Bump actions/checkout from 3df4ab11eba7bda6032a0b82a6bb43b11571feac to f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a

[dependabot]

Bumps actions/checkout from 3df4ab11eba7bda6032a0b82a6bb43b11571feac to f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a.

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• f548e57 Consolidate dependency updates in CHANGELOG (#2537)
• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• Additional commits viewable in compare view

[joshuagl]

I pushed a follow-on cleanup commit to this branch which ensures we're on the latest version of all the GHA we're using and adds a comment after the digest so we can more easily tell which version we're using. Dependabot will update the comments for us as it suggests bumps in future.

[trishankatdatadog]

Dependabot will update the comments for us as it suggests bumps in future.

Wasn't obvious why at all to me until I searched for it. Thanks for the PR!

[trishankatdatadog]

@joshuagl I am confused about one thing. Why did dependabot choose something newer but unversion, but you chose something older but versioned?

[joshuagl]

Great question @trishankatdatadog ! I believe dependabot resolved main (though two new commits have been made since then) whereas I am pinning to a release.

[dependabot]

A newer version of actions/checkout exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

[trishankatdatadog]

Great question @trishankatdatadog ! I believe dependabot resolved main (though two new commits have been made since then) whereas I am pinning to a release.

Yeap, looks like it. Out of curiosity, did you resolve the hashes/versions manually or did you use tooling?

[joshuagl]

I was playing around with frizbee a bit, so I got the hashes automatically but verified them by eye.

[trishankatdatadog]

I was playing around with frizbee a bit, so I got the hashes automatically but verified them by eye.

Useful tip, thanks!

[joshuagl]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[joshuagl]

@dependabot recreate