Repository navigation
Conversation
Contributor
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ✅ | Single commit | 1 commit — clean history |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | Changeset file found |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | All 1 Copilot thread(s) resolved |
| ❌ | CI passing | 1 check(s) failing: test |
Files Changed (55 files, +1696 −1689)
| File | +/− |
|---|---|
.changeset/bump-checkout-template-workflows.md |
+6 −0 |
.github/agents/squad.agent.md |
+1 −0 |
.squad-templates/workflows/squad-ci.yml |
+1 −1 |
.squad-templates/workflows/squad-docs.yml |
+1 −1 |
.squad-templates/workflows/squad-heartbeat.yml |
+1 −1 |
.squad-templates/workflows/squad-insider-release.yml |
+1 −1 |
.squad-templates/workflows/squad-issue-assign.yml |
+1 −1 |
.squad-templates/workflows/squad-label-enforce.yml |
+1 −1 |
.squad-templates/workflows/squad-preview.yml |
+1 −1 |
.squad-templates/workflows/squad-promote.yml |
+2 −2 |
.squad-templates/workflows/squad-release.yml |
+1 −1 |
.squad-templates/workflows/squad-triage.yml |
+1 −1 |
.squad-templates/workflows/sync-squad-labels.yml |
+1 −1 |
packages/squad-cli/templates/workflow-wiring-appendix-a-code-reviewer.md |
+131 −131 |
packages/squad-cli/templates/workflow-wiring-appendix-b-documenter.md |
+140 −140 |
packages/squad-cli/templates/workflow-wiring-guide.md |
+276 −276 |
packages/squad-cli/templates/workflows/squad-ci.yml |
+1 −1 |
packages/squad-cli/templates/workflows/squad-docs.yml |
+1 −1 |
packages/squad-cli/templates/workflows/squad-heartbeat.yml |
+1 −1 |
packages/squad-cli/templates/workflows/squad-insider-release.yml |
+1 −1 |
packages/squad-cli/templates/workflows/squad-issue-assign.yml |
+1 −1 |
packages/squad-cli/templates/workflows/squad-label-enforce.yml |
+1 −1 |
packages/squad-cli/templates/workflows/squad-preview.yml |
+1 −1 |
packages/squad-cli/templates/workflows/squad-promote.yml |
+2 −2 |
packages/squad-cli/templates/workflows/squad-release.yml |
+1 −1 |
packages/squad-cli/templates/workflows/squad-triage.yml |
+1 −1 |
packages/squad-cli/templates/workflows/sync-squad-labels.yml |
+1 −1 |
packages/squad-sdk/templates/workflow-wiring-appendix-a-code-reviewer.md |
+131 −131 |
packages/squad-sdk/templates/workflow-wiring-appendix-b-documenter.md |
+140 −140 |
packages/squad-sdk/templates/workflow-wiring-guide.md |
+276 −276 |
packages/squad-sdk/templates/workflows/squad-ci.yml |
+1 −1 |
packages/squad-sdk/templates/workflows/squad-docs.yml |
+1 −1 |
packages/squad-sdk/templates/workflows/squad-heartbeat.yml |
+1 −1 |
packages/squad-sdk/templates/workflows/squad-insider-release.yml |
+1 −1 |
packages/squad-sdk/templates/workflows/squad-issue-assign.yml |
+1 −1 |
packages/squad-sdk/templates/workflows/squad-label-enforce.yml |
+1 −1 |
packages/squad-sdk/templates/workflows/squad-preview.yml |
+1 −1 |
packages/squad-sdk/templates/workflows/squad-promote.yml |
+2 −2 |
packages/squad-sdk/templates/workflows/squad-release.yml |
+1 −1 |
packages/squad-sdk/templates/workflows/squad-triage.yml |
+1 −1 |
packages/squad-sdk/templates/workflows/sync-squad-labels.yml |
+1 −1 |
templates/workflow-wiring-appendix-a-code-reviewer.md |
+131 −131 |
templates/workflow-wiring-appendix-b-documenter.md |
+140 −140 |
templates/workflow-wiring-guide.md |
+276 −276 |
templates/workflows/squad-ci.yml |
+1 −1 |
templates/workflows/squad-docs.yml |
+1 −1 |
templates/workflows/squad-heartbeat.yml |
+1 −1 |
templates/workflows/squad-insider-release.yml |
+1 −1 |
templates/workflows/squad-issue-assign.yml |
+1 −1 |
templates/workflows/squad-label-enforce.yml |
+1 −1 |
| ... | +5 more files |
Total: +1696 −1689
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
Contributor
🔴 Impact Analysis — PR #1435Risk tier: 🔴 CRITICAL 📊 Summary
🎯 Risk Factors
📦 Modules Affectedci-workflows (1 file)
root (15 files)
squad-cli (14 files)
squad-sdk (14 files)
templates (11 files)
This report is generated automatically for every PR. See #733 for details. |
Contributor
🏗️ Architectural Review
Automated architectural review — informational only. |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the canonical Squad GitHub Actions workflow templates under .squad-templates/workflows/ to use a newer actions/checkout version, and adds a Changesets entry to ensure the template change is release-noted.
Changes:
- Bump
actions/checkoutfrom@v4→@v7across canonical workflow templates in.squad-templates/workflows/. - Add a changeset to publish the workflow template bump as a patch for both CLI and SDK.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .squad-templates/workflows/sync-squad-labels.yml | Bump actions/checkout to @v7. |
| .squad-templates/workflows/squad-triage.yml | Bump actions/checkout to @v7. |
| .squad-templates/workflows/squad-release.yml | Bump actions/checkout to @v7 (with full history checkout retained). |
| .squad-templates/workflows/squad-promote.yml | Bump actions/checkout to @v7 in both jobs. |
| .squad-templates/workflows/squad-preview.yml | Bump actions/checkout to @v7. |
| .squad-templates/workflows/squad-label-enforce.yml | Bump actions/checkout to @v7. |
| .squad-templates/workflows/squad-issue-assign.yml | Bump actions/checkout to @v7. |
| .squad-templates/workflows/squad-insider-release.yml | Bump actions/checkout to @v7 (with full history checkout retained). |
| .squad-templates/workflows/squad-heartbeat.yml | Bump actions/checkout to @v7. |
| .squad-templates/workflows/squad-docs.yml | Bump actions/checkout to @v7. |
| .squad-templates/workflows/squad-ci.yml | Bump actions/checkout to @v7. |
| .changeset/bump-checkout-template-workflows.md | Adds patch changeset describing the checkout bump for canonical workflow templates. |
Bump canonical Squad workflow templates to actions/checkout@v7 and sync generated template mirrors with node scripts/sync-templates.mjs --sync. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
serbrech
force-pushed
the
serbrech-bump-checkout-action
branch
from
July 2, 2026 03:58
11b1456 to
bb822d5
Compare
Collaborator
|
@bradygaster — heads up, this bumps the canonical workflow templates from checkout v4→v7. I've reviewed it and it looks good (Squad templates don't use \pull_request_target\ so the v7 fork-checkout blocking won't affect anything). The security hardening is a plus. Can you give this a quick look before merge since it touches all the template mirrors? |
Collaborator
|
Hey @serbrech — heads up that #1442 by @omercangumus supersedes this PR. That one pins ALL GitHub Actions references to full-length commit SHAs (which includes bumping checkout to v7 implicitly via \�ctions/checkout@9c091bb... #v7). Since SHA pinning is stricter than tag-only bumps and covers the same ground + more, this PR may no longer be needed once #1442 merges. Want to close this in favor of #1442, or is there something here that #1442 doesn't cover? |
tamirdresher
reviewed
Jul 7, 2026
tamirdresher
left a comment
tamirdresher
left a comment
Collaborator
There was a problem hiding this comment.
Clean actions/checkout v4 -> v7 bump — consistent across all 54 template mirrors, no stray versions left behind. Safe to merge once the red test check re-runs green (appears to be a transient/unrelated failure, not caused by this change).
Contributor
Author
had a look at that PR, makes sense to close in favor of that. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.squad-templates/workflowscheckout steps fromactions/checkout@v4toactions/checkout@v7.node scripts/sync-templates.mjs --syncin a separate commit so the root, CLI, and SDK template mirrors are refreshed from the canonical source.History check
eb57b87dbumped this repository's live.github/workflowsfrom checkout v4 to v6.3cfd2c5abumped the live.github/workflowsfrom checkout v6 to v7.Checkout v4 → v7 changes
persist-credentialsstores credentials under$RUNNER_TEMPinstead of directly in.git/config.git fetch/pushstill works. Docker container actions doing authenticated git operations need runner v2.329.0+.pull_request_targetandworkflow_run; addsallow-unsafe-pr-checkout: trueopt-in. Also migrated internals to ESM and updated dependencies.For Squad’s workflow templates, the bump is generally safe unless any template uses
pull_request_targetorworkflow_runand checks out untrusted fork PR code. The upside is newer runner/runtime support, safer credential persistence, dependency/security fixes, and v7’s fork-checkout protection.Validation
node scripts/sync-templates.mjs --syncnpm run build --ignore-scriptsNotes
.github/agents/squad.agent.md, because the sync script copies all canonical.squad-templatesfiles.