Skip to content

chore: bump actions/checkout from 4 to 7 - #1

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-7
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026 •

Copy link
Copy Markdown

Bumps actions/checkout from 4 to 7.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

@dependabot
dependabot Bot requested a review from paulmann as a code owner October 24, 2026 18:41
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 24, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions/checkout-7 branch from 7117151 to bf0d31e Compare October 30, 2026 19:05
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions/checkout-7 branch from bf0d31e to 73a8f86 Compare October 30, 2026 19:24
paulmann pushed a commit that referenced this pull request Oct 30, 2026
Dependabot opened #1 (actions/checkout 4 -> 7) and #2 (actions/setup-python
5 -> 7) against the previous ci.yml. That file has since been rewritten with a
package and a container job, so merging either PR would conflict and neither
could be reviewed against the current pipeline.

The bump is applied here in one reviewed change instead: every workflow, the
composite action, the PACKAGING guide, the six READMEs, the examples and the
wiki install pages now pin actions/checkout@v7 and actions/setup-python@v7.
The upload/download-artifact steps stay on v4: Dependabot did not propose them,
and they are not part of this change. CI on this commit is the proof that the
majors work together; the two Dependabot pull requests are closed as superseded.
@paulmann

Copy link
Copy Markdown
Owner

Closing as superseded by the reviewed bump in commit 302001c.

ci.yml was rewritten in this release cycle (a package job and a container job were added),
so neither Dependabot branch could be merged without conflicts, and neither could be reviewed
against the current pipeline. The bump is applied in one change instead:

  • actions/checkout: v4 -> v7 (all workflows, action.yml, examples, docs, wiki)
  • actions/setup-python: v5 -> v7 (same set)
  • actions/upload-artifact / download-artifact stay on v4: not part of these two PRs.

Evidence that the majors work together: CI run 41117734551 on 302001c — 5/5 jobs green,
including the container build and the clean-venv package install.

@paulmann paulmann closed this Oct 30, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/github_actions/actions/checkout-7 branch October 30, 2026 19:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant