ci: Bump actions/checkout from 4 to 7 - #99
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
dependabot
Bot
added
dependencies
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7
branch
from
June 22, 2026 14:32
b8b9fd7 to
899741b
Compare
bilby91
added a commit
that referenced
this pull request
Sep 1, 2026
* deps: bump the pending Go module updates Folds the six open dependabot module bumps into one change, taking the latest release of each rather than the version each PR was cut against: - compose-spec/compose-go/v2 2.11.0 -> 2.14.0 (#112) - google/go-containerregistry 0.21.7 -> 0.22.0 (#113 asked for 0.21.9) - moby/moby/api 1.54.2 -> 1.55.0, moby/moby/client 0.4.1 -> 0.5.1 (#100) - golang.org/x/term 0.43.0 -> 0.45.0 (#110) - google.golang.org/protobuf 1.36.11 -> 1.36.12 (#114) Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * ci: bump the pending GitHub Actions updates All four are majors whose breaking changes are the Node 24 runtime default and an ESM migration; the workflows pass no inputs that the majors removed, and no workflow uses pull_request_target or workflow_run, which is the trigger pair actions/checkout v7 newly refuses to check out fork PRs for. - actions/checkout v6 (ci.yml) and v4 (devcontainer-*.yml) -> v7 (#99) - actions/setup-go v6 -> v7 (#111) - docker/login-action v3 -> v4 (#96) - docker/setup-buildx-action v3 -> v4 (#95) Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(compose): refuse the compose lifecycle hooks on the native path compose-go 2.14 adds ServiceConfig.PreStart, so `pre_start` — which 2.11 rejected at schema validation — now loads cleanly. The native orchestrator creates the service container directly and has no ephemeral init-container step, so it dropped the hook silently; and because the hooks are part of the ServiceConfig that ConfigHash covers, editing a hook that never ran read as a config change and stopped and removed the running container, destroying its writable layer. Refused in Plan.Validate via the existing §2.2 unsupported-field mechanism, before any infrastructure side effect. stripForHash drops the three fields as well: the refusal already makes them unreachable there, but a recreation is unrecoverable, so no field the orchestrator does not execute should be able to trigger one if the refusal moves or a caller reaches ConfigHash directly. post_start and pre_stop parsed cleanly under 2.11 and had the same defect, so all three are refused rather than just the one the bump introduced. The shell-out backend is untouched — it delegates to `docker compose`, which implements the hooks. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(compose): refuse unsupported fields before building anything The §2.2 refusal ran only inside Orchestrator.Up, which the engine reaches after prepareComposeServiceImage, layerFeatures and buildComposeSidecarImages. A native project using a refused field therefore paid for the primary image and every sidecar build, and left those images tagged, before being told the engine will not run it. Plan.Validate already documents itself as side-effect-free and safe to call before any backend interaction, so the fix is to call it where that matters: straight after compose.Load. The orchestrator's own validation stays as the authoritative one. Native backend only. The shell-out path hands the project to `docker compose`, which implements hooks and other fields the native orchestrator refuses, so validating there would reject projects that work today. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: bilby91 <2201079+bilby91@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Member
|
Superseded by #129, which folded every open dependency bump into one change. This PR was cut against a
@dependabot close |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/actions/checkout-7
branch
September 1, 2026 16:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)df4cb1cUpdate changelog for v6.0.3 (#2446)