chore(deps): update actions/checkout action to v7 #1419
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -67,7 +67,7 @@ jobs: | |
| dispatch_reason: ${{ steps.runner_dispatch.outputs.reason }} | ||
| steps: | ||
| - name: Checkout eligibility action | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
|
There was a problem hiding this comment. 🧩 Analysis chain🌐 Web query:
💡 Result: In version 7.0.0 and later, the actions/checkout action implements security guardrails that block the checkout of fork pull request code when the workflow is triggered by pull_request_target or workflow_run [1][2]. This change was introduced to prevent "pwn request" vulnerabilities, where executing untrusted fork code in a privileged context (i.e., one with access to base repository secrets and the GITHUB_TOKEN) could lead to unauthorized access [1][2]. Regarding the behavior of the ref parameter: 1. Blocking Mechanism: By default, the checkout action will refuse to fetch fork-based content in these privileged triggers [1][3]. Attempting to use an explicit ref parameter (such as a pull request head SHA) without the required opt-in will result in a failure [1][2]. 2. Bypassing the Block: To legitimately check out fork code in these scenarios, you must explicitly opt in by setting the allow-unsafe-pr-checkout input to true [1][2]. This should only be done after reviewing the associated security risks, as it effectively authorizes the execution of untrusted fork code in a trusted, privileged environment [1]. 3. Trusted Base-Branch Checkouts: Recent updates have refined this security validation [4]. The action now recognizes explicit checkout configurations targeting the base repository and its trusted base references as safe [4]. Specifically, checkouts are treated as safe if the repository is the base repository (or omitted) and the ref refers to the base SHA or base ref [4]. These safe patterns do not trigger the security block and do not require setting allow-unsafe-pr-checkout to true [4]. In summary, an explicit ref pointing to a fork's head SHA does not bypass the security block; rather, the block is enforced to prevent such unsafe checkouts unless you explicitly acknowledge the risk by enabling the safety bypass [1][2]. Citations:
🏁 Script executed: #!/bin/bash
# Check reusable-18-autofix.yml for allow-unsafe-pr-checkout configuration
rg -A 5 "actions/checkout" .github/workflows/reusable-18-autofix.yml || trueRepository: stranske/Workflows Length of output: 964 🏁 Script executed: #!/bin/bash
# Search for any allow-unsafe-pr-checkout usage in the workflows
rg "allow-unsafe-pr-checkout" .github/workflows/ || trueRepository: stranske/Workflows Length of output: 44 🏁 Script executed: #!/bin/bash
# Check the checkout actions in trip-planner's autofix.yml
sed -n '65,100p' .github/workflows/autofix.ymlRepository: stranske/trip-planner Length of output: 1755 🏁 Script executed: #!/bin/bash
# Check context around line 521 for the third checkout
sed -n '515,530p' .github/workflows/autofix.ymlRepository: stranske/trip-planner Length of output: 584 🏁 Script executed: #!/bin/bash
# Also check the full event trigger context for the resolve job
sed -n '80,95p' .github/workflows/autofix.ymlRepository: stranske/trip-planner Length of output: 840 Remove upgrade to v7.0.0—stay with v6 to maintain compatibility with The 🤖 Prompt for AI Agents |
||
| with: | ||
| ref: >- | ||
| ${{ github.event.pull_request.base.sha || | ||
|
|
@@ -91,7 +91,7 @@ jobs: | |
|
|
||
| - name: Checkout for API helpers | ||
| if: steps.eligibility.outputs.should-run == 'true' | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| sparse-checkout: | | ||
| .github/actions/setup-api-client | ||
|
|
@@ -518,7 +518,7 @@ jobs: | |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout runner library | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| sparse-checkout: | | ||
| scripts/runner_lib | ||
|
|
||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -40,7 +40,7 @@ jobs: | |||||
| name: Runtime CI | ||||||
| runs-on: ubuntu-latest | ||||||
| steps: | ||||||
| - uses: actions/checkout@v7 | ||||||
|
There was a problem hiding this comment. Pin checkout action to commit SHA instead of This file uses an unpinned tag reference ( Update line 43 to use the commit SHA with an inline version comment for consistency across the repository. 🔧 Proposed fix- - uses: actions/checkout@v7
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0📝 Committable suggestion
Suggested change
🧰 Tools🪛 zizmor (1.25.2)[warning] 43-43: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 43-43: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI AgentsSource: Coding guidelines |
||||||
|
|
||||||
| - name: Set up Python | ||||||
| uses: actions/setup-python@v6 | ||||||
|
|
||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do not patch synced
agents-*workflows locally.Line 170, Line 186, and Line 296 update a synced
agents-*.ymlworkflow in this repo. Per repo policy, this change needs to be made instranske/Workflowsand then synced here; otherwise local drift will be overwritten.As per coding guidelines,
.github/workflows/agents-*.ymlworkflows should be fixed instranske/Workflows, not locally.Also applies to: 186-186, 296-296
🤖 Prompt for AI Agents
Sources: Coding guidelines, Linked repositories