chore(deps): update actions/checkout action to v5 #630
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=80&v=4){kind=small}
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Diagnostics Comparison:Click to expand
|
CodSpeed Performance ReportMerging #630 will not alter performanceComparing Summary
|
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@v5 |
There was a problem hiding this comment.
| - uses: actions/checkout@v5 | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 |
The checkout action uses a tag reference @v5 instead of the commit hash format used by other workflows in this repository, creating an inconsistent security approach.
View Details
Analysis
Inconsistent GitHub Actions pinning in provenance.yml breaks security pattern
What fails: provenance.yml uses tag reference actions/checkout@v5 instead of commit hash pinning used by 4 other workflows, creating inconsistent security approach in the repository
How to reproduce:
grep "checkout@" .github/workflows/*.yml
# Shows 4 files using: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
# Shows 2 files using: actions/checkout@v5Result: Inconsistent pinning approach - 4 workflows use secure commit hash pinning, 2 use mutable tag references
Expected: All workflows should use the same commit hash format for consistency and security, per StepSecurity best practices which recommends commit hash pinning for immutability against supply chain attacks
Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.
This PR contains the following updates:
v4->v5Release Notes
actions/checkout (actions/checkout)
v5Compare Source
Configuration
📅 Schedule: Branch creation - "on Monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.