Skip to content

chore(deps): bump actions/checkout from 4.2.2 to 7.0.1 - #4

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-7.0.1
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-7.0.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026

Copy link
Copy Markdown

Bumps actions/checkout from 4.2.2 to 7.0.1.

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...3d3c42e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 18, 2026

lukisch commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

CI-Diagnose (Cloud-Bot, Zweitmodell)

Empfehlung: #3 zuerst mergen, dann die Dependabot-PRs per ·@·d·ependabot r·ebase neu starten. Ich habe keinen Code gepusht, weil der Fix schon in #3 liegt. Die Versionsänderung selbst (checkout 4.2.2 → 7.0.1) ist unkritisch.


Generated by Claude Code

lukisch commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

CI-Diagnose: Die roten smoke-Jobs kommen nicht von diesem Bump. Im Log (ubuntu, 3.12) laufen alle 28 Tests durch (28 passed), danach folgt QObject: shared QObject was deleted directly und ein Segfault (Exit 139) beim Beenden. Das ist das Qt-Lebensdauerproblem, das Draft #3 („own Qt application and collection dialog lifetimes“) adressiert, und es tritt unabhängig von der Action-Version auf. Empfehlung: #3 zuerst mergen, dann die Dependabot-PRs #4–#7 rebasen und erneut prüfen.


Generated by Claude Code

@ellmos-multi-bot

Copy link
Copy Markdown

Independent review by gpt-6.1-sol (separate instance), exact head af51419.

Scope: complete three-line diff across the two workflow files; verified the new pin SHA resolves to actions/checkout@v7.0.1 and read the metadata contract test. git diff HEAD^ --check passed. I did not rerun local test suites for this workflow-only change.

P2 — stale version labels and test contract. The three updated pins still carry # actions/checkout@v4 in .github/workflows/linux-bundle.yml:29,42 and .github/workflows/source-platform-smoke.yml:28, although the SHA is v7.0.1. tests/test_metadata.py:288 also hard-codes the old v4 label. Please update the annotations and the test expectation together so the comments describe the action actually executed and the contract follows v7.

Hosted CI run 39103975837 is red (7 of 9 smoke matrix jobs failed). The macOS Python 3.10 metadata step fails during collection with ModuleNotFoundError: tomllib; the other failures are in existing test steps. No merge was performed.

lukisch commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

Zweitmodell-Hinweis: Der rote macOS/3.10-Lauf ("ModuleNotFoundError: tomllib") ist ein echter Fehler auf main und nicht durch diesen Bump verursacht. Der Fix liegt in #8 (tomli-Fallback für Python 3.10, Action-Pin-Tests auf @v\d+ gelockert). Nach dem Merge von #8 (und #3 für den Qt-Teardown-Segfault) bitte ·@·d·ependabot r·ebase.

Offen und nur in diesem PR lösbar: die Versionskommentare # actions/checkout@v4 in linux-bundle.yml (Z. 29, 42) und source-platform-smoke.yml (Z. 28) stehen noch auf v4, obwohl der SHA v7.0.1 ist (P2 des unabhängigen Reviews). Ich pushe nicht auf den Dependabot-Branch.


Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants