Bump actions/checkout from 4 to 7 - #107
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![prmerger-ai-pull-request-review[bot]](https://avatars.githubusercontent.com/u/273110951?s=60&v=4){kind=small}
There was a problem hiding this comment.
PRMerger Review
Machine-reviewed on a GitHub Actions runner. Build and test evidence is included below.
Run: https://github.com/skrcode/java-auto-unit-tests/actions/runs/28744771868
VERDICT: approve
SUMMARY:
This is a Dependabot-generated PR that performs a mechanical, consistent bump of actions/checkout from v4 to v7 across all four workflow files. All 8 occurrences of actions/checkout@v4 have been replaced — none remain. The Dependabot commit metadata explicitly declares dependency-version: '7' and update-type: version-update:semver-major, confirming the version was sourced from the actual actions/checkout GitHub releases. The repository's other ongoing Dependabot PRs (visible in git log) show similarly large major-version bumps for other actions (e.g., codecov/codecov-action 5→7, qodana-action 2024.2→2026.1), consistent with a 2026 dependency state. No other workflow logic was changed.
BUILD_AND_TEST:
No build or test command is applicable — this PR touches only GitHub Actions workflow YAML files. Correctness was verified through direct inspection: confirmed all 8 actions/checkout@v4 references were replaced with @v7, and no residual @v4 references remain (grep -rn "actions/checkout@v4" .github/ returned empty).
FINDINGS:
- none
FOLLOW_UPS: - The other first-party GitHub Actions (
actions/setup-java@v4,actions/upload-artifact@v4,actions/cache@v4) are still at v4; separate Dependabot PRs for those are visible in the git log and should be reviewed in turn.
Inline comments posted: 0 high-signal finding(s).
|
This pull request has been automatically marked as stale because it has not had recent activity. If you plan to continue work on this:
Thank you for your contribution! |
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)df4cb1cUpdate changelog for v6.0.3 (#2446)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)