⚠️ MAJOR: Update actions/checkout action to v7

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | major | `v4` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](https://github.com/actions/checkout/compare/v7...v7.0.1) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](https://github.com/actions/checkout/pull/2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](https://github.com/actions/checkout/pull/2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](https://github.com/actions/checkout/pull/2530) - Various dependency updates ### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](https://github.com/actions/checkout/compare/v7...v7) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://github.com/aiqiaoy) in [#2454](https://github.com/actions/checkout/pull/2454) - Various dependency updates ### [`v7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](https://github.com/actions/checkout/compare/v6.1.0...v7) - Skip running unsafe pr check if input is default by [@aiqiaoy](https://github.com/aiqiaoy) in [#2518](https://github.com/actions/checkout/pull/2518) - Trim only ascii whitespace for branch by [@aiqiaoy](https://github.com/aiqiaoy) in [#2521](https://github.com/actions/checkout/pull/2521) - Escape values passed to --unset by [@aiqiaoy](https://github.com/aiqiaoy) in [#2530](https://github.com/actions/checkout/pull/2530) - Various dependency updates ### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0) [Compare Source](https://github.com/actions/checkout/compare/v6.0.3...v6.1.0) #### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2500](https://github.com/actions/checkout/pull/2500) - backport fixes to releases-v6 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2527](https://github.com/actions/checkout/pull/2527) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <https://github.com/actions/checkout/compare/v6.0.3...v6.1.0> ### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](https://github.com/actions/checkout/compare/v6.0.2...v6.0.3) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](https://github.com/actions/checkout/pull/2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](https://github.com/actions/checkout/pull/2414) ### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602) [Compare Source](https://github.com/actions/checkout/compare/v6.0.1...v6.0.2) - Fix tag handling: preserve annotations and explicit fetch-tags by [@ericsciple](https://github.com/ericsciple) in [#2356](https://github.com/actions/checkout/pull/2356) ### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601) [Compare Source](https://github.com/actions/checkout/compare/v6...v6.0.1) - Add worktree support for persist-credentials includeIf by [@ericsciple](https://github.com/ericsciple) in [#2327](https://github.com/actions/checkout/pull/2327) ### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600) [Compare Source](https://github.com/actions/checkout/compare/v6...v6) - Persist creds to a separate file by [@ericsciple](https://github.com/ericsciple) in [#2286](https://github.com/actions/checkout/pull/2286) - Update README to include Node.js 24 support details and requirements by [@salmanmkc](https://github.com/salmanmkc) in [#2248](https://github.com/actions/checkout/pull/2248) ### [`v6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603) [Compare Source](https://github.com/actions/checkout/compare/v5.1.0...v6) - Fix checkout init for SHA-256 repositories by [@yaananth](https://github.com/yaananth) in [#2439](https://github.com/actions/checkout/pull/2439) - fix: expand merge commit SHA regex and add SHA-256 test cases by [@yaananth](https://github.com/yaananth) in [#2414](https://github.com/actions/checkout/pull/2414) ### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0) [Compare Source](https://github.com/actions/checkout/compare/v5.0.1...v5.1.0) #### What's Changed - **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2501](https://github.com/actions/checkout/pull/2501) - backport fixes to releases-v5 by [@aiqiaoy](https://github.com/aiqiaoy) in [#2523](https://github.com/actions/checkout/pull/2523) <https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change **Full Changelog**: <https://github.com/actions/checkout/compare/v5.0.1...v5.1.0> ### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](https://github.com/actions/checkout/compare/v5...v5.0.1) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](https://github.com/actions/checkout/pull/2301) ### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500) [Compare Source](https://github.com/actions/checkout/compare/v5...v5) - Update actions checkout to use node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#2226](https://github.com/actions/checkout/pull/2226) ### [`v5`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501) [Compare Source](https://github.com/actions/checkout/compare/v4.4.0...v5) - Port v6 cleanup to v5 by [@ericsciple](https://github.com/ericsciple) in [#2301](https://github.com/actions/checkout/pull/2301) </details> --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added the

major-upgrade

renovate

labels

2026-09-20 08:01:40 -04:00

renovate-bot added 1 commit

2026-09-20 08:01:40 -04:00

⚠️ MAJOR: Update actions/checkout action to v7

validate / validate (pull_request) Successful in 26s

Details

b4f10869dc

mysticalsoap commented

2026-09-20 13:05:59 -04:00

Owner

Verified from the branch's own CI run (run 312, the one that loaded actions/checkout@v7):

Action fetched from the data.forgejo.org mirror at ref=v7, ran under the runner's node:22-bookworm job image with no runtime warning. The declared Node 24 runtime is not enforced by forgejo-runner.
fetch-depth: 0 still gives gitleaks the full history: 763 commits scanned, no leaks.
v6 credential change: the token now lives in a temp file under RUNNER_TEMP via includeIf, not .git/config's extraheader, and the post step removes it. Nothing here depends on the old layout.
The v5.1/v6.1/v7 breaking change (blocking fork checkouts) only applies to pull_request_target and workflow_run; this workflow uses pull_request.

Nothing live is touched, no deploy on merge.

Verified from the branch's own CI run (run 312, the one that loaded `actions/checkout@v7`): - Action fetched from the data.forgejo.org mirror at `ref=v7`, ran under the runner's `node:22-bookworm` job image with no runtime warning. The declared Node 24 runtime is not enforced by forgejo-runner. - `fetch-depth: 0` still gives gitleaks the full history: 763 commits scanned, no leaks. - v6 credential change: the token now lives in a temp file under `RUNNER_TEMP` via `includeIf`, not `.git/config`'s `extraheader`, and the post step removes it. Nothing here depends on the old layout. - The v5.1/v6.1/v7 breaking change (blocking fork checkouts) only applies to `pull_request_target` and `workflow_run`; this workflow uses `pull_request`. Nothing live is touched, no deploy on merge.

mysticalsoap merged commit 1fdbefbfd2 into trunk

2026-09-20 13:46:49 -04:00

mysticalsoap deleted branch renovate/actions-checkout-7.x

2026-09-20 13:46:49 -04:00

mysticalsoap referenced this pull request from a commit

2026-09-20 13:46:51 -04:00

Merge pull request '⚠️ MAJOR: Update actions/checkout action to v7' (#297) from renovate/actions-checkout-7.x into trunk

Rows
Columns

⚠️ MAJOR: Update actions/checkout action to v7 #297

Release Notes

What's Changed

What's Changed