chore(deps): update actions/checkout action to v7.0.1 - #2799
Merged
Conversation
github-actions
Bot
added
the
agents:allow-change
Contributor
Automated Status SummaryHead SHA: afdc1be
Coverage Overview
Updated automatically; will refresh on subsequent CI/Docker completions. Keepalive checklistScopeNo scope information available Tasks
Acceptance criteria
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| manifest: artifacts/reference/manifest.json | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
Contributor
Workflow source neededPR #2799 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely. Please do one of:
Once a valid source is present, this warning will not be reposted. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 51800a5e2d
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| && matrix.python-version == env.PRIMARY_PYTHON_VERSION | ||
| }} | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
When this checkout pin changes, the existing test_artifact_names_normalized regression test still expects actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 for this exact LangSmith helper step (tests/workflows/test_reusable_ci_workflow.py:218-220). As a result, the workflow test suite will fail on this dependency bump until the expected SHA is updated alongside the workflow.
Useful? React with 👍 / 👎.
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
This workflow is read verbatim by test_workflow_has_no_write_or_apply_surface, which still asserts that the old checkout SHA is present (tests/scripts/test_consumer_sync_shadow_handoff.py:124-137). With this line now on 3d3c42e..., that existing test fails even though the workflow intent is unchanged, so the fixture/assertion needs to be updated with the pin bump.
Useful? React with 👍 / 👎.
This was referenced Jul 24, 2026
stranske
added a commit
that referenced
this pull request
Jul 24, 2026
#2815) Health 74 Template Drift has been red on main since 2026-07-20, forcing an admin override on every Workflows merge. Root cause is NOT unintended drift: Renovate/dep-pin bumps (#2799 actions/checkout v7.0.1, #2776 coverage pins) moved the consumer templates' pinned action SHAs, so 13 already-allowlisted entries' recorded fingerprints went stale. Verified via `git log --since=<last baseline>` that the only commits touching these 13 workflow files since the last re-baseline were those dependency bumps (root workflows keep floating major tags by design; consumer templates SHA-pin per the fleet action-pin contract, docs/HISTORY.md / PR #1925). The divergence is the intentional action-pin-contract drift, not a missing consumer improvement — so per the allowlist's own documented process, refresh the fingerprints rather than align (aligning would strip the required consumer pins). Refreshed main/template sha256 for: belt 71/72/73, auto-label, autofix-dispatcher, capability-check, decompose, dedup, guard, issue-optimizer, keepalive-loop-reporter, verifier, weekly-metrics. Per-entry reasons preserved; dated re-baseline note added to the header. check_template_drift.py now reports "unallowlisted drift: 0" (exit 0). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
stranske
added a commit
that referenced
this pull request
Jul 24, 2026
…summary) (#2821) * Make template-drift check pin-tolerant so Renovate bumps stop reddening it Health 74 Template Drift went red on main after every Renovate action-pin bump (#2799, and #2795 queued next), forcing a manual allowlist re-baseline each time — the 4th such re-baseline just landed (#2815). Root cause: normalize_text only stabilized line endings/whitespace, so a `uses: <action>@<sha> # vX` bump changed the fingerprint and staled the allowlist, even though consumer templates SHA-pin by contract while root floats major tags (an intentional, permanent divergence). Fix at the source: canonicalize GitHub Actions `uses:` refs in normalize_text — `uses: <action>@<ref>` (+ trailing `# vX` comment) collapses to `<action>@<pinned>`. The action PATH is preserved, so swapping to a different action is still drift and genuine logic changes still register; only the mutable pin ref is ignored. This makes action-pin bumps and the pinned-vs-floating divergence invisible to the check, so the allowlist stops going stale on dependency bumps. - scripts/check_template_drift.py: add _canonicalize_action_refs; apply in normalize_text. - tests: 6 new cases — SHA bump not drift, pinned==floating, different action still drift, reusable-workflow ref bump not drift / path change is, and a deliberate-break proving real logic drift still fails despite canonicalization. - config/template-drift-allowlist.txt: regenerated all 15 fingerprints under the new normalization (reasons preserved; 2026-07-24b note added). Verified: a simulated checkout SHA bump leaves the checker green (exit 0) with NO re-baseline; a real logic change still fails (exit 1). 25 drift tests pass. Workflows-repo-internal check only (consumers never run it) — no fleet blast radius. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Apply ruff format to drift-check tests Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Make backplane reference-run staleness non-blocking for the required suite The backplane registry's reference-run evidence has a 7-day freshness window (stale_after_hours=168). When it lapses, validate_registry() emitted a plain finding, so test_registry_has_no_tbd_placeholders_and_validates — which runs in `python ci` (the REQUIRED `summary` check) on every PR — went red, blocking ALL Workflows PRs until someone manually refreshed the evidence. There is no scheduled refresh, so this recurs weekly (it tripped 2026-07-24 ~14:29Z at 170.8h). Freshness is an OPERATIONAL concern, not a structural defect: an aged-but- well-formed reference run does not make the registry invalid. Separate the two: - Finding gains a `severity` field ("error" default; "stale" for the freshness lapse). Add blocking_findings() = structural (error) findings only. - The general structural test asserts blocking_findings(...) == [], tolerating a stale finding — so the required suite stops going red for unrelated PRs. - The CLI (`main`) and the dedicated, NON-required backplane lane (health-78, path-triggered) still exit 1 on staleness, so the freshness signal is preserved where it belongs instead of gating the whole fleet. - Tests: staleness is classified non-blocking; a deliberate-break proves structural defects (missing sha256) still block. Future-dated/malformed timestamps remain blocking errors. Scope: only reference-run staleness is reclassified. Deeper follow-up (auto- refresh the reference run, or schedule the conformance run) left for later. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Apply black formatting (repo uses black, not ruff format) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
stranske
added a commit
that referenced
this pull request
Jul 24, 2026
#2817) * Make template-drift check pin-tolerant so Renovate bumps stop reddening it Health 74 Template Drift went red on main after every Renovate action-pin bump (#2799, and #2795 queued next), forcing a manual allowlist re-baseline each time — the 4th such re-baseline just landed (#2815). Root cause: normalize_text only stabilized line endings/whitespace, so a `uses: <action>@<sha> # vX` bump changed the fingerprint and staled the allowlist, even though consumer templates SHA-pin by contract while root floats major tags (an intentional, permanent divergence). Fix at the source: canonicalize GitHub Actions `uses:` refs in normalize_text — `uses: <action>@<ref>` (+ trailing `# vX` comment) collapses to `<action>@<pinned>`. The action PATH is preserved, so swapping to a different action is still drift and genuine logic changes still register; only the mutable pin ref is ignored. This makes action-pin bumps and the pinned-vs-floating divergence invisible to the check, so the allowlist stops going stale on dependency bumps. - scripts/check_template_drift.py: add _canonicalize_action_refs; apply in normalize_text. - tests: 6 new cases — SHA bump not drift, pinned==floating, different action still drift, reusable-workflow ref bump not drift / path change is, and a deliberate-break proving real logic drift still fails despite canonicalization. - config/template-drift-allowlist.txt: regenerated all 15 fingerprints under the new normalization (reasons preserved; 2026-07-24b note added). Verified: a simulated checkout SHA bump leaves the checker green (exit 0) with NO re-baseline; a real logic change still fails (exit 1). 25 drift tests pass. Workflows-repo-internal check only (consumers never run it) — no fleet blast radius. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Apply ruff format to drift-check tests Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v7.0.0→v7.0.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.