[Superseded] Bump actions/checkout from 7.0.0 to 7.0.1 - #111
[Superseded] Bump actions/checkout from 7.0.0 to 7.0.1#111dependabot[bot] wants to merge 3 commits into
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughCodeQL 워크플로에서 ChangesCodeQL 워크플로 업데이트
Estimated code review effort: 1 (매우 간단) | ~2분 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 20: Update the actions/checkout step in the CodeQL workflow to set
persist-credentials to false, ensuring checkout does not retain authentication
credentials for subsequent steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 1664636a-5a0d-48b8-bab0-2ae46ff000e5
📒 Files selected for processing (1)
.github/workflows/codeql.yml
|
@opencode-agent Please perform an independent review of exact current head |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/ContextualWisdomLab.github.io"
pr=111
expected_sha="7b4a7658254dc4fc84f7e735d2811009101c20a8"
echo '== Local checkout and exact commit =='
git rev-parse HEAD
git status --short
git show --no-ext-diff --format='commit=%H%nparents=%P%nsubject=%s' --stat HEAD
git diff-tree --no-commit-id --name-status -r HEAD
git diff --no-ext-diff "${expected_sha}^" "${expected_sha}" -- .github/workflows/codeql.yml
printf '\n== Workflow content ==\n'
cat -n .github/workflows/codeql.yml
echo '== Pull request metadata =='
gh pr view "$pr" --repo "$repo" --json number,url,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
echo '== Pull request review threads =='
gh api graphql -F owner="${repo%%/*}" -F name="${repo#*/}" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body commit { oid } createdAt }
}
}
}
}
}
}'
echo '== Repository policy files =='
fd -H -t f -a '^(CODEOWNERS|CONTRIBUTING(\..*)?|SECURITY(\..*)?|POLICY(\..*)?|README(\..*)?|coderabbit\.ya?ml)$' . \
-E .git -E node_modules -E dist -E build \
| sort
for f in $(fd -H -t f -a '^(CODEOWNERS|CONTRIBUTING(\..*)?|SECURITY(\..*)?|POLICY(\..*)?|coderabbit\.ya?ml)$' . -E .git -E node_modules -E dist -E build); do
echo "-- $f"
sed -n '1,240p' "$f"
done
echo '== Branch protection and repository rulesets =='
gh api "repos/$repo/branches/main/protection" 2>&1 || true
gh api "repos/$repo/rulesets" 2>&1 || trueLength of output: 22438 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/ContextualWisdomLab.github.io"
sha="7b4a7658254dc4fc84f7e735d2811009101c20a8"
base="44ea2827947d7cdde0063488f8da2ca50a373459"
pinned="3d3c42e5aac5ba805825da76410c181273ba90b1"
echo '== Complete pull request diff and changed paths =='
git diff --no-ext-diff --name-status "$base" "$sha"
git diff --no-ext-diff --check "$base" "$sha"
git diff --no-ext-diff "$base" "$sha" -- .github/workflows/codeql.yml
echo '== Upstream actions/checkout v7.0.1 ref =='
gh api "repos/actions/checkout/git/ref/tags/v7.0.1"
gh api "repos/actions/checkout/commits/v7.0.1" --jq '{sha: .sha, message: .commit.message}'
if [ "$(gh api "repos/actions/checkout/commits/v7.0.1" --jq -r .sha)" = "$pinned" ]; then
echo 'PIN_MATCH=true'
else
echo 'PIN_MATCH=false'
fi
echo '== Check runs associated with the requested commit =='
gh api --paginate "repos/$repo/commits/$sha/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion, .details_url, .head_sha] | `@tsv`'
echo '== Commit statuses associated with the requested commit =='
gh api "repos/$repo/commits/$sha/status" \
--jq '{state: .state, statuses: [.statuses[] | {context, state, target_url}]}'
echo '== Active ruleset definitions =='
for id in 18156473 17921151; do
echo "-- ruleset $id"
gh api "repos/$repo/rulesets/$id"
doneLength of output: 11248
I found no actionable findings.
[approve] You are interacting with an AI system. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Approved on exact head 7b4a765 after verifying the single-file immutable actions/checkout v7.0.1 pin update, explicit persist-credentials: false hardening, successful exact-head Security Scan and Semgrep workflows, successful CodeRabbit status, and zero unresolved review threads.
Dismissed because repository rules identify seonghobae as the last pusher; this approval cannot satisfy the required independent non-last-pusher review gate.
|
Superseded by #145. The current-main replacement preserves this PR's complete valid scope—immutable |
seonghobae
changed the title
Pull request was closed
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
|
Closing as superseded by PR #145. The replacement is based on current |
|
@coderabbitai review Review the exact live head only. Verify every intended CodeQL checkout use resolves to immutable actions/checkout v7.0.1, persisted credentials remain disabled, no workflow permission or analysis scope is broadened, and site/build/security checks plus repository protection pass. Review only; do not update the branch, merge, release, or alter protections. |
Rate Limit Exceeded
|
1 participant
Bumps actions/checkout from 7.0.0 to 7.0.1.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit