From 20d738320ac404552fe909244729100ab66f1f8b Mon Sep 17 00:00:00 2001 From: jnasbyupgrade Date: Tue, 4 Aug 2026 16:29:18 -0500 Subject: [PATCH] ci: bump actions/checkout to v7 across all workflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit actions/checkout was pinned to v4 in claude.yml and claude-code-review.yml (both flagged as stale — Node.js 20 deprecation warnings), and to v5 in ci.yml. The actual current latest major is v7, so bump all three to v7 rather than stopping at v5. v7 adds a new opt-in gate (`allow-unsafe-pr-checkout`) that refuses to check out fork PR code under `pull_request_target` or `workflow_run` by default, to prevent "pwn request" style vulnerabilities. claude-code-review.yml's "Check out PR head" step does exactly that (pull_request_target, checking out `github.event.pull_request.head.repo.full_name` from a fork), so `allow-unsafe-pr-checkout: true` is added there to preserve existing behavior. This is safe in this workflow because the job is already gated to the trusted jnasbyupgrade fork only, the checkout is read-only (persist-credentials: false), and PR code is never built or executed. v5's Node 24 runtime bump and v6's credential-persistence rework (stored in a separate file under $RUNNER_TEMP rather than .git/config) require no workflow changes per upstream release notes. anthropics/claude-code-action stays pinned at v1 in both Claude workflows — checked releases/tags on the action's repo and no v2 exists yet. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 2 +- .github/workflows/claude-code-review.yml | 8 +++++++- .github/workflows/claude.yml | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index aad0d23..36d3396 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: - name: Start PostgreSQL ${{ matrix.pg }} run: pg-start ${{ matrix.pg }} - name: Check out the repo - uses: actions/checkout@v5 + uses: actions/checkout@v7 - name: Test on PostgreSQL ${{ matrix.pg }} run: pg-build-test diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 6585d24..63b0b25 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -78,12 +78,18 @@ jobs: if: steps.gate.outputs.decision == 'run' # Intentionally tracks the major-version tag (not a pinned SHA) so # upstream fixes are picked up automatically. - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: repository: ${{ github.event.pull_request.head.repo.full_name }} ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 1 persist-credentials: false + # v7 refuses to check out fork PR code under pull_request_target + # unless explicitly opted in. Safe here: this job is already gated + # to the trusted jnasbyupgrade fork only (see the `if:` above), the + # checkout is read-only (persist-credentials: false), and PR code is + # never built or executed. + allow-unsafe-pr-checkout: true - name: Run Claude Code Review if: steps.gate.outputs.decision == 'run' diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 7d1656c..dc559d1 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -36,7 +36,7 @@ jobs: - name: Checkout repository # Intentionally tracks the major-version tag (not a pinned SHA) so # upstream fixes are picked up automatically. - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 1 persist-credentials: false