chore(actions): move every actions/checkout pin to v7 - #70
Conversation
#69 unified the ten pins by dropping the new one back to v6. The consistency argument was right and the direction was wrong: v7.0.1 is current (released a week ago, 2026-07-20), v6 and v7 are both maintained, and there is no reason for the fleet to sit a major behind. Checked before bumping, because this file set deploys to every repo at once with no canary: - v7.0.0's headline change blocks checking out fork PR code — but only for `pull_request_target` and `workflow_run`. The guard reads the event name and returns early for anything else (src/unsafe-pr-checkout-helper.ts), so reusable-claude.yml's fork checkout, which runs on `issue_comment`, is not affected. That was the one change that could have broken the workflow this pin was argued over. - All ten call sites run on ubuntu-latest, so there is no self-hosted runner whose agent version could be too old for the action's newer runtime. The fork-PR block is a small win beyond currency: the fleet deliberately avoids `pull_request_target` (Anthropic's OIDC backend rejects it), and v7 makes that a hard failure rather than a convention someone can quietly break later. Not audited here: the other action pins (setup-node, upload-artifact, cache). Worth its own sweep rather than smuggling into a checkout bump. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011DKSBmZAgtkp3wfCB4TgMm
|
Claude finished @chrischall's task in 50s —— View job Review: actions/checkout v7 bump
SummaryThis PR bumps
Verdict: pass | |
|
✅ Auto-review verdict: pass — Clean version bump from v6 to v7 across 10 files with sound safety validation; no breaking changes to interfaces, composite actions, or fleet constraints. |
Follow-up to #69, which unified the ten
actions/checkoutpins by dropping the new one back to@v6. The consistency argument was right; the direction was wrong.v7.0.1is current (released 2026-07-20), both majors are maintained, and there's no reason the fleet should sit a major behind. Levelling up, not down.Checked before bumping
This file set deploys to every repo at once with no canary, so two things were worth verifying rather than assuming:
1. v7's fork-PR block doesn't affect us. v7.0.0's headline change is "block checking out fork pr for pull_request_target and workflow_run" (#2454) — which sounds alarming for
reusable-claude.yml, whose entire purpose is checking out fork PRs. The guard reads the event name and returns early for anything else:issue_comment/pull_request_review_comment/pull_request_revieware untouched. That was the one change that could have broken the workflow this pin was being argued over.2. No runner risk. All ten call sites run on
ubuntu-latest, so there's no self-hosted agent whose version might be too old for the action's newer runtime.A small bonus
The fleet deliberately avoids
pull_request_target(Anthropic's OIDC backend rejects it — see the note inreusable-pr-auto-review.yml). v7 turns that convention into a hard failure, so nobody can quietly reintroduce the fork-PR footgun later.Not in scope
The other action pins —
setup-node,upload-artifact,cache— weren't audited. That deserves its own sweep rather than being smuggled into a checkout bump.🤖 Generated with Claude Code
https://claude.ai/code/session_011DKSBmZAgtkp3wfCB4TgMm