.github/.github/workflows/callable-dependency-review.yaml at 4eff8bbc6de4c7c365dd82b1c0735e320b0190db - adam/.github - Sea Haven Git

adam/.github

mirror of https://github.com/Sea-Haven-Industries/.github.git synced 2026-10-07 16:18:55 +00:00

Adam Moussa 3a258918e2 chore(ci): bump actions/checkout v6 -> v7 across reusable workflows

actions/checkout v7.0.0 (2026-06-18) is internally an ESM rebuild plus
one behavioral change: it blocks checking out a fork PR head ref under
pull_request_target / workflow_run (PR #2454). No Sea Haven workflow uses
those triggers, so there is no reachable behavior change. The Node 24
runtime requirement already landed at v6, so v6 -> v7 carries no new
runner requirement. All runners here are GitHub-hosted (ubuntu, macos).

Covers all 16 checkout pins across 12 reusable/standalone workflows plus
the dependency-review workflow-template scaffold. Consumers on @main pick
this up automatically on merge.

2026-06-25 11:43:10 -04:00

13 lines

271 B

YAML

Raw Blame History

 name: Dependency Review
 on:
   workflow_call:
 permissions:
   contents: read
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
       - uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high