💡 Fleet-Wide Action Version Currency Probe with checkout v7 Backport Readiness

[github-actions[bot]]

Summary

Add a fleet-wide CI probe that audits every SHA-pinned GitHub Action across all org workflows, detects versions approaching end-of-support or imminent behavioral changes, and surfaces a fleet-status dashboard. The immediate trigger is the actions/checkout v7 pwn-request protection backport landing July 16, 2026 — which will change behavior for any SHA-pinned v6 checkout in pull_request_target workflows — but the probe is durable as ongoing action-version hygiene for the 8-repo consumer fleet.

Market Signal

GitHub shipped actions/checkout v7 on June 18, 2026 with secure-by-default pwn-request blocking for pull_request_target workflows. The backport to all supported major versions lands July 16 — 6 days from now. Workflows pinned to a floating major tag (@v4, @v6) will auto-receive the change; SHA-pinned workflows (this fleet's standard) will not, but will be exposed when eventually forced to bump. The fleet is currently on checkout@v6.0.3 across 15+ workflow files.

Datadog's 2026 research found 71% of organizations never pin actions to SHA. The fleet's SHA-pinning discipline is an advantage — but only if version currency is actively tracked. The tj-actions/changed-files compromise (March 2025, 23K repos) and the TeamPCP Trivy attack proved that action version awareness is a first-class security surface, not optional hygiene.

Source: GitHub Changelog — Safer pull_request_target defaults, GitHub Actions checkout v7 migration deadline

User Signal

The fleet already has stub-drift detection (scripts/fleet_stub_drift.sh) and the template-drift guard in lint.yml (#969). But these track reusable-workflow drift, not the underlying GitHub Actions themselves. pull_request_target is used in add-to-project.yml and dependabot-automerge.yml — both thin caller stubs that may need the opt-in allow-unsafe-pr-checkout flag if their checkout-of-fork behavior is intentional. Related: fleet-monitor (#193), stub-drift auto-remediation (#1043/#1148).

Technical Opportunity

The fleet-monitor infrastructure (scripts/fleet_report.sh) and stub-drift detection provide the pattern. A new action-version-currency.sh script can grep all consumer-manifest repos for pinned action SHAs, resolve them to versions via the GitHub API, compare against latest releases, and flag any with known behavioral changes (like v7's pwn-request default). Output slots into the existing fleet-monitor dashboard and issue-filing infrastructure. The consumer-manifest.json already enumerates all 8 downstream repos and their workflow files.

Assessment

Dimension	Score	Rationale
Feasibility	high	Extends existing fleet-monitor and stub-drift infrastructure; grep + GitHub API version lookup
Impact	high	Prevents silent behavioral changes from action version drift; closes a gap stub-drift doesn't cover
Urgency	high	checkout v7 backport lands July 16, 2026 — 6 days away

Adversarial Review

Strongest objection: The immediate v7 urgency may be overstated — dependabot-automerge.yml checks out Dependabot's own PRs (same org namespace, not external forks), so the pwn-request block likely doesn't fire. The fleet's SHA-pinning means the backport doesn't auto-apply anyway. Is this a solution looking for a problem?

Rebuttal: The v7 backport is the catalyst, not the core value. The durable value is fleet-wide action version currency — the same discipline the fleet already applies to reusable workflows (stub-drift) extended to the actions themselves. The supply-chain attacks of 2025 proved that action version awareness is a security surface. Adding this dimension to the existing fleet monitor closes a gap the stub-drift guard doesn't cover, with minimal incremental cost (the fleet-monitor cron already runs weekly).

Suggested Next Step

Write action-version-currency.sh as a pure-function library (input: consumer manifest + workflow YAML paths; output: version-currency report) with bats tests, then wire it into the weekly fleet-monitor cron alongside the existing stub-drift check. Immediate deliverable: audit the fleet's checkout version status before the July 16 backport.