[dependabot]

Problem

pr-kit.yml still pins actions/checkout at v4.4.0. Every other workflow in this repo already pins v7.0.1. Dependabot proposes v7.0.1, a major bump. Version 7 refuses to check out fork PR code under pull_request_target, and this workflow uses that trigger.

Change

The one pin moves to the verified v7.0.1 commit, the same commit the other workflows use. The SHA pin and its version comment stay.

- - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

Proof

Check	Result
Tag v7.0.1 resolves to 3d3c42e5aac5ba805825da76410c181273ba90b1	match, via gh api repos/actions/checkout/git/ref/tags/v7.0.1
Same commit in other workflows	19 steps across 10 other workflow files, via grep -rn actions/checkout@ .github/workflows/
lint-and-test on head 6db7ef5	pass, and its checkout step runs v7.0.1
Project verify skills	verify: none. this repo has no project verify-* skill, so the PR flow runs as before.

Release notes read for v5.0.0, v6.0.0, and v7.0.0. The v7 fork guard is src/unsafe-pr-checkout-helper.ts at v7.0.1. It returns early when the PR head repository is the base repository.

Review

Finding	Disposition	Reason
v7 refuses fork PR checkout under pull_request_target	Decline	The job skips fork and Dependabot PRs, per .github/workflows/pr-kit.yml:19. It checks out the default branch by name, per .github/workflows/pr-kit.yml:27, so no PR ref or PR SHA reaches the guard.
v6 moves persisted credentials to a separate file	Decline	The step sets persist-credentials: false, per .github/workflows/pr-kit.yml:28, and runs no authenticated git command.
PR CI does not run this workflow with v7	Decline	pull_request_target runs the workflow from the default branch. The first same-repository PR after merge runs it with v7.
The next PR kit install rewrites this pin to v4.4.0	Decline	The kit template pins v4.4.0, per .dev/pr-kit/open-pr/pr-kit.yml:25. The fix belongs in the kit source, and the owner gets that report.

Merge danger

Door: two-way. Revert this PR to restore the v4.4.0 pin.
Blast radius: low. Only the PR body contract job changes. It is not a required check on main, and a failure shows as a red check on the next same-repository PR.

Changes made by Claude Opus 5.5 via Claude Code

[coldtea-pr-lens]

Note

dependabot[bot] opened this pull request, so PR Lens left it undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-06T09:23:47.777668Z We couldn’t complete this review. Comment @codex review to try again.	6db7ef5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: cb0412a0-a608-4375-b362-bbb669484a6d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[AojdevStudio]

@pullfrog review the current head 6db7ef5. Review only and do not change the branch. Publish the normal current-head pullfrog-approval verdict.

[AojdevStudio]

Spec fidelity at 6db7ef5, against Dependabot's bump of actions/checkout to v7.0.1: no deviations. The one pin in .github/workflows/pr-kit.yml points at the upstream v7.0.1 commit 3d3c42e5aac5ba805825da76410c181273ba90b1 and keeps its version comment.

[pullfrog]

✅ No new issues found.

Reviewed changes — Reviewed the complete current-head diff at 6db7ef5, the surrounding workflow, upstream action contracts, and PR check results.

• Checkout upgrade — .github/workflows/pr-kit.yml updates its SHA-pinned actions/checkout from v4.4.0 to the verified v7.0.1 release commit.
• Compatibility and safety — The job retains default-branch checkout, disabled credential persistence, and fork/Dependabot exclusions; v7's fork guard does not block eligible same-repository PRs, and its Node 24 runtime matches the hosted runner setup already used elsewhere.
• Validation — Existing head CI checks passed; the PR body job is intentionally skipped for this Dependabot PR, so that result does not exercise the changed workflow. No branch content was modified.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}