Repository navigation
ci: bump actions/checkout from 5 to 7 - #2
Closed
dependabot[bot] wants to merge 19 commits into
Closed
dependabot[bot] wants to merge 19 commits into
dependabot[bot] wants to merge 19 commits into
Conversation
Set up the root POM and the build-wide quality gates every later module inherits: - root POM for org.devlive.pipeforge on JDK 21 with dependencyManagement - Maven Wrapper (Maven 3.9.9, script-only) and .java-version - Maven Enforcer: JDK 21, dependency convergence, no SNAPSHOT deps on release - Spotless with palantir-java-format and the MIT license header - Error Prone and SpotBugs, JaCoCo line coverage gate (80% by default) - license-maven-plugin with a permissive license whitelist - tools/license-header/check.sh for headers in non-Java files - quick profile that skips the gates for local loops - .editorconfig, .gitignore, LICENSE (MIT), README skeletons in English and Chinese Verified with JDK 21.0.10 and Maven 3.9.9. Tests: tools/build-checks/selftest.sh builds a clean fixture and confirms that bad formatting, a missing license header, an Error Prone error, a SpotBugs bug, diverging dependency versions and a GPL dependency each fail the build; it also covers the license header script (detect, fix, preamble, year, foreign header). Docs-Not-Needed: the documentation site does not exist yet Signed-off-by: qianmoQ <shicheng@devlive.org>
Run only what a change can affect, with a single required status check: - .ci/changed-components.sh with .ci/components.conf decides which jobs run (java, build-checks); Markdown-only changes run no build job, CI wiring runs all - .ci/maven-modules.sh maps changed files to reactor modules so the java job runs "mvnw verify -pl <modules> -am -amd"; root build inputs select the full reactor - lint job: license headers, shellcheck and the CI script tests on every change - dco job checks Signed-off-by on every pull request commit (.ci/check-dco.sh) - security workflow: CodeQL for Java and Actions, dependency review on pull requests (high severity vulnerabilities and GPL-family licenses are rejected) - Dependabot for Maven and GitHub Actions - ci-ok aggregates every job and is meant to be the only required check Tests: .ci/tests/run.sh, 25 cases covering module impact analysis (nested modules, aggregator POMs, root build inputs, fixtures outside the reactor, deleted files, prefix collisions), the component rules and the DCO check. actionlint 1.7.7 and shellcheck pass on the workflows and scripts. Docs-Not-Needed: CI configuration only, no user-visible behavior Signed-off-by: qianmoQ <shicheng@devlive.org>
Add the files an open source contributor expects, plus automation around them: - CONTRIBUTING in English and Chinese, CODE_OF_CONDUCT (Contributor Covenant 2.1), SECURITY (private vulnerability reporting), GOVERNANCE, MAINTAINERS - issue forms for bugs, feature proposals, plugin requests and documentation; questions are redirected to Discussions - pull request template with the mandatory checklist, CODEOWNERS - label definitions, path-based area labels, label sync, first-contribution welcome and stale reminders - initial docs-map.yaml for the documentation coverage check - README links to the new files Tests: .ci/check-community-files.sh validates the files (required files, guide structure, issue form fields and labels, label colors, labeler labels, CODEOWNERS owners against MAINTAINERS, PR checklist, docs-map entries) and runs in the lint job; .ci/tests/run.sh adds 13 cases for it (39 in total, all passing). actionlint passes on the new workflows. Docs-Not-Needed: these files are documentation themselves Signed-off-by: qianmoQ <shicheng@devlive.org>
Provide every service the examples and integration tests need with one command: - dev/docker-compose.yaml: MySQL 8.4 (ROW binlog, GTID), PostgreSQL 16 (wal_level=logical, replication role), Toxiproxy with MySQL and PostgreSQL proxies, Prometheus and Grafana with a provisioned data source; sample data on first start - MinIO with its buckets behind the optional s3 profile; the image is configurable through PIPEFORGE_MINIO_IMAGE because MinIO no longer publishes community images on Docker Hub - dev/up.sh (waits for health), dev/down.sh, dev/check.sh for functional checks - host ports default to the 33000-45000 range and can be changed in dev/.env - dev-env CI job starts the environment with MinIO, runs dev/check.sh and tears it down Verified with Docker 29.8 and Compose 5.5: mysql 8.4, postgres 16, toxiproxy 2.12.0, prometheus v2.55.1, grafana 11.4.0. Tests: dev/check.sh passes locally (binlog, ROW format, GTID, sample data, logical WAL, replication role, proxies, MySQL through the proxy, Prometheus ready, Grafana data source). The s3 profile was not started locally; the dev-env CI job covers it. Docs: development/local-environment in en-US and zh-CN, registered in docs-map.yaml. Signed-off-by: qianmoQ <shicheng@devlive.org>
Add @pipeforge/design-tokens, the single source of colors, radii, shadows, sizes and motion for the web UI and the documentation site: - tokens.css: light theme on :root, dark theme on .dark, reduced motion sets every duration to 0ms - theme.css: Tailwind CSS v4 @theme inline mapping to semantic utilities (bg-surface, text-fg-muted, rounded-control, shadow-popover, h-control-md, duration-fast, ...), the dark custom variant, and the fade-in, fade-up, scale-in, flow and pulse-soft animations - index.js: the first-frame theme script and the text contrast pairs - root pnpm workspace (Node 22, pnpm 10), web CI job and Dependabot for npm Verified with Node 22.22, pnpm 10.33 and Tailwind CSS 4.3.5. Tests: node:test, 13 cases. Both themes define the same tokens with non-empty values, the documented groups are complete, sizes and durations match the specification, every text pair reaches 4.5:1 contrast in both themes, theme.css maps every token, the utilities compile with Tailwind to the token variables, and the theme script applies stored and system preferences. Docs-Not-Needed: the tokens are shown on the documentation site in the next commit Signed-off-by: qianmoQ <shicheng@devlive.org>
Add the documentation site under docs/: Next.js App Router with static export for GitHub Pages, styled only with the shared design tokens. - routes /<lang>/ (home), /<lang>/<version>/<page>/ and a root page that picks the language from the browser; first-frame theme script, hreflang, sitemap and robots - MDX pipeline with GFM, heading anchors and Shiki highlighting through the css-variables theme mapped onto the syntax tokens - components: Callout, CodeBlock (title, line highlights, line numbers, copy button with check-mark bounce), Tabs (sliding underline, keyboard navigation), Steps - layout: collapsible navigation with a sliding indicator, scroll-spy table of contents, theme toggle with a circular view transition, language switch, search (FlexSearch over a build-time index with Han tokenization, Ctrl/Cmd K, arrow keys) - home page: Source -> Transform -> Sink DAG with particles flowing along offset-path and lineage highlighting on hover; feature cards that fade up when scrolled into view - build checks: structure (frontmatter, feature and plugin templates, empty sections, TODO), en-US and zh-CN consistency, links and anchors, UI rule scan - docs.yml: changes gate, checks, lint, tests, build, Lighthouse, Pages deploy from main, preview artifact on pull requests, docs-ok aggregate check - pages: getting-started/overview, development/contributing, development/docs-guide; the local environment page now declares the feature template Verified with Node 22.22, pnpm 10.33, Next.js 15.5.29, React 19.2.9, Tailwind CSS 4.3.5, Shiki 3.23 and Lighthouse CI 0.15.1. Tests: Vitest with Testing Library, 59 cases. Tabs, copy button, callout, steps, sidebar, search dialog, theme toggle and the home DAG interactions; unit tests for the content model, every build check, the UI scan, the search index and the MDX plugins. pnpm check, ESLint, Prettier and tsc pass. Lighthouse on the home pages and a doc page, also under the /pipeforge base path: performance 100, accessibility 98-100, best practices 96, SEO 100, LCP below 0.6 s. Docs: development/docs-guide and getting-started/overview in en-US and zh-CN; the site code and design tokens are registered in docs-map.yaml. Signed-off-by: qianmoQ <shicheng@devlive.org>
Enforce "documentation in the same commit" from docs-map.yaml: - docs/scripts/check-docs-coverage.sh <base> <head> checks every feat, perf and breaking commit (type!: or BREAKING CHANGE:) of the range; when it changes a mapped code path, every mapped page must change in en-US and zh-CN as well - "Docs-Not-Needed: <reason>" exempts a commit; an empty reason is rejected - every pipeforge-* module and Maven leaf module must be registered in docs-map.yaml, and every page listed there must exist in both languages - coverage job in docs.yml on pull requests, part of docs-ok Tests: Vitest, 15 new cases (74 in total) against temporary git repositories: glob matching, commit classification, required pages, complete and incomplete feature and perf commits, missing language, exemptions, breaking changes of any type, module registration, missing pages and the shell entry point with its exit codes. The check passes on this repository's history. Docs: development/docs-guide gains the documentation coverage section in en-US and zh-CN. Signed-off-by: qianmoQ <shicheng@devlive.org>
Add pipeforge-common with the error model every user-visible error goes through:
- ErrorCode (PF-<CATEGORY>-[<PLUGIN>-]<NNNN>), ErrorCategory with default kinds,
ErrorKind (TRANSIENT / DATA / FATAL), ErrorScope (job, run, node, subtask, table,
split)
- PipeForgeException with a builder; parameters must match the code's declared
parameters, the exception message is the English text, and toErrorInfo() renders
the structured object {code, params, scope, kind, message, hint, causeChain} in
any supported language
- ErrorRegistry: core codes in errors/<category>.yaml, plugin codes in
META-INF/pipeforge/errors.yaml; loading validates format, category per file,
unique codes and names, kinds, en-US and zh-CN message and hint, and identical
parameters across languages
- first codes: PF-CONF-0001..0005, PF-PLAN-0001..0008, PF-PLUG-0001..0003,
PF-SYS-0001
- documentation site: generate step exports the registry to generated/errors.json,
ErrorList renders it with search and category filters, link check knows the
generated anchors
Verified with JDK 21.0.10 and Maven 3.9.9.
Tests: 29 JUnit cases (registry validation positive and negative, every ErrorCode
constant registered with matching name and parameters and vice versa, plugin
registries from the class path, localized rendering, parameter checks, kind
override, cause chains, wrapping); line coverage above 80%, SpotBugs, Error Prone
and the license whitelist pass. Docs site: 4 new Vitest cases (78 in total).
Docs: concepts/errors (feature template) and reference/errors (generated from the
registry) in en-US and zh-CN; pipeforge-common registered in docs-map.yaml.
Signed-off-by: qianmoQ <shicheng@devlive.org>
Add pipeforge-api, the engine-independent API every plugin implements. It depends only on pipeforge-common (error codes) and JSpecify. - data model: Row, GenericRow, RowKind, TableId; logical types with DataType, DataTypes (factories and a parser that accepts SQL aliases and prints a canonical form) and TypeRoot; Column, CatalogTable and the sealed SchemaChangeEvent family - source: Source, SplitEnumerator, SourceReader (pull mode), ReaderOutput with per-split output, PollStatus, Boundedness and the contexts - transform: Transform, Collector, TransformContext; sink: Sink, SinkWriter, SinkCommitter, GlobalCommitter; Catalog - options: Option and Options builder, OptionRule (required, optional, exclusive, conditional, native namespaces, unknown keys with suggestions), ReadonlyConfig with type conversion, and OptionViolation mapped to PF-CONF-0001 / PF-CONF-0002 - factories with ServiceLoader discovery, VersionedSerializer, optional capability interfaces and the Predicate tree for filter push-down - @stable / @evolving / @internal on every public type; japicmp compares against the last released API (skipped until the first release) Verified with JDK 21.0.10 and Maven 3.9.9. Tests: 84 JUnit cases, 92% line coverage. OptionRule validation (required, range, exclusive, conditional, deprecated keys, unknown keys, sensitive masking), option conversion, logical type parsing, aliases, round trips, equality and error positions, GenericRow, TableId, CatalogTable consistency, and a scan asserting that every public type declares its stability. SpotBugs and Error Prone pass. Docs: development/api-overview and concepts/data-model in en-US and zh-CN; pipeforge-api registered in docs-map.yaml. Signed-off-by: qianmoQ <shicheng@devlive.org>
Add pipeforge-maven-plugin (goal prefix "pipeforge") with the first three goals: - package: builds <artifactId>-<version>.zip with plugin.yaml, lib/ (plugin jar and shipped dependencies), docs/, native-options/ and icon.svg; entries are sorted with a fixed timestamp; the zip is attached to the build - validate: plugin.yaml is well formed and matches the project version and the pipeforge-api major version; pipeforge-api and pipeforge-common are provided, no other PipeForge module is a dependency, no jar carries PipeForge classes, no class exists twice; every component loads, implements its factory interface, has a public no-argument constructor and reports the declared identifier - docs: exports descriptor, options (type, default, requirement, range, values, group, since; sensitive defaults omitted), exclusive groups, conditions, native namespaces and capabilities (from the factory's return type) to docs/generated/plugins/<id>.json The plugin.yaml model (PluginDescriptor, PluginType) lives in pipeforge-common so that the plugin loader can share it. Verified with JDK 21.0.10 and Maven 3.9.9. Tests: 12 JUnit cases in the plugin (inspector, docs model, dependency isolation with duplicate and shaded classes, reproducible archives), 5 descriptor cases in pipeforge-common, and 4 maven-invoker integration projects: a valid plugin that is packaged, validated and exported, and an invalid descriptor, an unisolated dependency and a wrong identifier that each fail the build with the expected message. Docs: development/plugin-packaging in en-US and zh-CN; docs-map.yaml maps the maven plugin and the descriptor model to it. Signed-off-by: qianmoQ <shicheng@devlive.org>
Add pipeforge-plugin, which finds installed plugins, isolates them and guards every call into plugin code: - PluginRepository scans plugin directories for extracted plugins and zip packages; zips are extracted into a cache keyed by their content hash, zip-slip entries are rejected, broken entries are reported with the reason - PluginClassLoader is child-first with a parent-first list (JDK, connector API, error codes, SLF4J, JSpecify) so engine and plugins share the API types - PluginManager keeps several versions of a plugin, resolves components by type, identifier and an optional id@version (highest semantic version otherwise, PF-PLUG-0008 when several plugins provide the identifier), marks plugins built for another API major version as unavailable, and shares one class loader per plugin version through ref-counted PluginLeases that close it when the last one ends - ForbiddenCalls reads class file constant pools and refuses plugins that call System.exit, Runtime.halt, system properties, default time zone or locale, security providers, the standard streams or JVM-wide handlers (PF-PLUG-0005); trusted packages can be allowed - PluginInvoker sets the context class loader, wraps failures with plugin and operation (PF-PLUG-0007) and interrupts control calls on timeout (PF-PLUG-0006) - ApiVersion in pipeforge-api reports the API version from the build - new error codes PF-PLUG-0004..0008 Verified with JDK 21.0.10 and Maven 3.9.9. Tests: 16 JUnit cases, 87% line coverage, with plugins compiled at test time: two plugins bundling two versions of the same library return their own versions; the class loader of a released plugin is garbage collected; versions are resolved and pinned; ambiguous identifiers and other API versions are reported; a plugin calling System.exit is refused unless trusted; invoker timeouts interrupt the call; zipped plugins are extracted once. Docs: concepts/plugins in en-US and zh-CN; development/api-overview mentions ApiVersion; docs-map.yaml registers pipeforge-plugin and narrows the API and error mappings to the pages that describe them. Signed-off-by: qianmoQ <shicheng@devlive.org>
The error reference added ErrorList and the data frontmatter field without describing them in the docs guide; the documentation coverage check over the whole history pointed this out. Both are now listed in en-US and zh-CN. Signed-off-by: qianmoQ <shicheng@devlive.org>
Add pipeforge-expressions, the expression language shared by filters, routers, field mappings and SQL jobs: SQL scalar expressions, typed before the job runs and compiled to bytecode. - parsing with Calcite's SQL parser (backtick quoting, case-insensitive names, lenient conformance for != and %); TIMESTAMP_LTZ '...' literals are rewritten before parsing and positions are mapped back - analysis into a typed tree: columns, ROW fields, array and map elements, pseudo-columns ($table, $db, $schema, $rowkind), literals of every type, arithmetic, comparisons, IS [NOT] DISTINCT FROM, AND/OR/NOT, IS predicates, BETWEEN, IN, LIKE with ESCAPE, RLIKE (RE2/J), CASE, IF, COALESCE, IFNULL, NULLIF, CAST and TRY_CAST, ARRAY and MAP constructors, registered functions with overloads and varargs - type rules: lossless implicit conversions only, integer division as DECIMAL, SQL decimal precision rules capped at 38 digits; every problem is PF-PLAN-0007 with line and column, including "did you mean" suggestions for columns - three-valued logic, overflow and division-by-zero checks, casts that use the job time zone for TIMESTAMP_LTZ - Janino code generation: one class per operator, one method per node, lazy short-circuit operators, deterministic subexpressions shared within and across expressions and computed at most once per row; classes with the same structure are reused - an interpreter with the same semantics (all operators live in one runtime class) - on-error dirty / null / fail with PF-DATA-0006 (kind DATA or FATAL) - function registry API with determinism and NULL handling; the built-in library follows in the next commit - "Go License" (RE2/J's BSD 3-Clause text) is mapped to BSD-3-Clause in the license whitelist Verified with JDK 21.0.10, Calcite 1.40.0, Janino 3.1.12 and RE2/J 1.8. Tests: 128 JUnit cases, 92% line coverage. A property test compiles random well-typed expressions in batches of 12 and compares 12000 compiled and interpreted evaluations per seed (values and error reasons; six seeds checked); type inference for 58 expressions; 29 error messages with positions; three-valued logic truth tables; arithmetic, decimal, cast, time zone, LIKE/RLIKE, nested access and laziness semantics; subexpression sharing counted through instrumented functions; on-error. Docs: concepts/expressions and reference/expression-syntax in en-US and zh-CN; pipeforge-expressions registered in docs-map.yaml. Signed-off-by: qianmoQ <shicheng@devlive.org>
Add the first batch of built-in scalar functions and the registry and catalog behind them. - Comparison and conditional: COALESCE, IFNULL, NULLIF, IF, GREATEST, LEAST, TYPEOF, IS_NUMERIC, IS_DATE. - Numeric: ABS, SIGN, CEIL, FLOOR, ROUND, TRUNCATE, DIV, MOD, POWER, SQRT, EXP, LN, LOG, LOG10, RAND, BIN, HEX, CONV. Overflow and invalid arguments are errors, never wrapped values. - String: LENGTH, LOWER, UPPER, INITCAP, TRIM/LTRIM/RTRIM, LPAD/RPAD, SUBSTRING, LEFT, RIGHT, POSITION, INSTR, REPLACE, TRANSLATE, REVERSE, REPEAT, CONCAT, CONCAT_WS, SPLIT_PART, SPLIT, REGEXP_* (RE2), ASCII, CHR, FORMAT. Positions count code points. - Date and time in the job time zone: CURRENT_DATE, NOW, RUN_START_TIME, DATE_FORMAT, TO_DATE, TO_TIMESTAMP(_LTZ), FROM_UNIXTIME, UNIX_TIMESTAMP, field extraction (EXTRACT, YEAR ... SECOND), DATE_ADD, DATE_SUB, DATEDIFF, TIMESTAMPDIFF, DATE_TRUNC, LAST_DAY, CONVERT_TZ. Parsing is strict, so 2026-11-31 is an error. - Conversion: CAST and TRY_CAST. - Functions are static methods annotated with @scalar; the registry derives signatures and overload order from them. Functions that take an EvaluationContext receive the job time zone, run start and clock, in generated code and in the interpreter alike. - Keyword call forms (TRIM ... FROM, POSITION ... IN, EXTRACT, TIMESTAMPDIFF, DAY) map onto the registered functions. - functions/builtin.yaml documents all 88 functions in both languages; the docs site renders reference/functions from it. Verified with JDK 21, Maven 3.9, Calcite 1.40.0, Janino 3.1.12, RE2/J 1.8, Node 22, Next.js 15.5.29. Tests: 254 JUnit tests in pipeforge-expressions, 93% line coverage. Every catalog signature is type-checked and every catalog example is evaluated compiled and interpreted and compared with the documented result; a property test checks NULL propagation for every overload; about 100 boundary and invalid-argument cases. Vitest covers the function table (81 tests). mvnw verify, license headers, docs checks and docs build pass. Docs: reference/functions (generated from the catalog), concepts/expressions, reference/expression-syntax (function call forms) and development/docs-guide (FunctionList), in en-US and zh-CN. Signed-off-by: qianmoQ <shicheng@devlive.org>
Add pipeforge-core, which turns a job definition into a checked
logical plan before any data is read.
- Job DSL: one model for YAML and JSON, read with SnakeYAML's composer
only (no object construction; custom tags, merge keys and duplicate
keys are rejected). Structural problems report line, column and path
(new PF-CONF-0006 JOB_INVALID). Nested mappings and dotted keys are
equivalent; a transform or sink without inputs reads the last source
or transform written before it.
- env options mode, parallelism, delivery, timezone and variables, plus
per-kind node defaults (env.source.*, ...); cluster-only prefixes are
rejected. Node options merge node > env > cluster > plugin default
and are validated with each plugin's OptionRule.
- Variables: ${var:...} with overrides and defaults, ${date:fmt,offset,
boundary} on the planned time in the job time zone (default UTC),
${env:...}, ${run:...}, ${job:name} and the $${ escape; other ${...}
texts are left for plugins. Cycles and malformed variables are
errors.
- Planning: input checks (new PF-PLAN-0009 INPUT_INVALID), cycle
detection with the path, every node must reach a sink (new
PF-PLAN-0010 NODE_DISCONNECTED), schema derivation in topological
order with column-wise merging of several inputs, mode derivation
(new PF-PLAN-0011 BOUNDEDNESS_MISMATCH) and the exactly-once check.
- Components come from installed plugins (PluginComponents, one lease
per plugin version) or from factory instances (StaticComponents).
- explain in plan mode as aligned text or JSON: settings, variables,
nodes, options with their origin (secrets masked), schemas with the
changes per transform, merged sink inputs and warnings.
Verified with JDK 21, Maven 3.9.9, SnakeYAML 2.3, Jackson 2.18.2,
Node 22, Next.js 15.5.29.
Tests: 112 JUnit tests in pipeforge-core, 96% instruction coverage:
DSL positive and negative cases with locations, variable resolution
(offsets, boundaries, leap years, time zones), planner errors and
option precedence, schema merge rules, golden files for the text and
JSON explain output, planning against an installed plugin package, and
every job example in the new docs pages parsed in both languages.
mvnw verify, license headers, docs checks and docs build pass.
Docs: reference/job-dsl, reference/variables and
concepts/plan-and-explain in en-US and zh-CN; node examples in
concepts/plugins and concepts/expressions now use id.
Signed-off-by: qianmoQ <shicheng@devlive.org>
Ignore .Codex next to .claude so that local agent notes and design drafts never reach the repository. Signed-off-by: qianmoQ <shicheng@devlive.org>
The API server is built on Spring Boot 4.1. Align the versions managed by the root POM with its BOM so that every module, the server included, resolves the same libraries: - JUnit 5.11.4 -> 6.0.3, AssertJ 3.27.3 -> 3.27.7, Mockito 5.14.2 -> 5.23.0, JSpecify 1.0.0 -> 1.0.1 - SLF4J 2.0.16 -> 2.0.20, Logback 1.5.16 -> 1.5.38 - Jackson 2.18.2 -> 2.21.7, SnakeYAML 2.3 -> 2.6 - new properties spring-boot.version 4.1.2 and springdoc.version 3.2.0 Verified with JDK 21 and Maven 3.9.9: mvnw verify passes for all modules (513 tests) with formatting, Error Prone, SpotBugs, license and coverage gates. Signed-off-by: qianmoQ <shicheng@devlive.org>
Errors in a job definition now carry the line, column and path of the offending value as structured scope fields, so that editors such as the Web UI can mark the exact place instead of parsing the message. - ErrorScope gains line, column and path, ErrorScope.definition(...) and withDefinition(...); toMap() lists them after the runtime parts and omits unknown lines. - pipeforge-core attaches the location to every PF-CONF-0006 JOB_INVALID error. Verified with JDK 21 and Maven 3.9.9. Tests: scope rendering with and without a known line, and the scope of a parser error (line, column and path); mvnw verify passes for common, api, plugin, expressions and core. Docs: concepts/errors explains the scope fields and reference/job-dsl mentions the location of PF-CONF-0006, in en-US and zh-CN. Signed-off-by: qianmoQ <shicheng@devlive.org>
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v5...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/actions/checkout-7
branch
November 11, 2026 13:47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 5 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)