Skip to content

Bump the github-actions group across 1 directory with 6 updates #3234

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump the github-actions group across 1 directory with 6 updates #3234

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,14 +27,14 @@ jobs:
actions: read # Required for Claude to read CI results on PRs
steps:
- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 1
persist-credentials: false

- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@d5726de019ec4498aa667642bc3a80fca83aa102 # v1.0.148
uses: anthropics/claude-code-action@3553f84341b92da26052e28acf1aa898f9511f32 # v1.0.177
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env]
use_commit_signing: true
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/conformance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,14 @@ jobs:
server-conformance:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
version: 0.9.5
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
- run: uv sync --frozen --all-extras --package mcp-everything-server
Expand Down Expand Up @@ -82,14 +82,14 @@ jobs:
client-conformance:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
version: 0.9.5
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
# --compile-bytecode: without it, ~40 concurrently spawned interpreters
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/deploy-docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,12 +40,12 @@ jobs:
url: ${{ steps.deployment.outputs.page_url }}

steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
version: 0.9.5
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/docs-preview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@
steps:
- name: Determine authorization
id: check
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const { owner, repo } = context.repo;
Expand Down Expand Up @@ -116,13 +116,13 @@
permissions:
contents: read
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ needs.authorize.outputs.head_sha }}
persist-credentials: false

Check failure on line 122 in .github/workflows/docs-preview.yml

View check run for this annotation

Claude / Claude Code Review

checkout v7 blocks fork-PR head checkout in docs-preview pull_request_target build job 

actions/checkout v7's new fork-PR guard (actions/checkout#2454) will make the `build` job's checkout step fail for any fork-opened PR: the step runs under `pull_request_target` with `ref` set to the PR head SHA, which v7 refuses unless `allow-unsafe-pr-checkout: true` is set. Since this checkout of PR code is the workflow's deliberate, admin-gated and secret-isolated design (per the header comment), add `allow-unsafe-pr-checkout: true` to this step, noting the `authorize` job as the compensating
Comment on lines +119 to 122

@claude claude Bot Aug 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 actions/checkout v7's new fork-PR guard (actions/checkout#2454) will make the build job's checkout step fail for any fork-opened PR: the step runs under pull_request_target with ref set to the PR head SHA, which v7 refuses unless allow-unsafe-pr-checkout: true is set. Since this checkout of PR code is the workflow's deliberate, admin-gated and secret-isolated design (per the header comment), add allow-unsafe-pr-checkout: true to this step, noting the authorize job as the compensating control.

Extended reasoning...

What breaks. actions/checkout v7.0.0's headline breaking change (actions/checkout#2454, also backported to v6.1.0) adds a guard that refuses to check out a fork PR's head when the workflow was triggered by pull_request_target or workflow_run, unless the new allow-unsafe-pr-checkout: true input is set. The build job in docs-preview.yml is triggered by pull_request_target and explicitly checks out the PR head via ref: ${{ needs.authorize.outputs.head_sha }} — exactly the pattern the new guard blocks. After this bump, every admin-authorized auto-preview of a PR opened from a fork fails at the checkout step with Refusing to check out fork pull request code from a pull_request_target workflow.

Why the v7.0.1 relaxation doesn't help. v7.0.1 (actions/checkout#2518) skips the guard only when the ref input is left at its default. Verified against the pinned commit 3d3c42e: in src/input-helper.ts, isDefaultCheckout = isWorkflowRepository && !core.getInput('ref') — this job sets ref explicitly, so assertSafePrCheckout still runs.

Step-by-step proof (traced through the pinned v7.0.1 source). A maintainer with admin opens a docs PR from their fork; the authorize job approves it and outputs head_sha = context.payload.pull_request.head.sha. In the build job's checkout step:

  1. input-helper.ts: ref input is non-empty → isDefaultCheckout is false → the guard runs.
  2. unsafe-pr-checkout-helper.ts: eventName === 'pull_request_target' matches; the 40-hex ref input is reclassified as input.commit.
  3. The guard collects pull_request.head.sha from the event payload into prShas; the workflow passed precisely that SHA, so commitMatchesPrHeadSha is true.
  4. pull_request.head.repo.id !== repository.id (fork) and allow-unsafe-pr-checkout is unset (default false in action.yml) → the step throws and the build job fails.

Why this is a deliberate capability, not an accident. The workflow's header comment documents this design explicitly: the build executes PR code, is gated by the authorize job (admin sender for auto-preview, admin/maintainer for /preview-docs), and is isolated from Cloudflare secrets — PR code never shares a runner with the deploy token. The exact risk v7's guard targets is already mitigated by an intentional, layered design, so the guard's failure here is a false positive for this workflow.

Scope. Same-repo PRs are unaffected (head.repo.id === repository.id returns early), and the issue_comment /preview-docs path is unaffected (event name mismatch). No other workflow bumped in this PR checks out a PR head under pull_request_target/workflow_run, so this is the only affected location — but fork-opened PRs are common for maintainers, and the auto-preview path would regress silently until someone hits it.

Fix. Add allow-unsafe-pr-checkout: true to this checkout step (with a brief comment — and a zizmor ignore if the new zizmor version flags it — documenting that the authorize gate plus secret isolation are the compensating controls), then merge the bump.


- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
# pull_request_target runs share the base-branch Actions cache; saving
# a cache populated while untrusted PR code ran would let it poison
Expand Down Expand Up @@ -194,7 +194,7 @@
pull-requests: write
steps:
- name: Post or update preview comment
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
AUTHORIZED: ${{ needs.authorize.outputs.authorized }}
PR_NUMBER: ${{ needs.authorize.outputs.pr_number }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/publish-pypi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,12 @@ jobs:
runs-on: ubuntu-latest
needs: [checks]
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: false
version: 0.9.5
Expand Down
24 changes: 12 additions & 12 deletions .github/workflows/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
pre-commit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

Expand All @@ -22,14 +22,14 @@ jobs:
- name: Install uv
id: setup-uv
continue-on-error: true
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
version: 0.9.5

- name: Install uv (retry)
if: steps.setup-uv.outcome == 'failure'
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
version: 0.9.5
Expand Down Expand Up @@ -69,7 +69,7 @@ jobs:
os: [ubuntu-latest, windows-latest]

steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

Expand All @@ -78,14 +78,14 @@ jobs:
- name: Install uv
id: setup-uv
continue-on-error: true
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
version: 0.9.5

- name: Install uv (retry)
if: steps.setup-uv.outcome == 'failure'
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
version: 0.9.5
Expand All @@ -112,7 +112,7 @@ jobs:
readme-snippets:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

Expand All @@ -121,14 +121,14 @@ jobs:
- name: Install uv
id: setup-uv
continue-on-error: true
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
version: 0.9.5

- name: Install uv (retry)
if: steps.setup-uv.outcome == 'failure'
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
version: 0.9.5
Expand All @@ -152,7 +152,7 @@ jobs:
docs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

Expand All @@ -161,14 +161,14 @@ jobs:
- name: Install uv
id: setup-uv
continue-on-error: true
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
version: 0.9.5

- name: Install uv (retry)
if: steps.setup-uv.outcome == 'failure'
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
version: 0.9.5
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/zizmor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,9 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Run zizmor 🌈
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
Loading