chore(deps): bump actions/checkout from 4.3.1 to 6.0.2#19
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v4.3.1...v6.0.2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughThis PR standardizes the pinned version of the Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 17: The workflow uses a mutable tag for actions/checkout
("actions/checkout@v6.0.2") which should be pinned to a resolved commit SHA for
supply-chain security; update both occurrences (the one at line 17 and the one
at line 40 referenced in the comment) to the specific commit SHA that
corresponds to v6.0.2 (replace "actions/checkout@v6.0.2" with
"actions/checkout@<resolved-commit-sha>") so the workflow references an
immutable commit instead of a tag.
In @.github/workflows/gitleaks.yml:
- Line 32: Replace the mutable tag for the actions/checkout step (currently
"actions/checkout@v6.0.2") with an immutable commit SHA to prevent supply-chain
risk; locate the workflow step that uses "actions/checkout" and change the
version reference to the full commit SHA of the v6.0.2 release (or the desired
release commit) so the action is pinned immutably.
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 4ffce3ec-8c08-474f-8171-2a26fa651cfa
📒 Files selected for processing (6)
.github/workflows/cargo-deny.yml.github/workflows/ci.yml.github/workflows/commitlint.yml.github/workflows/dependency-review.yml.github/workflows/gitleaks.yml.github/workflows/link-check.yml
| runs-on: ubuntu-22.04 | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v6.0.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the commit SHA for actions/checkout v6.0.2 and locate mutable pins in workflows.
set -euo pipefail
echo "Resolved commit SHA for actions/checkout v6.0.2:"
gh api /repos/actions/checkout/tags --paginate --jq '.[] | select(.name=="v6.0.2") | .commit.sha'
echo
echo "Checkout references in workflow files:"
rg -nP 'uses:\s*actions/checkout@' .github/workflowsRepository: Sentriscloud/sentrix-grpc-wasm
Length of output: 884
Pin actions/checkout to a resolved commit SHA instead of the v6.0.2 tag.
Lines 17 and 40 in ci.yml use a mutable tag reference, which violates supply-chain security best practices. Pin to the resolved commit SHA.
Suggested fix
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2Also applies to: Line 40
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 17-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 17, The workflow uses a mutable tag for
actions/checkout ("actions/checkout@v6.0.2") which should be pinned to a
resolved commit SHA for supply-chain security; update both occurrences (the one
at line 17 and the one at line 40 referenced in the comment) to the specific
commit SHA that corresponds to v6.0.2 (replace "actions/checkout@v6.0.2" with
"actions/checkout@<resolved-commit-sha>") so the workflow references an
immutable commit instead of a tag.
There was a problem hiding this comment.
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 17, The workflow uses a mutable tag for
actions/checkout ("actions/checkout@v6.0.2") which should be pinned to a
resolved commit SHA for supply-chain security; update both occurrences (the one
at line 17 and the one at line 40 referenced in the comment) to the specific
commit SHA that corresponds to v6.0.2 (replace "actions/checkout@v6.0.2" with
"actions/checkout@") so the workflow references an
immutable commit instead of a tag.
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Resolved commit SHA for actions/checkout v6.0.2 ==="
gh api /repos/actions/checkout/tags --paginate --jq '.[] | select(.name=="v6.0.2") | .commit.sha'
echo
echo "=== All actions/checkout references in workflow files ==="
rg -nP 'uses:\s*actions/checkout@' .github/workflows/
Length of output: 836
@satyakwok The resolved commit SHA for actions/checkout@v6.0.2 is de0fac2e4500dabe0009e67214ff5f5447ce83dd.
Findings:
- ✅ Already correctly pinned:
cargo-deny.yml,commitlint.yml,dependency-review.yml,link-check.yml - ❌ Still using mutable tag
@v6.0.2:ci.yml(lines 17 & 40) andgitleaks.yml(line 32)
Here are the fixes needed:
- Pin
ci.ymllines 17 and 40 to the resolved commit SHA - Pin
gitleaks.ymlline 32 to the resolved commit SHA
🧠 Learnings used
Learnt from: satyakwok
Repo: Sentriscloud/sentrix-grpc-wasm PR: 16
File: .github/workflows/commitlint.yml:16-16
Timestamp: 2026-05-13T17:32:01.876Z
Learning: When pinning GitHub Actions to a SHA in workflow YAML (e.g., `uses: <owner>/<repo>@<sha>`), pin to the **commit SHA** that the tag resolves to—not the SHA of the annotated tag object. For annotated tags, `gh api /repos/<owner>/<repo>/git/refs/tags/<tag>` returns the tag-object SHA (incorrect for `uses@<sha>` pinning). Instead, obtain the commit SHA with `gh api /repos/<owner>/<repo>/tags --jq '.[] | select(.name=="<tag>") | .commit.sha'` and pin to that value. GitHub Actions resolves `uses@<sha>` at runtime to the commit, so the pinned SHA must match the resolved commit SHA.
- 📌 Commit the changes to this branch
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. An unexpected error occurred while generating fixes: Bad credentials - https://docs.github.com/rest |
dependabot
Bot
deleted the
dependabot/github_actions/actions/checkout-6.0.2
branch
1 participant
Bumps actions/checkout from 4.3.1 to 6.0.2.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Commits
de0fac2Fix tag handling: preserve annotations and explicit fetch-tags (#2356)064fe7fAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...8e8c483Clarify v6 README (#2328)033fa0dAdd worktree support for persist-credentials includeIf (#2327)c2d88d3Update all references from v5 and v4 to v6 (#2314)1af3b93update readme/changelog for v6 (#2311)71cf226v6-beta (#2298)069c695Persist creds to a separate file (#2286)ff7abcdUpdate README to include Node.js 24 support details and requirements (#2248)08c6903Prepare v5.0.0 release (#2238)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit