ci(actions): bump actions/checkout from 4 to 6#91
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
Warning
|
| Layer / File(s) | Summary |
|---|---|
Checkout Action Version Bump .github/workflows/branch-protection-sentinel.yml, .github/workflows/codeql.yml, .github/workflows/security.yml |
All three workflows updated their checkout step from actions/checkout@v4 to actions/checkout@v6 for consistent action versioning across CI jobs. |
Estimated code review effort
🎯 1 (Trivial) | ⏱️ ~3 minutes
Poem
🐰 Three workflows leap and bound,
From v4 to v6, a hop profound,
Actions upgraded, clean and bright,
GitHub flows now run just right! ✨
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Description check | A descrição do PR não segue o template de descrição requerido do repositório. O PR contém apenas as notas de versão automáticas do Dependabot, sem as seções obrigatórias do template (Descrição, Tipo de mudança, Issue relacionada, Checklist, Como testar, etc.). | Preencha o PR description seguindo o template obrigatório: adicione uma descrição clara da mudança, selecione o tipo de mudança (neste caso, provavelmente 'Refatoração' ou 'Segurança'), inclua a checklist completa com itens validados, e adicione notas para o reviewer conforme necessário. |
✅ Passed checks (4 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The PR title clearly and concisely summarizes the main change: bumping the GitHub Action version. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-6
branch
2 times, most recently
from
d0e1c61 to
2efe60a
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/security-compliance.yml (1)
18-18: ⚡ Quick winPin
actions/checkoutto an immutable commit SHA.Line 18 uses a mutable version tag (
@v6). For supply-chain hardening, pin to the full commit SHA and keep the version in a comment:- - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6Note: This pattern is used across multiple workflows in the repository and could be applied consistently.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/security-compliance.yml at line 18, Replace the mutable tag "actions/checkout@v6" with an immutable full commit SHA for supply-chain hardening: update the uses entry to point to the action at a specific commit SHA (e.g., actions/checkout@<full-commit-sha>) and keep the human-readable version "v6" as a YAML comment for clarity; apply the same change everywhere the mutable "@v6" tag is used so workflows consistently pin actions to immutable SHAs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/security-compliance.yml:
- Line 18: Replace the mutable tag "actions/checkout@v6" with an immutable full
commit SHA for supply-chain hardening: update the uses entry to point to the
action at a specific commit SHA (e.g., actions/checkout@<full-commit-sha>) and
keep the human-readable version "v6" as a YAML comment for clarity; apply the
same change everywhere the mutable "@v6" tag is used so workflows consistently
pin actions to immutable SHAs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 213c3d4b-35a7-4c14-8d70-e95b747c3f08
📒 Files selected for processing (4)
.github/workflows/branch-protection-sentinel.yml.github/workflows/codeql.yml.github/workflows/security-compliance.yml.github/workflows/security.yml
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-6
branch
from
2efe60a to
9a11716
Compare
|
@coderabbitai full review Generated by Claude Code |
|
Tip For best results, initiate chat on the files or code changes.
[full_review] |
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-6
branch
4 times, most recently
from
ccc8a31 to
bf77ce9
Compare
|
🟡 Parecer técnico — RECOMENDADO MERGEAR (com nota) Tipo: GitHub Action major (v4 → v6, pula v5)
Diff: 3 arquivos workflow, 3 linhas (só bumps). Verificações antes de mergear:
Bloqueio atual: mesmo do #93 — CI quebrado por env Supabase. Aguardar #101. — Claude (housekeeping de PRs, 08/05/2026) |
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-6
branch
from
bf77ce9 to
e7804f3
Compare
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
adm01-debug
force-pushed
the
dependabot/github_actions/actions/checkout-6
branch
from
e7804f3 to
b7b073b
Compare
1 participant
Bumps actions/checkout from 4 to 6.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
de0fac2Fix tag handling: preserve annotations and explicit fetch-tags (#2356)064fe7fAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...8e8c483Clarify v6 README (#2328)033fa0dAdd worktree support for persist-credentials includeIf (#2327)c2d88d3Update all references from v5 and v4 to v6 (#2314)1af3b93update readme/changelog for v6 (#2311)71cf226v6-beta (#2298)069c695Persist creds to a separate file (#2286)ff7abcdUpdate README to include Node.js 24 support details and requirements (#2248)08c6903Prepare v5.0.0 release (#2238)