build(deps): update actions/checkout action to v7 (main)
Metadata
Current evaluation
Renovate PR #1638 bumped actions/checkout from v6 to v7 in two GitHub workflow files (+2/-2) and was approved and merged into main as commit 6ce6e7c7.
Resolution: closed resolved
Reason: The pull request itself was merged into main at commit 6ce6e7c7, updating both workflow files that reference actions/checkout. Renovate automerge was enabled and review was approved; only the unrelated OSV-scanner job failed, which did not block the merge.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v6` → `v7` |
---
### Release Notes
<details>
<summary>actions/checkout (actions/checkout)</summary>
### [`v7.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700)
[Compare Source](https://redirect.github.com/actions/checkout/compare/v7.0.0...v7.0.0)
- Block checking out fork PR for pull\_request\_target and workflow\_run by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2454](https://redirect.github.com/actions/checkout/pull/2454)
- Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2458](https://redirect.github.com/actions/checkout/pull/2458)
- Bump flatted from 3.3.1 to 3.4.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2460](https://redirect.github.com/actions/checkout/pull/2460)
- Bump js-yaml from 4.1.0 to 4.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2461](https://redirect.github.com/actions/checkout/pull/2461)
- Bump [@​actions/core](https://redirect.github.com/actions/core) and [@​actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2459](https://redirect.github.com/actions/checkout/pull/2459)
- upgrade module to esm and update dependencies by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2463](https://redirect.github.com/actions/checkout/pull/2463)
- Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2462](https://redirect.github.com/actions/checkout/pull/2462)
### [`v7`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700)
[Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.3...v7.0.0)
- Block checking out fork PR for pull\_request\_target and workflow\_run by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2454](https://redirect.github.com/actions/checkout/pull/2454)
- Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2458](https://redirect.github.com/actions/checkout/pull/2458)
- Bump flatted from 3.3.1 to 3.4.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2460](https://redirect.github.com/actions/checkout/pull/2460)
- Bump js-yaml from 4.1.0 to 4.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2461](https://redirect.github.com/actions/checkout/pull/2461)
- Bump [@​actions/core](https://redirect.github.com/actions/core) and [@​actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2459](https://redirect.github.com/actions/checkout/pull/2459)
- upgrade module to esm and update dependencies by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2463](https://redirect.github.com/actions/checkout/pull/2463)
- Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2462](https://redirect.github.com/actions/checkout/pull/2462)
</details>
---
### Configuration
📅 **Schedule**: (in timezone Etc/UTC)
- Branch creation
- "every weekend"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-parts).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJQUjogRGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Renovate PR #1638 bumped actions/checkout from v6 to v7 in two GitHub workflow files (+2/-2) and was approved and merged into main as commit 6ce6e7c7. | |
| stealth/space-bunny-alpha | — | closed resolved | Renovate updated actions/checkout from v6 to v7 in two workflow files and merged it to main in canonical/craft-parts#1638 at commit 6ce6e7c7. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged automated dependency update upgrading actions/checkout from v6 to v7 on the main branch. Approved by one reviewer and passed CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
5
Complexity:
5
Confidence:
95
|
needs review | Updates GitHub Actions checkout dependency from v6 to v7. Generated by Renovate with automerge enabled. Currently open and awaiting CI validation. |
Update history
| Date | Change |
|---|---|
| updated |
Related work
-
Related To:
canonical/craft-parts#1403
(confidence 90%)
Prior Renovate PR that bumped actions/checkout v5 -> v6 in the same two workflow files, merged as commit 773156a8; this PR is the follow-on major bump to v7.
-
Related To:
canonical/craft-parts#585
(confidence 45%)
Later commit f86068ea 'fix(ci): resolve all zizmor findings in GitHub workflows' touches the actions/checkout@v7 references, but is unrelated follow-up CI hardening rather than the resolving change.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #240 build(deps): update actions/checkout action to v7 (main) | craft-platforms | merged | Renovate PR #240 merged into main, updating actions/checkout from v6 to v7 across three workflow files in commit f97a8a4. | |
| #460 build(deps): update actions/checkout action to v7 (main) | craft-cli | merged | Renovate PR #460 bumped actions/checkout from v6 to v7 in the two workflows using it; merged into main as commit 20cad57 with all CI checks green. | |
| #193 build(deps): update actions/checkout action to v7 (main) | craft-grammar | merged | Renovate PR #193 merged as commit 4070c51, updating actions/checkout from v6 to v7 in two workflow files. | |
| #196 build(deps): update actions/checkout action to v7 (main) | starflow | merged | Merged #196: Renovate PR updating actions/checkout from v6.0.3 to v7.0.1. | |
| #2747 build(deps): update actions/checkout action to v7 (main) | charmcraft | merged | Renovate PR #2747 bumping actions/checkout from v6 to v7.0.0 across 9 workflow files (+17/-17) was approved and merged into main as commit c559e7ff; some snap-tests and OSV-scanner jobs failed but did not block the merge. | |
| #963 build(deps): update actions/checkout action to v6 (main) | craft-application | merged | Renovate PR merged: actions/checkout bumped v5 -> v6 in check-renovate, release-publish and spread workflows (+4/-4). Merged via commit 66a0ad04; later superseded by #1124 upgrading to v7. | |
| #1403 build(deps): update actions/checkout action to v6 (main) | craft-parts | merged | Renovate PR #1403 upgraded actions/checkout from v5 to v6 in two workflow files and merged into main as 773156a8. | |
| #986 build(deps): update actions/checkout action to v7 (main) | craft-providers | merged | Renovate's actions/checkout v6→v7 major bump was approved and merged into main via commit 6939f1a; workflows check-renovate, release-publish and tests-weekly now pin actions/checkout@v7 (+4/-4). | |
| #568 build(deps): update github actions to v7 (main) | starbase | merged | Renovate PR #568 was merged via commit 7c9407b, upgrading actions/checkout from v6 to v7 in three GitHub Actions workflow files after approval and with all CI checks passing. | |
| #1124 build(deps): update actions/checkout action to v7 (main) | craft-application | merged | Renovate PR canonical/craft-application#1124 merged into main, bumping actions/checkout from v6 to v7 across three workflow files (+4/-4). Approved by 2 reviewers; snap-tests (openstack) and OSV-scanner failures did not block automerge. |