This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://github.com/actions/checkout) | action | major | `v6` → `v7` |
---
### Release Notes
<details>
<summary>actions/checkout (actions/checkout)</summary>
### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700)
[Compare Source](https://github.com/actions/checkout/compare/v7.0.0...v7.0.0)
- Block checking out fork PR for pull\_request\_target and workflow\_run by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2454](https://github.com/actions/checkout/pull/2454)
- Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2458](https://github.com/actions/checkout/pull/2458)
- Bump flatted from 3.3.1 to 3.4.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2460](https://github.com/actions/checkout/pull/2460)
- Bump js-yaml from 4.1.0 to 4.2.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2461](https://github.com/actions/checkout/pull/2461)
- Bump [@​actions/core](https://github.com/actions/core) and [@​actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2459](https://github.com/actions/checkout/pull/2459)
- upgrade module to esm and update dependencies by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2463](https://github.com/actions/checkout/pull/2463)
- Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2462](https://github.com/actions/checkout/pull/2462)
### [`v7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700)
[Compare Source](https://github.com/actions/checkout/compare/v6.0.3...v7.0.0)
- Block checking out fork PR for pull\_request\_target and workflow\_run by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2454](https://github.com/actions/checkout/pull/2454)
- Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2458](https://github.com/actions/checkout/pull/2458)
- Bump flatted from 3.3.1 to 3.4.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2460](https://github.com/actions/checkout/pull/2460)
- Bump js-yaml from 4.1.0 to 4.2.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2461](https://github.com/actions/checkout/pull/2461)
- Bump [@​actions/core](https://github.com/actions/core) and [@​actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2459](https://github.com/actions/checkout/pull/2459)
- upgrade module to esm and update dependencies by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2463](https://github.com/actions/checkout/pull/2463)
- Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2462](https://github.com/actions/checkout/pull/2462)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzIuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI1MS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Status update: checkout v7 itself looks low risk, but this PR should wait for a clean current baseline.
The PR branch is behind current main. Its original PR CI was green, but newer main has had unrelated test failures/queued runs after other merges. Since this is a workflow change and not urgent, the right next step is to rebase/retry and require a green run on the current base.
Affected likelihood: unlikely for checkout v7 itself; risk is confidence in the current baseline.
Recommendation: rebase/retry, then merge once current PR CI is green.
Status update: checkout v7 itself looks low risk, but this PR should wait for a clean current baseline.
The PR branch is behind current `main`. Its original PR CI was green, but newer `main` has had unrelated test failures/queued runs after other merges. Since this is a workflow change and not urgent, the right next step is to rebase/retry and require a green run on the current base.
Affected likelihood: unlikely for checkout v7 itself; risk is confidence in the current baseline.
Recommendation: rebase/retry, then merge once current PR CI is green.
Weekly automation status: not merging automatically.
Risk assessment: actions/checkout@v7 itself worked in this PR run and the workflow is plain pull_request/push, not pull_request_target or workflow_run, so the upstream v7 security-hardening change should not be a functional issue. However, the current pull_request validation is red: RecordingCoordinatorTests.TranscriptLineWorkflowRuleTransformsLiveTranscriptBeforePersistingMarkdown timed out after checkout/build/test setup succeeded.
Affected likelihood: likely unrelated test flake, but current gate is failed.
Recommendation: Renovate retry/rebase or rerun checks; merge only after the PR workflow is green. Rollback is reverting the workflow back to actions/checkout@v6.
Weekly automation status: not merging automatically.
Risk assessment: `actions/checkout@v7` itself worked in this PR run and the workflow is plain `pull_request`/`push`, not `pull_request_target` or `workflow_run`, so the upstream v7 security-hardening change should not be a functional issue. However, the current pull_request validation is red: `RecordingCoordinatorTests.TranscriptLineWorkflowRuleTransformsLiveTranscriptBeforePersistingMarkdown` timed out after checkout/build/test setup succeeded.
Affected likelihood: likely unrelated test flake, but current gate is failed.
Recommendation: Renovate retry/rebase or rerun checks; merge only after the PR workflow is green. Rollback is reverting the workflow back to `actions/checkout@v6`.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v6→v7Release Notes
actions/checkout (actions/checkout)
v7.0.0Compare Source
v7Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
Status update: checkout v7 itself looks low risk, but this PR should wait for a clean current baseline.
The PR branch is behind current
main. Its original PR CI was green, but newermainhas had unrelated test failures/queued runs after other merges. Since this is a workflow change and not urgent, the right next step is to rebase/retry and require a green run on the current base.Affected likelihood: unlikely for checkout v7 itself; risk is confidence in the current baseline.
Recommendation: rebase/retry, then merge once current PR CI is green.
f3dc612260to765d44b9d9Weekly automation status: not merging automatically.
Risk assessment:
actions/checkout@v7itself worked in this PR run and the workflow is plainpull_request/push, notpull_request_targetorworkflow_run, so the upstream v7 security-hardening change should not be a functional issue. However, the current pull_request validation is red:RecordingCoordinatorTests.TranscriptLineWorkflowRuleTransformsLiveTranscriptBeforePersistingMarkdowntimed out after checkout/build/test setup succeeded.Affected likelihood: likely unrelated test flake, but current gate is failed.
Recommendation: Renovate retry/rebase or rerun checks; merge only after the PR workflow is green. Rollback is reverting the workflow back to
actions/checkout@v6.765d44b9d9tod81c2731da