chore(deps): update actions/checkout action to v7 by renovate[bot] · Pull Request #16 · wave-av/sdk-python

renovate · 2026-06-20T08:14:58Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v6.0.3` → `v7.0.1`
actions/checkout	action	major	`v5.0.1` → `v7.0.1`
actions/checkout	action	major	`v4.3.1` → `v7.0.1`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.1.0`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2026-06-20T08:15:01Z

PR author is in the excluded authors list.

changeset-bot · 2026-06-20T08:15:02Z

⚠️ No Changeset found

Latest commit: eb88e93

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

wave-bugbot · 2026-06-20T10:27:36Z

🌊 WAVE BugBot — 7 finding(s)

🔴 6 · 🟠 1

🔴 P0.github/workflows/_checks.yml:23CWE-862 — Unpinned action tag (@v1 vs commit SHA)
Using a versioned tag (@v1) instead of a specific commit SHA for the actions/checkout action can lead to security vulnerabilities if the action is updated in a
🔴 P0.github/workflows/public-repo-guard.yml:45CWE-862 — Unpinned action tag (@v1 vs commit SHA)
Using a versioned tag (@v1) instead of a specific commit SHA for the actions/checkout action can lead to security vulnerabilities if the action is updated in a
🔴 P0.github/workflows/python-lint.yml:23CWE-862 — Unpinned action tag (@v1 vs commit SHA)
Using a versioned tag (@v1) instead of a specific commit SHA for the actions/checkout action can lead to security vulnerabilities if the action is updated in a
🔴 P0.github/workflows/_checks.yml:23CWE-89 — Unpinned action tag (@v1 vs commit SHA)
Using a specific version of an action (e.g., @v7.0.0) instead of a commit SHA can lead to unexpected behavior if the action is updated in the future.
🔴 P0.github/workflows/public-repo-guard.yml:45CWE-89 — Unpinned action tag (@v1 vs commit SHA)
Using a specific version of an action (e.g., @v7.0.0) instead of a commit SHA can lead to unexpected behavior if the action is updated in the future.
🔴 P0.github/workflows/python-lint.yml:23CWE-89 — Unpinned action tag (@v1 vs commit SHA)
Using a specific version of an action (e.g., @v7.0.0) instead of a commit SHA can lead to unexpected behavior if the action is updated in the future.
🟠 P1.github/workflows/_checks.yml:23CWE-426 — Unpinned search_path in SECURITY DEFINER function
The search_path is not pinned, which could allow an attacker to shadow your functions or objects.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

devin-ai-integration

Devin Review found 2 potential issues.

devin-ai-integration · 2026-08-14T17:24:18Z

 runs-on: ubuntu-latest
 steps:
- - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1


🔍 Checkout step here still lacks persist-credentials: false unlike all others
Every other checkout in the repo (.github/workflows/_checks.yml:23, :54, :114 and .github/workflows/python-lint.yml:23-25) sets with: persist-credentials: false, but this guard job leaves the default. Note actions/checkout v7 still persists credentials by default, so the inconsistency remains after the bump; worth aligning while touching the line.
Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-14T17:24:19Z

 runs-on: ubuntu-latest
 steps:
- - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1


🟨 Checkout step in the public-repo-guard workflow leaves credentials on disk
The checkout step in .github/workflows/public-repo-guard.yml:45 is the only one in the repo without persist-credentials: false (compare .github/workflows/_checks.yml:24-25 and .github/workflows/python-lint.yml:24-25). The workflow subsequently downloads and executes a third-party binary (gitleaks) and runs a repo-vendored shell script over PR-controlled content, all while the GITHUB_TOKEN remains written into .git/config, making token theft possible if any of that step's inputs are compromised.
Was this helpful? React with 👍 or 👎 to provide feedback.

macroscopeapp · 2026-08-14T17:24:59Z

Approvability

Verdict: Needs human review

Mechanical dependency update of actions/checkout to v7 across CI workflows. However, all changed files are owned by wave-av/core-team, not the author (Renovate bot), so designated owners should review.

No code changes detected at 8351e4b. Prior analysis still applies.

^{You can customize Macroscope's approvability policy. Learn more.}

codeant-ai · 2026-08-27T00:44:40Z

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

renovateBotforce-pushed the renovate/actions-checkout-7.x branch 2 times, most recently from 591ee58 to eb88e93Compare July 22, 2026 05:10

renovateBotforce-pushed the renovate/actions-checkout-7.x branch from eb88e93 to 28390c8Compare August 14, 2026 17:23

devin-ai-integrationBot reviewed Aug 14, 2026
View reviewed changes

chore(deps): update actions/checkout action to v7
8351e4b

renovateBotforce-pushed the renovate/actions-checkout-7.x branch from 28390c8 to 8351e4bCompare August 27, 2026 00:44

Navigation Menu

Uh oh!

chore(deps): update actions/checkout action to v7 - #16

chore(deps): update actions/checkout action to v7#16
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/actions-checkout-7.x

renovateBot commented Jun 20, 2026•
edited
Loading

Uh oh!

greptile-appsBot commented Jun 20, 2026

Uh oh!

changeset-botBot commented Jun 20, 2026•
edited
Loading

Uh oh!

wave-bugbotBot commented Jun 20, 2026

Uh oh!

devin-ai-integrationBot left a comment

Uh oh!

devin-ai-integrationBotAug 14, 2026

Uh oh!

devin-ai-integrationBotAug 14, 2026

Uh oh!

macroscopeappBot commented Aug 14, 2026•
edited
Loading

Uh oh!

codeant-aiBot commented Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovateBot commented Jun 20, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v7.0.1

v7.0.0

v6.1.0

Configuration

Uh oh!

greptile-appsBot commented Jun 20, 2026

Uh oh!

changeset-botBot commented Jun 20, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

wave-bugbotBot commented Jun 20, 2026

🌊 WAVE BugBot — 7 finding(s)

Uh oh!

devin-ai-integrationBot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integrationBotAug 14, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integrationBotAug 14, 2026

Choose a reason for hiding this comment

Uh oh!

macroscopeappBot commented Aug 14, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Approvability

Uh oh!

codeant-aiBot commented Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovateBot commented Jun 20, 2026•
edited
Loading

`v7.0.1`

`v7.0.0`

`v6.1.0`

changeset-botBot commented Jun 20, 2026•
edited
Loading

macroscopeappBot commented Aug 14, 2026•
edited
Loading