actions: bump actions/checkout from 4.3.1 to 7.0.0 - #12
Closed
dependabot[bot] wants to merge 35 commits into
Closed
Conversation
Bare workflow file so GitHub recognizes it on pull_request events. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Migrate pkg/lockfile from github/gh-actions-pin (commit 6c98632, branch nodeselector/fix-sha-pin-destruction) into standalone multi-language repository. Layout: - go/pkg/lockfile/ — Go implementation (module github.com/github/actions-lockfile/go) - schema/ — canonical lockfile JSON schema (single source of truth) - testdata/ — shared test fixtures for all language implementations Key decisions: - Schema deduplication via go:generate (no duplicate JSON in Go tree) - Shared testdata at root, symlinked into Go package for test resolution - go 1.19 floor preserved for downstream consumer compatibility - Security-boundary parser (uses.go) preserved byte-for-byte Removes old prototype code (dev/, pkg/) and CLI test fixtures. Source: github/gh-actions-lock@6c98632 Theme: lockfile-migration Status: builds Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
setup-go looks for go.sum at repo root by default; our module lives under go/. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…tests - Schema pin regex: enforce sha1=40 / sha256=64 hex digits (was unbounded) - Parse() doc: clarify structural-only validation scope - ParseActionRef: add isValidPath() for subdirectory charset + traversal guards - Rename isValidOwnerOrRepo → isValidSegment (same charset, used for paths too) - Add test: ref containing @ (foo/bar@a@b → ref=a@b) - Add 5 path-rejection test cases (space, quotes, .., ., //) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…cies Address staff + distinguished-engineer review feedback on the migrated lockfile parser. Security boundary (uses.go / doc.go): - isValidSegment now rejects whole-segment "." and ".." (not just charset). - Add isValidRef denylist for the @ref: rejects whitespace, quotes, backtick, backslash, and the ".." sequence (git-invalid, zero valid refs lost) so a ref cannot break out of a quoted literal or smuggle a traversal. Refs still contain "/", so downstream must percent-escape. - ParseActionRef gates the ref via isValidRef. Tightened doc.go contract. Breaking API change (lockfile.go): - Rename File.Actions -> File.Dependencies to match the YAML key. The yaml:"dependencies" tag is unchanged, so the on-disk format is stable; only the Go field name changes. Downstream consumers must update field access. Contract accuracy: - Future-version error message is now tool-agnostic (no hardcoded gh-actions-pin upgrade command); ErrFutureVersion sentinel preserved. - schema.go docstring corrected: the pin pattern constrains pin *values* (workflows/uses arrays), not dependencies map keys, so schema validation alone does not guarantee every dependency key is a pin. - SemVer doc notes API stability (kept exported; consumer relies on it). Tests: add 11 boundary-rejection cases (dot segments, quote/space/ backtick/backslash refs, ".." refs); keep foo/bar@a@b valid. Field renames across lockfile_test, schema_test. Skip-on-missing testdata in action_meta_test to match schema_test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Downstream consumers (github/launch detached-lockfiles) must split a
reusable-workflow uses: ref (OWNER/REPO/.github/workflows/<name>.yml@ref)
into (nwo, subpath, ref) to derive that repo's lockfile path. Hand-rolling
the split with a last-`@` scan mis-parses refs that legitimately contain
`@` (e.g. a branch named "release@2024"), yielding a wrong path and a
silent enforcement downgrade. Centralize the split here, where the uses:
grammar and its telemetry-validated validation already live.
- Add exported ReusableWorkflowRef{Owner,Repo,Path,Ref,Raw} + NWO()/FullName()
and ParseReusableWorkflowRef, the mirror of ParseActionRef for the shape
ParseActionRef rejects. Same prefilters, first-`@` split, and security
validation (charset, traversal, ref metacharacters).
- Extract the shared parse into splitUsesRef returning an unexported usesRef
carrier, so ActionRef's "this is a repository action" contract is never
briefly violated by an unclassified value.
- Tighten reusable-workflow classification: isReusableWorkflow now requires a
single YAML file directly under .github/workflows/ (GitHub's actual
grammar); nested paths like .github/workflows/sub/ci.yml are not reusable.
ParseActionRef's rejection is preserved via the broader isWorkflowFile, so
its behavior is unchanged and the two parsers remain mutually exclusive
(locked in by a property test).
- ParseReusableWorkflowRef rejects local (./...) reusable workflows by design;
IsLocalReusableWorkflow covers that shape.
Tests: full coverage for ParseReusableWorkflowRef incl. the ref-with-`@`
bug case, ref-with-`/`, nested rejection, injection/traversal rejection,
and a mutual-exclusion property test across both parsers.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
workflow_dispatch Release workflow with a patch/minor/major dropdown that delegates to script/release. The script regenerates + drift-checks the tree, runs the full build, computes the next go/vX.Y.Z from the latest tag, pushes the tag, cuts a GitHub Release, and warms the module proxy. Runnable locally (RELEASE_DRY_RUN=1 to preview). Guards against v2+ tags without a /vN module path. Replaces local-only tagging. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
feat(lockfile): migrate parser package from gh-actions-pin
Parse now enforces that required action fields carry meaningful values, not just that the keys are present: - branch must be a non-empty string - owner_id and repo_id must be positive integers (> 0) A present-but-zero-value field would silently disable the security check it is meant to enforce (e.g. owner_id: 0 bypasses owner identity verification). The JSON schema is tightened with minLength and minimum constraints to match. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add variadic paths parameter to Parse(contents, paths...) so callers can limit per-dependency checks (unknown keys, required keys, zero-value rejection) to only the entries referenced by the named workflows. When paths is empty, every dependency is validated — back-compat for whole-file tooling (CLI regen, Dependabot, existing callers compile unchanged). When paths is non-empty, entries outside the referenced set are skipped. A path absent from f.Workflows contributes zero entries and validates nothing (fail-open for non-onboarded workflows). Document-level invariants (version, unknown top-level keys) always run regardless of paths. This fixes the blast-radius bug where one corrupt dependency entry in a shared lockfile fails every workflow that loads it, including workflows that don't reference the corrupt entry at all.
Strict field validation and scoped per-workflow Parse
The CLI was renamed from gh-actions-pin to gh-actions-lock. Update schema description, README links, code comments, and the negative test assertion to match.
…lockfile Rename gh-actions-pin references to gh-actions-lock
commit:"" passes requiredActionKeys presence check but bypasses rejectZeroValues because nonEmptyStringKeys only listed "branch". An attacker-controlled lockfile could set commit:"" on every action, silently converting a required integrity field into a no-op for any consumer that reads Action.Commit without separately checking for the empty-string case. Fix: add "commit" to nonEmptyStringKeys so the same zero-value rejection that guards "branch" now guards "commit" too.
commit:"notadigest" or commit:"HEAD" passed validation because rejectZeroValues only checked for the empty string. A crafted lockfile could supply a plausible-looking but structurally invalid commit, making downstream integrity checks produce false results. Fix: after the empty-string gate, validate the commit value via isValidAlgoHex, which calls the same isValidDigest path used by ParsePin so the two never drift apart.
Parse accepted action entries where commit:"sha1-AAAA" lived under a key ending in :sha1-BBBB. A consumer checking action.Commit trusts a different hash than the pin key they used for the lookup — the lockfile's two representations of the same digest point at different commits, enabling a bait-and-switch on consumers that only check one. Fix: in canonicalizeActions, compare action.Commit against the pin key's algo+hex; return an error (locatable in the YAML tree) when they disagree.
ParsePin extracted the ref from a pin string but only checked for an embedded colon — it never validated the ref against the same denylist that ParseActionRef applies via isValidRef. A crafted pin key with a ref containing spaces, quotes, backtick, or backslash returned ok=true and handed the caller a Pin.Ref loaded with shell metacharacters. Any consumer that passes Pin.Ref to a shell command, URL builder, or GraphQL literal is directly exploitable. Fix: apply isValidRef to the extracted ref before accepting the parse; the function is the single denylist definition shared with ParseActionRef, so the two parsers cannot drift apart.
Workflow keys (e.g. ".github/workflows/ci.yml") are used by consumers as repo-relative file paths. Parse never validated them, so a crafted lockfile could include "../../../etc/passwd" or "/etc/shadow" as a key. Any consumer that calls os.Open(key) or feeds the key to filepath.Join without sanitizing gets an arbitrary-file-read primitive. Fix: validateWorkflowPaths checks every key in f.Workflows: - no leading "/" (no absolute paths) - no ".." segment (no traversal) - no control characters Errors are anchored to the offending YAML key node when available.
branch and tag values in action metadata are used in GraphQL queries, log output, and sometimes shell commands by consumers. Parse accepted any non-empty string — "main\ninjected-header: value" or "main\\evil" were both valid. An attacker-controlled lockfile could arm a downstream injection through either field. Fix: rejectZeroValues now applies isValidRef to branch and tag values when present, using the same denylist as ParseActionRef (rejects whitespace, quotes, backslash, backtick, and ".." sequences). This is the single shared denylist definition so the two parsers cannot drift apart.
Parse accepted inputs of unlimited size. A crafted multi-gigabyte YAML document — or one using YAML alias expansion — would cause memory exhaustion in yaml.Unmarshal / Decode before any validation runs. This is a trivially exploitable remote DoS for any service that feeds untrusted lockfile bytes to Parse. Fix: reject inputs larger than MaxParseSize (1 MiB) before calling yaml.Unmarshal. Legitimate lockfiles are orders of magnitude smaller than this cap. Export the constant so consumers can describe the limit in their own error messages.
Parse accepted circular uses references (A uses B, B uses A; or self-loops A uses A). The lockfile is meant to record a DAG of action dependencies. Any consumer that walks Action.Uses naively — build dependency trees, topological sort, transitive closure computation — will loop infinitely on a crafted lockfile. Fix: run a three-colour DFS (white/grey/black) over the uses graph after canonicalization. Any back-edge (grey node revisited) triggers a ParseError locatable to the offending dependency key in the YAML tree.
With a 1 MiB input cap, a single dependency entry can still pack ~20,000 entries into its uses: sequence (each ~50-byte pin string). canonicalizeActions allocates a new slice of the same length for every action — a 20× in-memory amplification on a maximum-size input. The legitimate upper bound for a real composite action's uses list is tens of entries. Fix: add MaxUsesPerAction (500) constant and rejectOverlongUses, which checks the raw YAML sequence length during validateKnownFields before any allocation occurs.
ParseActionMeta accepted unbounded string input and would collect an
unbounded NestedUses slice from a crafted composite action.yml:
- A 3.5 MB action.yml with 100,000 composite steps parsed cleanly,
allocating a 100K-element []string with no back-pressure.
- No size check ran before yaml.Unmarshal, so yaml.v3 itself had to
absorb the full document before any limit could be applied.
Fix: add two new exported constants checked at the start of the function:
MaxActionMetaSize = 64 KiB (size check before any YAML parsing)
MaxNestedUses = 500 (cap on NestedUses slice growth)
64 KiB is generous for action.yml — the largest in the wild is under
20 KiB. 500 composite steps is far beyond any real action; GitHub's
own largest composite action has fewer than 30 steps.
Tests added: OversizedInputRejected, ExactMaxSizeAccepted,
OverlongUsesListRejected, UsesListAtMaxAccepted.
Review feedback applied: - ParseActionMeta now rejects YAML anchors/aliases explicitly (action.yml doesn't use them; their presence is either a mistake or an exploit). - Removed MaxUsesPerAction (500) and MaxNestedUses (500) — the runner has no per-action step count limit, so we can't be stricter. - Updated detectUsesCycle comment to cite where the runner rejects cycles (CompositeActionsMaxDepth in src/Runner.Common/Constants.cs) and frame our check as shifting the failure left.
- checkWorkflowPathKey: reject backslash and colon characters to prevent Windows-style absolute paths (C:\...) and UNC paths (\server\share) from bypassing the forward-slash-only traversal checks. - detectUsesCycle: fix comment to say 'recursive DFS' (not iterative) and document why recursion depth is bounded (MaxParseSize limits dependency count to ~5,000; Go stacks grow to 1 GB). - ParsePin ref comment: remove misleading claim about escaping being unnecessary. The denylist rejects obviously-malicious refs but callers must still escape for their target context.
…ening Security hardening: input validation and resource limits
…rsing (#7) * lockfile: drop branch field, rename tag to ref (optional) Remove the branch requirement from the Action schema — it is no longer a required field and is dropped entirely. The tag field is renamed to ref and remains optional: not every pinned commit has a symbolic ref recorded. Updates the JSON schema, validation logic (allowedActionKeys, requiredActionKeys, nonEmptyStringKeys, rejectZeroValues), the Action struct, equalAction comparison, and all tests. * lockfile: make ref required The CLI reliably populates ref for every dep that passes impostor checks, so an empty ref means the lockfile is stale/corrupt. ref is now in requiredActionKeys and nonEmptyStringKeys. The schema describes the priority the CLI enforces (full semver tag > any tag > branch by protection/default/release pattern) but the parser only checks presence — priority ordering is the CLI's concern. * lockfile: add SplitRef and BestRef helpers SplitRef classifies a lockfile ref back into tag/branch: stable semver is a tag, everything else is a branch. BestRef picks the single ref for serialization: tag wins over branch. These bridge the CLI's internal Tag/Branch resolver model into the single ref field for lockfile read/write. * lockfile: simplify pin key to owner/repo@ref, bump to v0.0.2 Drop the :algo-hex digest suffix from pin keys. The commit hash now lives only in Action.Commit — the pin key is purely a human-readable identifier (owner/repo@ref). This eliminates the triple-SHA noise in lockfiles (the hash appeared in the @ref portion for SHA-pinned deps, in the :algo-hex suffix, and in the commit: field). Schema changes: - Version bumped to v0.0.2 - Pin pattern simplified to ^[^/@:]+/[^/@:]+@[^:]+$ - Pin struct drops Algo/Hex fields - Commit-mismatch cross-check between key and body removed - ParsePin now handles owner/repo@ref directly * lockfile: keep schema version at v0.0.1 No version bump — the pin key format change is backward-incompatible but we're pre-GA and don't want to deal with multi-version compat machinery yet. * lockfile: multi-version parsing with VersionPolicy Bump current schema to v0.0.2 (simplified pin keys, ref required). Restore v0.0.1 as the legacy format (tag/branch fields, :algo-hex pin suffix). Parse() now accepts both versions and normalizes to the latest File struct. New API surface: - VersionPolicy{Min, Max} — servers declare which versions they read - ParseWithPolicy(data, policy, paths...) — version-gated parsing - DefaultPolicy() — accepts all known versions (v0.0.1–v0.0.2) - SchemaForVersion(v) — returns embedded JSON schema by version - ErrUnsupportedVersion sentinel — version below consumer minimum v0.0.1 compat path: - Accepts :algo-hex pin key suffix, strips during canonicalization - Maps tag/branch fields → ref via BestRef - Does not require ref field (only commit, owner_id, repo_id) - Rejects ref field (unknown in v0.0.1 schema) Rollout: ship parser+launch with {Min:v0.0.1, Max:v0.0.2} first, then ship CLI writing v0.0.2. Eventually bump Min to drop v0.0.1. * lockfile: export CLIName const for consistent messaging Parser and launch both reference the CLI in user-facing messages. Centralizing the name here avoids stale references when the CLI gets renamed (previously 'gh actions-pin', now 'gh actions-lock'). * lockfile: reuse isFutureVersion for versionLessThan * lockfile: add parse benchmarks * lockfile: validate refs in v0.0.1 compat path parsePinV001 and migrateV001Actions were not calling isValidRef on extracted/synthesized refs, allowing shell metacharacters from crafted tag/branch values to flow into Action.Ref unchecked. Consumers use Action.Ref in GraphQL queries and shell commands. Now: parsePinV001 rejects pins with invalid refs (matching ParsePin), and migrateV001Actions drops refs that fail validation rather than propagating them. * lockfile: fall back to pin key ref when tag/branch fails validation If BestRef(tag, branch) produces an unsafe ref that isValidRef rejects, try extracting the ref from the pin key before giving up. This prevents migrated v0.0.1 entries from ending up with empty Ref values that violate the v0.0.2 schema invariant. * lockfile: drop ref character validation denylist The workflow parser does no character validation on uses: refs — just a structural @ split. Align the lockfile library: isValidRef now only rejects empty strings and colons (colon is the legacy pin key separator, needed for grammar correctness). Removes ~110 lines of security theater. * readme: update for v0.0.2 schema * lockfile: address PR review feedback - Re-add isValidRef check in splitUsesRef (colons must be rejected for pin grammar compatibility) - Fix stale version references in comments (v0.0.1 -> v0.0.2) - Update rejectZeroValues doc comment to reflect relaxed ref validation - Add colon-in-ref test case for ParseActionRef - Tighten v0.0.1 schema pin pattern (reject colons in NWO, restrict algo to sha1|sha256) * lockfile: skip ref-mismatch check for full-SHA pin keys When a transitive dep is pinned by commit (key is owner/repo@<sha>), the body's ref field holds the discovered symbolic ref (e.g. v9.2.0). This mismatch is expected and correct — skip the check when pin.Ref is a full SHA.
* Add community health files and fix LICENSE copyright Prep for the public open-source release (github/open-source-releases#710). - LICENSE: correct the stale templated copyright line from "2019 GitHub Inc." to "2026 GitHub, Inc." (MIT body unchanged). - Add CONTRIBUTING.md (adapted from the OSPO Go template to this repo's make-based workflow; states inbound=outbound MIT). - Add CODE_OF_CONDUCT.md, SECURITY.md, SUPPORT.md from the OSPO templates. - Add CODEOWNERS assigning @github/actions-dispatch. - README: add a public-preview / pre-1.0 disclaimer near the top. * Correct CODEOWNERS team to @github/actions-dispatch-reviewers
Prep for the public open-source release (github/open-source-releases#710). Enable weekly Dependabot updates for the two ecosystems in this repo: - gomod, rooted at /go where the module lives. - github-actions, rooted at / for the workflow files. Keeps the Go dependencies and the (now SHA-pinned) workflow actions current once the repo is public.
dependabot
Bot
added
dependencies
Prep for the public open-source release (github/open-source-releases#710). Dogfood the lockfile this repo defines: run `gh actions-lock` to pin every resolvable action to an immutable commit SHA recorded in .github/workflows/actions.lock. The tool narrows the mutable refs in the workflow files to full semver (actions/checkout@v4 -> @v4.3.1, actions/setup-go@v5 -> @v5.6.0) and records the resolved SHA + owner/repo ids in the lockfile. All changes here are tool-generated; nothing was hand-edited. This replaces the manual SHA-pinning PR (#9).
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.3.1...v7.0.0) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/checkout-7
branch
from
July 8, 2026 16:16
f145ce2 to
57563e7
Compare
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 4.3.1 to 7.0.0.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)df4cb1cUpdate changelog for v6.0.3 (#2446)