chore(deps): bump actions/checkout from 4 to 5#70
chore(deps): bump actions/checkout from 4 to 5#70dependabot[bot] wants to merge 1 commit intomasterfrom
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v5) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
the
dependencies
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
📝 WalkthroughSummary by CodeRabbit
WalkthroughUpdated the GitHub Actions workflow at .github/workflows/tests.yml to change the checkout action from actions/checkout@v4 to actions/checkout@v5. No other steps or configuration were modified. The workflow continues to set up Go using actions/setup-go@v5, and all job structure, triggers, and commands remain unchanged. Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/tests.yml (1)
15-15: Pin actions/checkout to the v5.0.0 commit SHA for supply-chain hardeningTag-based refs can be retagged. Pinning to the exact v5.0.0 commit ensures immutability:
- File: .github/workflows/tests.yml
Line: 15- - uses: actions/checkout@v5 + - uses: actions/checkout@330947b61a935d08ec76e43b994f3423e407c96d # v5.0.0
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/tests.yml(1 hunks)
🔇 Additional comments (2)
.github/workflows/tests.yml (2)
15-15: LGTM: Safe bump to actions/checkout v5The upgrade to actions/checkout@v5 is appropriate. With GitHub-hosted runners (ubuntu-latest, windows-latest), the minimum runner requirement for v5 is satisfied.
15-15: If you use any self-hosted runners, ensure minimum runner version is metactions/checkout v5 requires runner >= 2.327.1. GitHub-hosted runners are fine; self-hosted runners must be updated before this merges to avoid runtime failures.
If you have self-hosted runners, confirm their versions meet or exceed 2.327.1.
|
Superseded by #74. |
dependabot
bot
deleted the
dependabot/github_actions/actions/checkout-5
branch
Bumps actions/checkout from 4 to 5.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
08c6903Prepare v5.0.0 release (#2238)9f26565Update actions checkout to use node 24 (#2226)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)