 46, 77, and 108 need security hardening. Replace the mutable version tag `@v7`
with a pinned full commit SHA (the specific commit hash for that release) and
add the persist-credentials: false parameter to each checkout step to disable
credential persistence. This ensures reproducible deployments and reduces
security risk by not storing Git credentials in the runner environment.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3416ea46-7001-4ac1-be4e-38e9dfe4db2f
📒 Files selected for processing (3)
.github/workflows/commands.yml.github/workflows/release.yaml.github/workflows/test.yaml
| steps: | ||
| - name: Check out code | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify all checkout uses are SHA-pinned and have persist-credentials:false nearby.
rg -n --type=yaml 'uses:\s*actions/checkout@' .github/workflows
echo
echo "Potentially unpinned checkout references:"
rg -n --type=yaml 'uses:\s*actions/checkout@v[0-9]+' .github/workflows
echo
echo "Checkout steps missing persist-credentials:false (manual inspect from context):"
rg -n -C2 --type=yaml 'uses:\s*actions/checkout@' .github/workflowsRepository: openshift/containernetworking-plugins
Length of output: 3564
🏁 Script executed:
cat -n .github/workflows/commands.yml | head -20Repository: openshift/containernetworking-plugins
Length of output: 574
Pin actions/checkout to an immutable SHA and disable credential persistence.
This step uses a mutable tag (@v7) instead of a full commit SHA and lacks the persist-credentials: false configuration. Both are required by the CI/CD security hardening guidelines.
Suggested patch
- name: Check out code
- uses: actions/checkout@v7
+ uses: actions/checkout@<FULL_LENGTH_COMMIT_SHA_FOR_V7>
+ with:
+ persist-credentials: false🧰 Tools
🪛 zizmor (1.25.2)
[warning] 11-12: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 12-12: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/commands.yml at line 12, The actions/checkout step uses a
mutable tag (`@v7`) instead of a pinned commit SHA, and lacks the
persist-credentials configuration required for security hardening. Replace the
`uses: actions/checkout@v7` with a full commit SHA in the format `uses:
actions/checkout@<FULL_COMMIT_SHA>` and add `persist-credentials: false` as a
new parameter in the with section to ensure immutable deployment and disable
credential persistence.
Sources: Coding guidelines, Linters/SAST tools
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/release.yaml | head -80Repository: openshift/containernetworking-plugins
Length of output: 2930
Pin both actions/checkout steps to full SHAs and disable credential persistence.
Lines 17 and 72 both use actions/checkout@v7 with default credential persistence, which presents a supply-chain and token-exposure risk in this release workflow.
Suggested patch
- name: Checkout code
- uses: actions/checkout@v7
+ uses: actions/checkout@<FULL_LENGTH_COMMIT_SHA_FOR_V7>
+ with:
+ persist-credentials: falsePer CI/CD security guidelines: pin actions by full SHA (not tag) and apply credential hardening controls in workflows.
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 16-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yaml at line 17, The release workflow has two
instances of actions/checkout@v7 (at lines 17 and 72) that present security
risks due to using version tags instead of full SHAs and allowing default
credential persistence. Replace both `actions/checkout@v7` with the full
SHA-pinned version and add `persist-credentials: false` to each checkout step to
disable credential persistence and mitigate supply-chain and token-exposure
risks.
Sources: Coding guidelines, Linters/SAST tools
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/test.yaml | sed -n '10,120p'Repository: openshift/containernetworking-plugins
Length of output: 3943
Pin all checkout actions to full commit SHA and disable credential persistence.
All five checkout steps at lines 15, 31, 46, 77, and 108 use the mutable tag @v7 and do not disable credential persistence, violating the CI/CD security baseline.
Suggested patch pattern (apply to each checkout step)
- - uses: actions/checkout@v7
+ - uses: actions/checkout@<FULL_LENGTH_COMMIT_SHA_FOR_V7>
+ with:
+ persist-credentials: false🧰 Tools
🪛 zizmor (1.25.2)
[warning] 15-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 15-15: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/test.yaml at line 15, All five checkout action steps using
actions/checkout@v7 at lines 15, 31, 46, 77, and 108 need security hardening.
Replace the mutable version tag `@v7` with a pinned full commit SHA (the specific
commit hash for that release) and add the persist-credentials: false parameter
to each checkout step to disable credential persistence. This ensures
reproducible deployments and reduces security risk by not storing Git
credentials in the runner environment.
Sources: Coding guidelines, Linters/SAST tools
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)df4cb1cUpdate changelog for v6.0.3 (#2446)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit