chore(deps): update actions/checkout action to v7 by renovate[bot] · Pull Request #15 · wave-av/wave-modules

renovate · 2026-06-19T16:47:02Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v6.0.3` → `v7.0.1`
actions/checkout	action	major	`v5.0.1` → `v7.0.1`
actions/checkout	action	major	`v4.3.1` → `v7.0.1`

Release Notes

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.1.0`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2026-06-19T16:47:06Z

PR author is in the excluded authors list.

changeset-bot · 2026-06-19T16:47:08Z

⚠️ No Changeset found

Latest commit: bef3ab9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

wave-bugbot · 2026-06-20T15:14:55Z

🌊 WAVE BugBot — 5 finding(s)

🔴 4 · 🟠 1

🔴 P0 .github/workflows/_checks.yml:23 CWE-862 — Unpinned action tag (@v1 vs commit SHA)
Using a versioned tag (@v1) instead of a specific commit SHA for actions can lead to security vulnerabilities if the action is updated in a way that introduces
🔴 P0 .github/workflows/governance-enforce.yml:23 CWE-862 — Unpinned action tag (@v4 vs commit SHA)
Using a versioned tag (@v4) instead of a specific commit SHA for actions can lead to security vulnerabilities if the action is updated in a way that introduces
🔴 P0 .github/workflows/public-repo-guard.yml:45 CWE-862 — Unpinned action tag (@v5.0.1 vs commit SHA)
Using a versioned tag (@v5.0.1) instead of a specific commit SHA for actions can lead to security vulnerabilities if the action is updated in a way that introdu
🔴 P0 .github/workflows/shell-lint.yml:20 CWE-862 — Unpinned action tag (@v6.0.3 vs commit SHA)
Using a versioned tag (@v6.0.3) instead of a specific commit SHA for actions can lead to security vulnerabilities if the action is updated in a way that introdu
🟠 P1 .github/workflows/_checks.yml:23 CWE-426 — Unpinned search_path in SECURITY DEFINER function
The search_path is not pinned, which could allow an attacker to shadow your functions or objects by creating them in an earlier schema.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

macroscopeapp · 2026-08-14T16:36:52Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR only updates pinned checkout action versions in CI workflows and does not change product runtime behavior. Human owner review is warranted because every changed workflow is explicitly owned by the streaming team, not by the Renovate author.

Not approved because:

Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

No code changes detected at 99b65b9. Prior analysis still applies.

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

codeant-ai · 2026-08-24T03:24:48Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

codeant-ai · 2026-08-27T00:42:39Z