Update actions/checkout action to v7 - #66
Conversation
Kimchi Code Review
Summary📊 Review Score: 15/100 (overall code quality — 0 lowest, 100 highest) 🧪 Tests: no — No test files were modified alongside the workflow change. The updated workflow should at minimum be validated by a successful CI run before merge. 🔒 Security concerns found: The PR pins 📝 Found 2 issue(s). See inline comments for details. What to expectKimchi will analyze the changes in this pull request and post:
The review typically completes within a few minutes. This comment will be updated once the review is ready. Interact with Kimchi
ConfigurationReviews are configured by your organization admin. Powered by Kimchi — AI-powered code review by CAST AI |
![kimchi-review[bot]](https://avatars.githubusercontent.com/in/3223788?s=60&v=4){kind=small}
There was a problem hiding this comment.
📊 Review Score: 15/100 (overall code quality — 0 lowest, 100 highest)
⏱️ Estimated effort to review: 1/5 (1 = trivial, 5 = very complex)
🧪 Tests: no — No test files were modified alongside the workflow change. The updated workflow should at minimum be validated by a successful CI run before merge.
🔒 Security concerns found: The PR pins actions/checkout to a commit commented as # v7. The official actions/checkout action does not have a v7 release (the current major version is v4). Using a non-existent or potentially compromised major version of a privileged action that handles repository checkout and GITHUB_TOKEN introduces critical supply-chain risk.
📝 Found 2 issue(s). See inline comments for details.
| steps: | ||
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | ||
| - name: Setup Go |
There was a problem hiding this comment.
🚨🔒 Security
The workflow updates actions/checkout to commit 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with the comment # v7. The official actions/checkout action has no v7 release; the current major version is v4. Using a non-existent or unverified major version of a core privileged action that checks out repository source code and handles the GITHUB_TOKEN exposes the build pipeline to severe supply chain compromise, including potential exfiltration of secrets or source code.
💡 Suggestion: Reject this update. Restore the verified pinned SHA for the latest official v4 release (11bd71901bbe5b1630ceea73d27597364c9af683 for v4.2.2) or another officially documented release, confirming the SHA against the actions/checkout GitHub repository.
| steps: | ||
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | ||
| - name: Setup Go |
There was a problem hiding this comment.
The comment # v7 attached to the new actions/checkout SHA is misleading because it mismatches the official release versioning of the action. A mismatched version comment makes future dependency auditing, security scanning, and Renovate automation unreliable.
💡 Suggestion: If updating is required, ensure the comment accurately reflects the verified major or full semantic version of the pinned commit hash (for example, # v4.2.2).
633e71c to
fb63cc9
Compare
This PR contains the following updates:
v4→v7Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
v5.1.0Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
v5Compare Source
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.