Update checkout action

MAGIC Grants/Skylight Wallet

c8838b0d View source ↗

Public commit record

What the developer wrote

Authored by Keeqler

28/100 · Opaque

Update checkout action

✓ Subject identifies a change! No meaningful explanatory body

The short version

What changed, and why it matters

This commit simply updates the GitHub Actions 'checkout' step from version 4 to version 6 in several workflow files. It is a routine dependency/maintenance change with no visible security fix or vulnerability introduced in the diff itself.

Recommended action

No immediate action required. Verify that actions/checkout@v6 is the legitimate official release and that the organization's pinned action hashes or allow-list policies permit v6. Continue normal CI monitoring.

Security signals we found

No security-relevant code changes

No change to workflow permissions, secrets, or trust boundaries

Routine third-party action version bump

Technical analysis

Evidence from the diff

The patch bumps actions/checkout@v4 to actions/checkout@v6 across three workflow files (build-builder-image.yml, build-monero-c.yml, release.yml). No other workflow logic, permissions, inputs, secrets handling, or build commands are changed. The change is a standard version upgrade of a widely used official GitHub action.

Changed components

.github/workflows/build-builder-image.yml.github/workflows/build-monero-c.yml.github/workflows/release.yml

Inspect captured patch +14 / −14

diff --git a/.github/workflows/build-builder-image.yml b/.github/workflows/build-builder-image.yml
index 66508a8..52271a3 100644
--- a/.github/workflows/build-builder-image.yml
+++ b/.github/workflows/build-builder-image.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Extract Flutter version from pubspec.yaml
         id: flutter
diff --git a/.github/workflows/build-monero-c.yml b/.github/workflows/build-monero-c.yml
index c6ef9b9..2160439 100644
--- a/.github/workflows/build-monero-c.yml
+++ b/.github/workflows/build-monero-c.yml
@@ -15,7 +15,7 @@ jobs:
       image: debian:bookworm
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build monero_c
         env:
@@ -40,7 +40,7 @@ jobs:
       image: debian:bookworm
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build monero_c
         env:
@@ -65,7 +65,7 @@ jobs:
       image: debian:bookworm
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build monero_c
         env:
@@ -90,7 +90,7 @@ jobs:
       image: debian:bookworm
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build monero_c
         env:
@@ -115,7 +115,7 @@ jobs:
       image: debian:bookworm
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build monero_c
         env:
@@ -145,7 +145,7 @@ jobs:
           - aarch64-apple-iossimulator
     steps:
       - name: Checkout monero_c repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: vtnerd/monero_c
           ref: lwsf
@@ -265,7 +265,7 @@ jobs:
       - create-ios-xcframework
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Download x86_64-linux-gnu artifact
         uses: actions/download-artifact@v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e3f5d46..3ce2322 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
       version_matches: ${{ steps.check.outputs.VERSION_MATCHES }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Check if pubspec version matches tag
         id: check
@@ -94,7 +94,7 @@ jobs:
           echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           sparse-checkout: pubspec.yaml
           sparse-checkout-cone-mode: false
@@ -122,7 +122,7 @@ jobs:
           df -h
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: recursive
 
@@ -169,7 +169,7 @@ jobs:
     needs: version
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: recursive
 
@@ -204,7 +204,7 @@ jobs:
     needs: version
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: recursive
 
@@ -246,7 +246,7 @@ jobs:
     needs: version
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: recursive

Risk score

Why this scored 19/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 2/15

Confidence 9/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 19/100

Community notes

Related watches

Merge pull request #178 from MAGICGrants/2.1.0-release-fixes

Update pins

Merge branch 'main' into 2.1.0-release-fixes