Skip to content

Bump actions/checkout from 4 to 5 #1515

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

Bump actions/checkout from 4 to 5 #1515

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 11, 2025

Bumps actions/checkout from 4 to 5.

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

v4.2.2

What's Changed

Full Changelog: actions/checkout@v4.2.1...v4.2.2

v4.2.1

What's Changed

New Contributors

Full Changelog: actions/checkout@v4.2.0...v4.2.1

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

V5.0.0

V4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v4.1.4

v4.1.3

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump actions/checkout from 4 to 5
5531984 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 11, 2025
@matter-code-review
Copy link
Contributor

Code Quality type: bug fix

Summary By MatterAI MatterAI logo

🔄 What Changed

This Pull Request updates the actions/checkout GitHub Action from version v4 to v5 across multiple workflow files within the .github/workflows/ directory. This is a routine dependency upgrade for the CI/CD pipelines.

🔍 Impact of the Change

Upgrading actions/checkout to v5 brings several benefits, including performance improvements, enhanced security features, and support for newer Git capabilities. This ensures that all affected GitHub Actions workflows leverage the latest stable version of the action, improving the overall reliability, efficiency, and security posture of the CI/CD process. It's a low-risk, high-benefit maintenance update.

📁 Total Files Changed

  • .github/workflows/automation-trigger-test.yml: Updated actions/checkout to v5 for code checkout.
  • .github/workflows/integration-tests.yml: Updated actions/checkout to v5 for code checkout.
  • .github/workflows/post-release-qa.yml: Updated actions/checkout to v5 across multiple jobs.
  • .github/workflows/pre-release-qa.yml: Updated actions/checkout to v5 across multiple jobs.
  • .github/workflows/release.yml: Updated actions/checkout to v5 across multiple jobs, including commented-out sections.
  • .github/workflows/verify.yml: Updated actions/checkout to v5 for code checkout.
  • .github/workflows/version-bump.yml: Updated actions/checkout to v5 for code checkout.

🧪 Test Added

No new functional tests were added as this PR focuses on CI/CD configuration updates. The existing workflow tests will implicitly run against the updated actions/checkout version.

🔒Security Vulnerabilities

No new security vulnerabilities were introduced. On the contrary, upgrading to actions/checkout@v5 is a proactive measure to mitigate potential vulnerabilities or security weaknesses present in older versions, as newer versions often include security patches and best practice implementations.

Tip

Quality Recommendations

  1. Consider implementing Dependabot or similar automation for GitHub Actions dependency updates to ensure workflows remain up-to-date with the latest security patches and features, reducing manual effort for such bumps.

  2. For highly critical workflows, evaluate the trade-off of pinning actions to a specific commit hash (e.g., actions/checkout@<commit_hash>) instead of a major version (@v5). This provides immutability and prevents unexpected breaking changes from minor updates within a major version, though it requires more frequent manual updates.

Tanka Poem ♫

CI/CD flows now,
Action bumped, new version gleams,
Code fetched with speed,
Pipelines run, secure and swift,
Tests pass, a scientist smiles. ✨🚀

@matter-code-review
Copy link
Contributor

Important

PR Review Skipped

PR review skipped as per the configuration setting. Run a manually review by commenting /matter review

💡Tips to use Matter AI

Command List

  • /matter summary: Generate AI Summary for the PR
  • /matter review: Generate AI Reviews for the latest commit in the PR
  • /matter review-full: Generate AI Reviews for the complete PR
  • /matter release-notes: Generate AI release-notes for the PR
  • /matter : Chat with your PR with Matter AI Agent
  • /matter remember : Generate AI memories for the PR
  • /matter explain: Get an explanation of the PR
  • /matter help: Show the list of available commands and documentation
  • Need help? Join our Discord server: https://discord.gg/fJU5DvanU3

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 24, 2025

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/github_actions/actions/checkout-5 branch September 24, 2025 17:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gdeluna-branch