chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 - #291
Merged
mergify[bot] merged 1 commit intoAug 5, 2026
Conversation
dependabot
Bot
added
dependencies
Contributor
Merge Protections🟢 All 6 merge protections satisfied — ready to merge. Show 6 satisfied protections🟢 🤖 Continuous Integration
🟢 👀 Review Requirements
🟢 Enforce conventional commitMake sure that we follow https://www.conventionalcommits.org/en/v1.0.0/
🟢 🔎 Reviews
🟢 📕 PR description
🟢 🚦 Auto-queueWhen all merge protections are satisfied, this pull request will be queued automatically. |
mergify Bot
pushed a commit
that referenced
this pull request
Aug 5, 2026
CI has failed on every pull request since 2026-07-01. The last green run was 2026-06-30 (run 28426521860). Nothing in this repo changed: the only commits touching `.github/workflows/` since then are Dependabot tag bumps, and the `uses:` refs have looked like this for the repo's whole life. What changed is outside the repo. `tools/semgrep` runs `semgrep --config=auto`, which resolves the Community rule registry **at run time**, and that registry now carries `yaml.github-actions.security.github-actions-mutable-action-tag`. It reports 7 blocking findings — every `uses:` names a mutable tag instead of a 40-character commit SHA: | file | lines | |---|---| | `.github/workflows/ci.yaml` | 19, 20, 27, 43 | | `.github/workflows/release.yml` | 16, 17, 25 | That single red job is why ruff 0.15.19 → 0.16.0, actions/checkout, actions/setup-python and even Mergify's own configuration-deprecation PRs are all stuck. The loop is self-sustaining: Dependabot writes *mutable tags* when it bumps an action, so its own GHA bumps trip the rule they just re-introduced. #291 is literally "bump actions/checkout from 7.0.0 to 7.0.1" failing on the tag it wrote. ## The one that is not a lint nit `release.yml:25` was `pypa/gh-action-pypi-publish@release/v1` — a mutable **branch**, not even a tag, on the job that holds this project's PyPI publish rights (`environment: release`, `id-token: write`). A push to that branch upstream — by its owner or by anyone who compromises the repository — runs with permission to publish `sql-compare` to PyPI on the next release, and there is no version number to notice it by. This is the real supply-chain exposure here; it is pinned deliberately, not incidentally. ## What this does and does not cost Every ref is pinned to the SHA its current tag resolves to, so behaviour is unchanged today — including `gh-action-pypi-publish`, where `dc37677` (v1.14.2) is exactly where `release/v1` points right now. The trailing `# vX.Y.Z` comment keeps the file readable and is the field Dependabot rewrites. No new maintenance: Dependabot updates SHA-pinned actions natively and `.github/dependabot.yml` already enables the `github-actions` ecosystem. Verified locally against the exact CI image — `semgrep/semgrep:1.138.0` running `semgrep --config=auto --error --timeout=15 .` over the same 18 targets with the same 329 rules: **7 blocking findings before, 0 after.** ## What this does NOT fix — a call for @jd Pinning the semgrep *image* pins the **engine**, not the **rules**. `--config=auto` still resolves the registry live, which is precisely how this repo went red with zero commits, and it will happen again the next time the Community ruleset gains a rule this repo trips. Green today does not mean green tomorrow. Three options, none of them free: 1. **Pin a ruleset** — `--config=p/<ruleset>` or a versioned registry pin. Keeps CI reproducible; new upstream rules only arrive when someone bumps them, which is also the downside. 2. **Vendor the rules** — copy the rule YAML into the repo. Fully reproducible and diffable; someone has to own refreshing it. 3. **Accept the drift** — status quo. Zero effort, and the fleet occasionally goes red with no local cause. Note the monorepo has explicitly made this choice and recorded it in its root `CLAUDE.md`. Changing the security posture is a maintainer call, so this PR does not make it. It only unblocks CI.
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7.0.1
branch
from
August 5, 2026 13:52
2369941 to
36baced
Compare
Contributor
Merge Queue Status
This pull request spent 13 minutes 8 seconds in the queue, with no time running CI. ReasonThe pull request conflicts with the base branch The pull request was held in the queue, conflicting with 1 pull request ahead of it. The conflict became a base branch one after #293 merged. HintYou should update or rebase your pull request. If you want to requeue this pull request, you can post a Requeued — the merge queue status continues in this comment ↓. |
Contributor
|
@dependabot[bot] this pull request is now in conflict 😩 |
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7.0.1
branch
from
August 5, 2026 14:09
36baced to
ebc6fb3
Compare
Contributor
Merge Queue Status
This pull request spent 5 minutes 46 seconds in the queue, including 6 seconds running CI. Required conditions to merge
|
mergify
Bot
deleted the
dependabot/github_actions/actions/checkout-7.0.1
branch
August 5, 2026 14:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 7.0.0 to 7.0.1.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)