chore(deps): bump actions/checkout from 4 to 7 - #41
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
srpatcha
left a comment
srpatcha
left a comment
There was a problem hiding this comment.
Approving. Target version verified to exist and be current, and the failing CI
here is not caused by this bump.
I checked every target in this batch against the upstream release list rather
than assuming Dependabot picked a real tag:
mymindstorm/setup-emsdk v16 latest v16 exists
actions/setup-java v6 latest v6.0.0 exists
pnpm/action-setup v6 latest v6.0.10 exists
actions/checkout v7 latest v7.0.1 exists
All current majors.
The red CI is not yours
Every job in this run fails with:
apps/epdf/epdf.h:5:10: fatal error: eapps_core.h: No such file or directory
master does not build, and has not for a while — 48 fatal errors from a clean
clone. The cause is .gitignore:61, a bare core rule intended for Unix core
dumps, which matches any file or directory named core at any depth and
therefore excluded core/, the source tree. core/common/include/eapps_core.h
is included by all 44 app targets and was never committed:
$ git ls-files | grep -c eapps_core.h
0
#42 fixes that. Once it lands, re-run these and the result will mean something.
Merging this before #42 is harmless — it cannot make a build that already fails
fail differently — but the check will stay red until #42 is in.
Worth noting for whoever triages these: a major-version bump of a GitHub Action
can carry breaking changes, and the usual way to find out is CI. That signal is
currently unavailable in this repository for reasons unrelated to any of these
four PRs, so approval here rests on the version existing and the diff being a
pure version string change — not on a green run.
srpatcha
left a comment
srpatcha
left a comment
There was a problem hiding this comment.
Review — eApps#41 "chore(deps): bump actions/checkout from 4 to 7"
head: a08ff6b author: app/dependabot ci: fail (11 of 11 substantive checks)
Verdict: The bump itself is mechanically correct and low-risk for this repo — I checked
the three intervening major releases against what these workflows actually use. What is
not fine is the context: every check on this PR fails, master was already failing before
it, and master has no required status checks, so nothing here distinguishes a safe bump
from a broken one.
Findings
| # | Severity | File:line | Finding | Recommended fix |
|---|---|---|---|---|
| 1 | High | repo setting: branches/master/protection |
GET /repos/embeddedos-org/eApps/branches/master/protection returns required_status_checks: null. Branch protection is on and requires reviews, but no check is required to pass. A PR that rewrites actions/checkout in all 27 workflow files can be merged with all 11 jobs red. This is the reason findings 2 and 3 have gone unaddressed. |
Set required status checks on master. At minimum Native (ubuntu-latest) and the JS/TS lane job, with strict: true. Do this before merging anything that touches every workflow at once. |
| 2 | High | .github/workflows/ci-native.yml, .github/workflows/ci.yml |
All 11 substantive checks fail: Native (ubuntu-latest), Native (macos-latest), Native (windows-latest), Sanitizers, JS/TS lane, and Category (connectivity/games/media/productivity/security/web). This PR is not the cause — gh run list --branch master shows CI concluding failure on 3d51c47a, 1e5fd083 and b433a430, all predating this PR. Two distinct pre-existing breakages, from the job logs: the native lanes fail with apps/etimer/etimer.h:5:10: fatal error: eapps_core.h: No such file or directory (same for etunnel, eplay, eftp, essh, snake, ezip — the app targets do not get core/common's include directory), and the JS/TS lane fails at pnpm install --frozen-lockfile with ERROR: Expected object but found - string, a malformed pnpm-lock.yaml/workspace file. |
These are two separate fixes and neither belongs in this PR. Open one issue per breakage and fix them first; a dependency bump against a red baseline carries no information. |
| 3 | Low | all 27 workflow files | The bump moves a mutable major tag (@v4 → @v7) rather than pinning a commit SHA. .github/workflows/scorecard.yml runs OpenSSF Scorecard and .github/STANDARDS.md:62 lists Scorecard as an org-wide security framework; Scorecard's Pinned-Dependencies check scores unpinned action references. Pre-existing — @v4 was unpinned too — but a change that touches every uses: line in the repo is the cheapest opportunity to fix it. |
Pin to actions/checkout@<sha> # v7.0.1 and let Dependabot's github-actions ecosystem update the comment. If the org has decided tags are acceptable, say so in STANDARDS.md so the Scorecard result is expected rather than unexplained. |
| 4 | Low | (repo-wide) | .github/dependabot.yml is absent from master. Dependabot was turned off org-wide — eDB's removal commit eaf4e1c records "Dependabot is disabled org-wide: config removed here, and alerts plus automated security fixes turned off via the API. 90 open Dependabot PRs". So this PR is an orphan: it will not be rebased, it will not be superseded, and if it is closed the bump will not be re-proposed. The bot's own comment on this PR about a missing github-actions label is moot for the same reason. |
Decide explicitly: merge it, or close it and record actions/checkout@v7 as a manual to-do. Leaving it open is the one option that produces nothing. |
Compatibility check on the bump itself
v4 → v7 skips two majors. Checked against this repo's workflows:
- v5.0.0 — moves to node24 and requires Actions runner ≥
v2.327.1.grep -rn "self-hosted" .github/workflows/returns nothing; every job is onubuntu-latest,macos-latestorwindows-latest, so the runner floor is met. - v6.0.0 — persists credentials to a separate file instead of git config.
- v7.0.0 — blocks checking out a fork PR under
pull_request_targetandworkflow_run.grep -rn "pull_request_target\|workflow_run" .github/workflows/returns nothing, so no job is affected.
actions/checkout@v7.0.1 exists (published 2026-07-20). The diff is a uniform
@v4 → @v7 substitution across 27 files with no other edits — I read every changed
line; there are exactly two distinct changed strings.
Architecture conformance
Not applicable in the layering sense — the diff touches only .github/workflows/, adds no
#include, import, link line or manifest dependency, and cannot violate §5.1. eApps sits
in Tier 4 (Developer Ecosystem, "Registry/eApps") per §21, and CI configuration belongs in
the repo it runs in. §21.1 is untouched.
The relevant standard is .github/STANDARDS.md §"Org-wide compliance frameworks" →
OpenSSF Scorecard, which finding 3 addresses.
Proposed changes
- Configure required status checks on
master(finding 1). Without this the other three
findings have no mechanism that would ever surface them. - Fix the two pre-existing CI breakages separately (finding 2): give the
apps/*targets
thecore/commoninclude path, and repair the pnpm workspace/lockfile. - Re-run this PR's checks once
masteris green. If they pass, merge; the bump is sound. - Optionally convert to SHA pins in the same commit (finding 3).
Not checked
- Whether the bump is safe under a working build. Every job failed before reaching
anything the checkout version could influence, so this PR has never actually been
exercised. My compatibility assessment above is from the release notes and a grep of the
workflow files, not from a green run. - The 27 workflow files' behaviour. I verified the diff is a pure tag substitution; I
did not review the workflows themselves for other defects. Sanitizersand the sixCategory (...)jobs. I read the logs for
Native (ubuntu-latest)and theJS/TS laneonly, and assumed the other nine share
those two root causes because they run the same build. Not confirmed job by job.- Whether any consumer pins eApps workflows. Out of scope for a bundle review.
Automated architecture review of a08ff6b931a2 — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.
1 participant
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)