Release notes

Sourced from actions/checkout's releases.

\n
v7.0.0
\n
What's Changed
\n
\n
block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454
\n
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458
\n
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460
\n
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461
\n
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459
\n
upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463
\n
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462
\n
getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464
\n
update error wording by @aiqiaoy in actions/checkout#2467
\n
\n
New Contributors
\n
\n
@aiqiaoy made their first contribution in actions/checkout#2454
\n
\n
Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v7.0.0
\n
v6.0.3
\n
What's Changed
\n
\n
Update changelog by @ericsciple in actions/checkout#2357
\n
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414
\n
Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439
\n
Update changelog for v6.0.3 by @yaananth in actions/checkout#2446
\n
\n
New Contributors
\n
\n
@yaananth made their first contribution in actions/checkout#2414
\n
\n
Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.3
\n
v6.0.2
\n
What's Changed
\n
\n
Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355
\n
Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356
\n
\n
Full Changelog: https://github.com/actions/checkout/compare/v6.0.1...v6.0.2
\n
v6.0.1
\n
What's Changed
\n
\n
Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314
\n
Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327
\n
Clarify v6 README by @ericsciple in actions/checkout#2328
\n
\n
Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.1
\n
v6.0.0
\n
What's Changed
\n
\n
Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248
\n
Persist creds to a separate file by @ericsciple in actions/checkout#2286
\n
v6-beta by @ericsciple in actions/checkout#2298
\n
\n\n

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

\n
Changelog
\n
v7.0.0
\n
\n
Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454
\n
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458
\n
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460
\n
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461
\n
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459
\n
upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463
\n
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462
\n
\n
v6.0.3
\n
\n
Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439
\n
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414
\n
\n
v6.0.2
\n
\n
Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356
\n
\n
v6.0.1
\n
\n
Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327
\n
\n
v6.0.0
\n
\n
Persist creds to a separate file by @ericsciple in actions/checkout#2286
\n
Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248
\n
\n
v5.0.1
\n
\n
Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301
\n
\n
v5.0.0
\n
\n
Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226
\n
\n
v4.3.1
\n
\n
Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305
\n
\n
v4.3.0
\n
\n
docs: update README.md by @motss in actions/checkout#1971
\n
Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977
\n
Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043
\n
Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044
\n
Update README.md by @nebuk89 in actions/checkout#2194
\n
Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224
\n
Update package dependencies by @salmanmkc in actions/checkout#2236
\n
\n
v4.2.2
\n
\n
url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941
\n
Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946
\n
\n
v4.2.1
\n
\n
Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924
\n
\n\n

... (truncated)

Commits

9c091bb update error wording (#2467)
1044a6d getting ready for checkout v7 release (#2464)
f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
d914b26 upgrade module to esm and update dependencies (#2463)
537c7ef Bump @actions/core and @actions/tool-cache and Remove uuid (#2459)
130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
0f9f3aa Bump actions/publish-immutable-action (#2458)
f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
df4cb1c Update changelog for v6.0.3 (#2446)
Additional commits viewable in compare view

\n
\n","base","head","base_sha","3f3268c414e42a327cc5adeefd14a6bafcb1ea46","head_sha","e21d8620f3cc371adb8855b67be31d196ab55fe5","merge_commit_sha","9b74e0916bada952ce0697bbd5f5e2f5a10c5163","comments","diff","user",{"_270":316,"_181":316,"_317":-5,"_274":318,"_42":319},"commits",1,"changed_files",5,"additions",6,"deletions","dependabot[bot]","email","https://avatars.githubusercontent.com/in/29110?v=4",49699333,"events",[322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349],{"_154":535,"_351":536},{"_154":366,"_351":530},{"_154":525,"_351":526},{"_154":370,"_351":517},{"_154":370,"_351":512},{"_154":370,"_351":507},{"_154":385,"_351":497},{"_154":385,"_351":492},{"_154":370,"_351":486},{"_154":370,"_351":483},{"_154":385,"_351":475},{"_154":370,"_351":471},{"_154":385,"_351":466},{"_154":370,"_351":459},{"_154":370,"_351":456},{"_154":385,"_351":448},{"_154":370,"_351":444},{"_154":385,"_351":439},{"_154":370,"_351":435},{"_154":370,"_351":428},{"_154":385,"_351":409},{"_154":370,"_351":402},{"_154":385,"_351":397},{"_154":370,"_351":390},{"_154":385,"_351":386},{"_154":370,"_351":371},{"_154":366,"_351":367},{"_154":350,"_351":352},"turn/completed","params",{"_353":354,"_87":355},"threadId","019f4900-9de9-7361-b1f3-fc7afa5de46b",{"_356":357,"_358":359,"_103":-5,"_42":360,"_361":362,"_363":364,"_365":113},"completedAt",1783636236,"durationMs",31042,"019f4900-9ea3-78b1-9282-e9d7b0e60a20","items",[],"startedAt",1783636205,"status","thread/status/changed",{"_365":368,"_353":354},{"_92":369},"idle","rawResponseItem/completed",{"_372":373,"_353":354,"_374":360},"item",{"_375":376,"_377":-5,"_42":-5,"_378":-5,"_379":380,"_96":93,"_92":381},"turnId","content",[382],"end_turn","internal_chat_message_metadata_passthrough","phase","final_answer","message",{"_46":383,"_92":384},"### Regression assessment\n\nI don’t expect a regression from this `actions/checkout@v4` → `@v7` bump for this repo.\n\nWhy:\n\n* The main behavioral concern in the provided `actions/checkout@v7` release notes is the new protection that blocks checking out fork PRs for `pull_request_target` and `workflow_run`.\n* This repo’s checkout usages are in workflows triggered by ordinary `pull_request`, `push`, `schedule`, `workflow_dispatch`, or tag pushes — not `pull_request_target` or `workflow_run`. For example, CI uses `pull_request` and checks out with `actions/checkout@v7`. 【F:.github/workflows/ci.yml†L3-L10】【F:.github/workflows/ci.yml†L39-L40】\n* The analyzer workflow also uses only `push`, `pull_request`, and `workflow_dispatch`, with checkout in its jobs. 【F:.github/workflows/analyzers.yml†L3-L10】【F:.github/workflows/analyzers.yml†L32-L33】【F:.github/workflows/analyzers.yml†L51-L52】\n* CodeQL uses `push`, `pull_request`, `schedule`, and `workflow_dispatch`, then checks out normally. 【F:.github/workflows/codeql.yml†L3-L13】【F:.github/workflows/codeql.yml†L34-L35】\n* Release checkout happens on tag pushes or manual dispatch, so the fork-PR blocking behavior should not apply there either. 【F:.github/workflows/release.yml†L3-L8】【F:.github/workflows/release.yml†L36-L37】\n* Sonar’s workflow already explicitly skips fork PRs when the secret would be unavailable, and its checkout is a standard checkout step. 【F:.github/workflows/sonar.yml†L27-L39】\n* The Dependabot automerge workflow does not use `actions/checkout` at all. 【F:.github/workflows/dependabot-automerge.yml†L23-L45】\n\n### Checks performed\n\n* ✅ `rg -n \"actions/checkout|pull_request_target|workflow_run|checkout@\" .github`\n* ✅ `for f in .github/workflows/*.yml; do echo '---' $f; nl -ba $f | sed -n '1,90p'; done`\n* ✅ `git status --short && git branch --show-current`\n\nNo code changes were needed.","output_text","item/completed",{"_372":387,"_353":354,"_374":360},{"_42":388,"_379":380,"_46":383,"_92":389},"msg_0b6b109bdf79c27c016a5021034ad881938ca296e918adcd48","agentMessage",{"_372":391,"_353":354,"_374":360},{"_375":-5,"_392":393,"_42":-5,"_378":-5,"_394":395,"_92":396},"encrypted_content","gAAAAABqUCEDVy4k7yGtyjZcJRE169L30BkCgrek56uz2og1I7riiodSUg6gnQKZzoScA_PuWCyA7BAKTQrh12_e6chMWkVp6LXTDsDJHOpdqFxUgcxYkvKVZ5-kVE3sZN8slg2GDjIkd3f0Pfk3KR_N1Ryxc-Sa4OHxkHwx6QPL4EcAn9Dln_akmWPPO7Xc14cxqRxNOxcCo7WBMvFbpjY9euzASMeRFouDHIpTCQOVLRNP5umSBl0wzWea1yuRaSG5HKjHOEIT5Kph0y_u9Uiop4C2kgFo5P0dIrSMbUWg_P_YoD06w6625gFtfYZIa9fqKJCtjyPspQFbhwl1tKsNJ3JRfD2ogvJ9rwjLilBw8OHuQU8JC2HwnLRfr0e7DEaVOS3jCCj2WP8-hW-S8LjW28cI1V9dIkYGlBT4jPEEMaZbkXY8rNHFxMfSanV8DRy0Iy7kBDan7hQ613wt0i2VGLFKwpu6qaY2nkIjcA9nTMk3Qv3uJQFPqVeiIQluCXxdO_NzRdIWJOMhNjL8wJfY7TiKdr8BnagNePSdR-dxg2KRC0lR9V8bKAMqreSCXNJRmdql4elGiR0jRfiTAYGMvGKtBBydDrcQcD1akEHmROYwkQ8i08oEcsm5AADP9XWoWp_PLqLr0TOv06uo347vrKaxcNXUhja4s89ml8paTq_koDh0wtfHSZ4eGVo1d65HVuza6hAwA9xVhcXG1WZwSFN_hySoBBPR_QOpSlpghkAaBBqqBn8ZrWELDj53jai23853cUdyF1f7P7qFs81z_tioVQ7ntZ_FIJ-CyiZhr5PvM172Gd8BwRJ1DisKepNTCrD2SH0Fw8ovo29evcSM7gTmm_pLvHrzZQqd7NMB077n4pO6gtJ7H4CeSdgdEVWU9VATZxCxVEdt2xSphNmCA0m3YrmT43q6gxdQk3a5tMy3aBC-Tih1_F2hlJYzbeDt7AQG3hNHVmbgM2HS8-9M801gmP9LYAh5Nmrp0kVoIqC4oMXKxdOsBz9Aqya_mjXcDmz5j9G4V1LCsKq8DqLzKY7NFzOw9jr4EsLgvku5CcQV8sqRvP6Gm_Dyg0WsQVljwbhYDNrSUWt0JDbWYjeDOADa5whdufQ81c2EuXHM3MF8q9BW_ivCJUpjBjuBtlr-UPKbDAJKPdKFrLTVzOO0XawY7ju9ePMEkk__Twz4fF_JbZcVu1M-OA_cbZDUZxgRDpu6thol-ED0oPp8Q7jF0lDGY7l6E-cjHATOyABlXhQg4PXdTMWxTi4bQ1qPgZNLwNeBSyxuD2wYO_gVkuIfn4nIj4xdhUJL-K1igrwvH2k540grbepJc6pv6Srx4FJH2iPfGVbI_5LWRFffwaQksM6OiuTyn0qyEjHDBWllprV8oAX72nr_SHuI-r3bdrHGZdVRfIse5gRbXzikkSIPEzzBRmBugAwq-B7T0gdCk31EdBJZpl_pa_WIIlKZ0PneX_x8uAIYqlZKdwIGpMHz7x8u0crsJHSQyjNYSPh8h-DV8qrK0hX58PbOG-aqLnH7qWU4j7wbMDWdesm5jIxggLaijj52V4HpsMsl5RNmX1tJtNmVQMLceE4Ph_P2AJELvvC_Mytwz84B4H1xtLLSNKjyo-VwVqah6nR39fyZ3Y0okbX7VG-28_UTMvkkDZ1T8-7HNPLF4DDt0PeSoBJEAbdHnyZr1rXskoJcKJHC8XKKKJgF7k8fwGOYKFqHwKLsC9AXVxq7FBelCqK-c-9WwFUQVSONFyTCVLZRVLUHx7TEE7Aan1MkeSgPgvOFgT4W0DnVjoiFLDsxJFByXaeWpUc7SqV2-oOj3WXhrGD14LSr1EGTvsvA-WelRpSYFPJ_6PEPleKpNDGiVriCCywLbnkx_ocH3lTmOm3SHhenOBaWPdYrfZxvB7mvOUclOk9CEIprLMaC8o-et7OMfFaPHeuSyfevEM5pA6nUtP_A7yVZmToiL3iJnn4Qq4Q0tMrshA4mgRvQb5nzVzIQNJFR_FTvk-jcxp_EleIdhdztb0lwExN9tJvn3_mBCc1GHTsJANkY9KVdIUPe4jX6m0xz0cJbjDrZTUKXdhWsL5drSppg8KLJBZ4=","summary",[],"reasoning",{"_372":398,"_353":354,"_374":360},{"_375":399,"_42":400,"_394":401,"_92":396},[],"rs_0b6b109bdf79c27c016a5020ffc5988193b350483f28e49612",[],{"_372":403,"_353":354,"_374":360},{"_404":405,"_42":-5,"_378":-5,"_406":407,"_92":408},"call_id","call_zQCdztD7oMbecUID31n4gavB","output","Chunk ID: 8540d3\nWall time: 0.0000 seconds\nProcess exited with code 0\nOriginal token count: 2\nOutput:\nwork\n","function_call_output",{"_372":410,"_353":354,"_374":360},{"_411":412,"_413":414,"_415":416,"_417":418,"_358":32,"_419":32,"_42":405,"_420":421,"_422":423,"_365":113,"_92":424},"aggregatedOutput","work\n","command","/bin/bash -lc 'git status --short && git branch --show-current'","commandActions",[425],"cwd","/workspace/first-class-errors","exitCode","processId","16051","source","unifiedExecStartup","commandExecution",{"_413":426,"_92":427},"git status --short && git branch --show-current","unknown",{"_372":429,"_353":354,"_374":360},{"_430":431,"_404":405,"_42":-5,"_378":-5,"_181":432,"_433":-5,"_92":434},"arguments","{\"cmd\":\"git status --short && git branch --show-current\",\"workdir\":\"/workspace/first-class-errors\",\"yield_time_ms\":1000,\"max_output_tokens\":2000}","exec_command","namespace","function_call",{"_372":436,"_353":354,"_374":360},{"_375":-5,"_392":437,"_42":-5,"_378":-5,"_394":438,"_92":396},"gAAAAABqUCD7xQTWpc_W08hIcbN8KAbeE2RCaTFR8OJtzmaLD5QEv8ORGBw5E8gySR0nxdaIc8ArSWXwkYKaUI6iY_rgu4ol4d7TgBA6GNxoU9wwCrNVMk3en7vohfNDoHxXJ33etSLI70YfJOBeHT2WMMmMHEC8q0iGPtW3qOs12QBfRwHoXwIWzry5lIjP4vFczKOg_jXoKayjrRvU0Ygp2--mNZEf1BoBiG1Y9aGSuJD5lBjHQAUJ6tP_H18x-H88uhtMXAc5mLf5sOJXQK8HnZo-Ed-qXuK0KUTbqpgiaz7G9dgPvVYx6kw2YznxveVhA8SfA2VsBrAkpxb_w5h_ouWSeOhXYjyUKy3t8nk7l-YImvdtHOU6fbzJ9ZBwE29e4LVtw_stYUnNuZ8PRN1gmfuw-KCPSvfQEiiK3SwnmZXcZpisQFAslDTQMQO-acpZQAOUPmsc7NDYOOsZr-omj2Bsqe6nBEViiVUOuvz6jy3uif5mVlBqWNRYyCyNvNgj7NSx2T0nI36agWnETX_hk_sr2PHIQUKWov139Ps4sel-uiBP7sYygN3wyJCcYcwWP7i5Aqt2VBmjo60oQE1-Bu74B6b9fhLDySFplojg-hvTNWo3EppWli9lpKPWESUI39sjqt0guTkjaOAE_8F5fW9fbqs33jgwRIBwH1K-tqnizjAXQrSKWa5sF_PSbmfIOxWKu1bHzQj05Xfr88enIKfsDFSUb8tqNvjsXmDMgDdEAHgcv9UpJwkeCpqfSRl7wufhON3b8cD_1L_q0gxwZZRBwmapsezpPb6npXpMxoMc4KSYDRYkKRAus00Q6zXoEHzKrBrmPJtNySZ2aFdRh8SXQiq3nqN4DkbvgmhpJE3W8QyHo2V3umoamtNZkDjHhEQaCq3H78F6fRoOlIgeyC6-cI4pwmlkMLziNgcHIUGcZcX9PHy4AVlLOxMGfnrnbaIBZShgt2L8r5OXnS6naRTIQlT4rj9idvcE4tSMHVLqlRop01c5AKQFmQsLqj5Zhr-XpQBMHYsmN47wlp5AvLtygjINglPJ8OMHAhkFFDTkXZ26qV8TiZonk3QKtdQyku3F3LE74qZkDOu9PhgXmpeNdNS5ANw6GDU9tMo8w3qt22uPAqpKfSoPR833UnjO1kcX2GOicx0qT_XN621rDCIYdJ1Wq80nunDz8Sl0rsRZGtAEwHqkYJYZ6iTAtHb9mx07e8ahjN3uyw8rmJbMIIImQuc9Xoz6X4ELy-IL0xDzJBZBjF5KMPU_ODmcS2iVWBBnd1YFz3SXYUcn6XVpGd8qi2j_6idI4pUAIJR8tp6GnEsGolT6NpGcSV46_PeuBeO-fgbkjMlfZgE1xqmSV0Kybtem5Q==",[],{"_372":440,"_353":354,"_374":360},{"_375":441,"_42":442,"_394":443,"_92":396},[],"rs_0b6b109bdf79c27c016a5020f8c0f0819393448c340ac00732",[],{"_372":445,"_353":354,"_374":360},{"_404":446,"_42":-5,"_378":-5,"_406":447,"_92":408},"call_4IBwYTqZa5pUzlKMHDjkhDBm","Chunk ID: ae2423\nWall time: 0.0001 seconds\nProcess exited with code 0\nOriginal token count: 4495\nOutput:\n--- .github/workflows/analyzers.yml\n 1\tname: analyzers\n 2\t\n 3\ton:\n 4\t push:\n 5\t branches:\n 6\t - main\n 7\t pull_request:\n 8\t branches:\n 9\t - main\n 10\t workflow_dispatch:\n 11\t\n 12\t# Cancel superseded runs on the same branch / PR.\n 13\tconcurrency:\n 14\t group: analyzers-${{ github.workflow }}-${{ github.ref }}\n 15\t cancel-in-progress: true\n 16\t\n 17\t# Least privilege: this workflow only checks out and builds, so the token\n 18\t# needs nothing beyond read access to the repository contents.\n 19\tpermissions:\n 20\t contents: read\n 21\t\n 22\tenv:\n 23\t DOTNET_NOLOGO: 'true'\n 24\t DOTNET_CLI_TELEMETRY_OPTOUT: 'true'\n 25\t DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 'true'\n 26\t\n 27\tjobs:\n 28\t dogfood:\n 29\t name: Dogfood analyzers\n 30\t runs-on: ubuntu-latest\n 31\t steps:\n 32\t - name: Checkout\n 33\t uses: actions/checkout@v7\n 34\t\n 35\t - name: Setup .NET\n 36\t uses: actions/setup-dotnet@v4\n 37\t with:\n 38\t dotnet-version: '10.0.x'\n 39\t\n 40\t # Dogfood: build the sample with the analyzers wired in (FirstClassErrors.Usage.csproj references\n 41\t # them with OutputItemType=Analyzer). Fails the build on any Error-severity FCExxx diagnostic and\n 42\t # surfaces the warnings in the log. The analyzer unit-test suite itself runs as part of the ci\n 43\t # workflow, which builds and tests the whole solution.\n 44\t - name: Build usage (dogfood analyzers)\n 45\t run: dotnet build FirstClassErrors.Usage/FirstClassErrors.Usage.csproj -c Release\n 46\t\n 47\t floor:\n 48\t name: Dogfood analyzers on the Roslyn floor\n 49\t runs-on: ubuntu-latest\n 50\t steps:\n 51\t - name: Checkout\n 52\t uses: actions/checkout@v7\n 53\t\n 54\t - name: Setup floor .NET SDK\n 55\t uses: actions/setup-dotnet@v4\n 56\t with:\n 57\t # Exactly 8.0.100 (Roslyn 4.8.0 == VS 2022 17.8), the oldest supported host. A wildcard like\n 58\t # 8.0.x would install a later feature band whose bundled Roslyn is newer than the floor, so the\n 59\t # job would stop testing the actual floor. Paired with rollForward: disable in the nested global.json.\n 60\t dotnet-version: '8.0.100'\n 61\t\n 62\t - name: Build on the floor SDK\n 63\t # tools/floor-check/global.json selects the .NET 8 (Roslyn 4.8) SDK: the repo-root global.json pins\n 64\t # .NET 10 and rollForward: latestFeature never rolls down to a lower major, so building from this\n 65\t # directory is what makes the CLI pick the nested pin. ReportAnalyzer AND detailed verbosity are both\n 66\t # required for Roslyn's per-analyzer table to reach the log (it is silent at default verbosity);\n 67\t # --no-incremental guarantees a real compilation so that table is always produced. The (verbose) log\n 68\t # is echoed only on failure to keep a green run readable.\n 69\t working-directory: tools/floor-check\n 70\t run: dotnet build -c Release --no-incremental -p:ReportAnalyzer=true -v detailed > build.log 2>&1 || { cat build.log; exit 1; }\n 71\t\n 72\t - name: Prove the analyzer actually loaded\n 73\t # A never-loaded analyzer would otherwise leave the build green: CS8032 is emitted only when loading\n 74\t # is attempted. The assembly name alone appears in ordinary build lines (\"FirstClassErrors.Analyzers ->\n 75\t # ...dll\" / paths), so match a fully-qualified analyzer *type* (`...Analyzer`): it appears only in\n 76\t # the ReportAnalyzer table, i.e. only if the analyzer really loaded and ran. The pattern deliberately\n 77\t # does not depend on the trailing diagnostic-id list, which is a Roslyn-version formatting detail.\n 78\t working-directory: tools/floor-check\n 79\t run: grep -qE 'FirstClassErrors\\.Analyzers\\.[A-Za-z]+Analyzer' build.log\n--- .github/workflows/ci.yml\n 1\tname: ci\n 2\t\n 3\ton:\n 4\t push:\n 5\t branches:\n 6\t - main\n 7\t pull_request:\n 8\t branches:\n 9\t - main\n 10\t workflow_dispatch:\n 11\t\n 12\t# Cancel superseded runs on the same branch / PR.\n 13\tconcurrency:\n 14\t group: ci-${{ github.workflow }}-${{ github.ref }}\n 15\t cancel-in-progress: true\n 16\t\n 17\t# Least privilege: this workflow only checks out and builds/tests, so the token\n 18\t# needs nothing beyond read access to the repository contents.\n 19\tpermissions:\n 20\t contents: read\n 21\t\n 22\tenv:\n 23\t DOTNET_NOLOGO: 'true'\n 24\t DOTNET_CLI_TELEMETRY_OPTOUT: 'true'\n 25\t DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 'true'\n 26\t\n 27\tjobs:\n 28\t build-test:\n 29\t name: Build & test (${{ matrix.os }})\n 30\t runs-on: ${{ matrix.os }}\n 31\t strategy:\n 32\t # Run both legs to completion so a platform-specific failure is always visible.\n 33\t fail-fast: false\n 34\t matrix:\n 35\t # The doc generator spawns the worker as a separate process and manipulates\n 36\t # file-system paths, so the whole solution is exercised on both platforms.\n 37\t os: [ubuntu-latest, windows-latest]\n 38\t steps:\n 39\t - name: Checkout\n 40\t uses: actions/checkout@v7\n 41\t\n 42\t - name: Setup .NET\n 43\t uses: actions/setup-dotnet@v4\n 44\t with:\n 45\t dotnet-version: '10.0.x'\n 46\t\n 47\t - name: Restore\n 48\t run: dotnet restore FirstClassErrors.sln\n 49\t\n 50\t - name: Build\n 51\t run: dotnet build FirstClassErrors.sln -c Release --no-restore\n 52\t\n 53\t - name: Test\n 54\t # Collect OpenCover coverage via coverlet.collector (configured in coverage.runsettings).\n 55\t # Reports land under artifacts/coverage//coverage.opencover.xml, ready for a Sonar scan.\n 56\t run: >-\n 57\t dotnet test FirstClassErrors.sln -c Release --no-build\n 58\t --collect:\"XPlat Code Coverage\"\n 59\t --settings coverage.runsettings\n 60\t --results-directory artifacts/coverage\n 61\t --logger \"console;verbosity=normal\"\n 62\t\n 63\t - name: Upload coverage report\n 64\t uses: actions/upload-artifact@v4\n 65\t with:\n 66\t # Per-OS name so the two matrix legs do not clash when uploading.\n 67\t name: coverage-${{ matrix.os }}\n 68\t path: artifacts/coverage/**/coverage.opencover.xml\n 69\t if-no-files-found: error\n--- .github/workflows/codeql.yml\n 1\tname: codeql\n 2\t\n 3\ton:\n 4\t push:\n 5\t branches:\n 6\t - main\n 7\t pull_request:\n 8\t branches:\n 9\t - main\n 10\t schedule:\n 11\t # Weekly re-scan so newly shipped CodeQL queries run against unchanged code.\n 12\t - cron: '17 6 * * 1'\n 13\t workflow_dispatch:\n 14\t\n 15\t# Cancel superseded runs on the same branch / PR.\n 16\tconcurrency:\n 17\t group: codeql-${{ github.workflow }}-${{ github.ref }}\n 18\t cancel-in-progress: true\n 19\t\n 20\tpermissions:\n 21\t contents: read\n 22\t\n 23\tjobs:\n 24\t analyze:\n 25\t name: CodeQL analyze (C#)\n 26\t runs-on: ubuntu-latest\n 27\t permissions:\n 28\t # Required to upload results to the code-scanning dashboard.\n 29\t security-events: write\n 30\t # Needed by the action on private repositories; harmless on public ones.\n 31\t actions: read\n 32\t contents: read\n 33\t steps:\n 34\t - name: Checkout\n 35\t uses: actions/checkout@v7\n 36\t\n 37\t - name: Initialize CodeQL\n 38\t uses: github/codeql-action/init@v4\n 39\t with:\n 40\t languages: csharp\n 41\t # Buildless extraction: no .NET SDK or build step is needed, and it sidesteps\n 42\t # compiler-tracing issues on a very new SDK. Switch to `manual` (with a\n 43\t # dotnet build step) later if deeper data-flow analysis is ever wanted.\n 44\t build-mode: none\n 45\t\n 46\t - name: Perform CodeQL analysis\n 47\t uses: github/codeql-action/analyze@v4\n 48\t with:\n 49\t category: \"/language:csharp\"\n--- .github/workflows/dependabot-automerge.yml\n 1\tname: dependabot-automerge\n 2\t\n 3\t# Palier A of the Dependabot automation policy: for Dependabot PRs, enable\n 4\t# GitHub auto-merge on patch and minor updates so they merge on their own once\n 5\t# the required checks pass. Major updates are deliberately left untouched for\n 6\t# human review.\n 7\t#\n 8\t# IMPORTANT — this workflow only *enables* auto-merge; it does not decide when to\n 9\t# merge. GitHub merges the PR only once the branch's REQUIRED status checks pass.\n 10\t# Without a branch-protection rule on `main` that marks the CI checks as required,\n 11\t# auto-merge would merge immediately. The required checks are therefore the safety\n 12\t# gate, not this workflow.\n 13\t\n 14\ton:\n 15\t pull_request:\n 16\t branches:\n 17\t - main\n 18\t\n 19\t# Least privilege by default; the job widens only what it needs.\n 20\tpermissions:\n 21\t contents: read\n 22\t\n 23\tjobs:\n 24\t automerge:\n 25\t name: Auto-merge Dependabot patch/minor\n 26\t runs-on: ubuntu-latest\n 27\t # Only act on PRs raised by Dependabot.\n 28\t if: github.actor == 'dependabot[bot]'\n 29\t permissions:\n 30\t # Enable auto-merge (contents) on the pull request (pull-requests).\n 31\t contents: write\n 32\t pull-requests: write\n 33\t steps:\n 34\t - name: Fetch Dependabot metadata\n 35\t id: meta\n 36\t uses: dependabot/fetch-metadata@v2\n 37\t\n 38\t - name: Enable auto-merge for patch and minor updates\n 39\t # Major updates fall through this condition, so they never get auto-merge\n 40\t # and stay open for a human to review.\n 41\t if: steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor'\n 42\t env:\n 43\t GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n 44\t PR_URL: ${{ github.event.pull_request.html_url }}\n 45\t run: gh pr merge --auto --merge \"$PR_URL\"\n--- .github/workflows/release.yml\n 1\tname: release\n 2\t\n 3\ton:\n 4\t push:\n 5\t # Publish on semantic-version tags, e.g. v1.2.3 or v1.2.3-beta.1.\n 6\t tags:\n 7\t - 'v*.*.*'\n 8\t workflow_dispatch:\n 9\t inputs:\n 10\t version:\n 11\t description: 'Package version to publish, without the leading \"v\" (e.g. 1.2.3)'\n 12\t required: true\n 13\t\n 14\t# Never publish the same ref twice concurrently.\n 15\tconcurrency:\n 16\t group: release-${{ github.ref }}\n 17\t cancel-in-progress: false\n 18\t\n 19\tpermissions:\n 20\t contents: read\n 21\t # Allow the job to request a GitHub OIDC token, exchanged for a short-lived NuGet API key\n 22\t # via trusted publishing (no long-lived NUGET_API_KEY secret is stored).\n 23\t id-token: write\n 24\t\n 25\tenv:\n 26\t DOTNET_NOLOGO: 'true'\n 27\t DOTNET_CLI_TELEMETRY_OPTOUT: 'true'\n 28\t DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 'true'\n 29\t NUGET_FEED: 'https://api.nuget.org/v3/index.json'\n 30\t\n 31\tjobs:\n 32\t pack-push:\n 33\t name: Pack & push NuGet\n 34\t runs-on: ubuntu-latest\n 35\t steps:\n 36\t - name: Checkout\n 37\t uses: actions/checkout@v7\n 38\t\n 39\t - name: Setup .NET\n 40\t uses: actions/setup-dotnet@v4\n 41\t with:\n 42\t dotnet-version: '10.0.x'\n 43\t\n 44\t - name: Resolve version\n 45\t id: version\n 46\t shell: bash\n 47\t # Read the (attacker-controllable) tag name and manual input via the environment rather than interpolating\n 48\t # ${{ ... }} straight into the script, and validate the result against a strict SemVer allowlist. A tag such\n 49\t # as \"v1.2.3;id\" is a valid Git ref that matches the v*.*.* trigger, so an unchecked value could inject shell\n 50\t # commands into every step that uses it.\n 51\t env:\n 52\t EVENT_NAME: ${{ github.event_name }}\n 53\t INPUT_VERSION: ${{ github.event.inputs.version }}\n 54\t REF_NAME: ${{ github.ref_name }}\n 55\t run: |\n 56\t if [ \"$EVENT_NAME\" = \"workflow_dispatch\" ]; then\n 57\t VERSION=\"$INPUT_VERSION\"\n 58\t else\n 59\t # REF_NAME is the tag name (e.g. v1.2.3); strip the leading \"v\".\n 60\t VERSION=\"${REF_NAME#v}\"\n 61\t fi\n 62\t if ! printf '%s' \"$VERSION\" | grep -Eq '^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?$'; then\n 63\t echo \"::error::Invalid version '$VERSION'; expected a SemVer value like 1.2.3 or 1.2.3-beta.1.\"\n 64\t exit 1\n 65\t fi\n 66\t echo \"version=$VERSION\" >> \"$GITHUB_OUTPUT\"\n 67\t echo \"Resolved package version: $VERSION\"\n 68\t\n 69\t - name: Restore\n 70\t run: dotnet restore FirstClassErrors.sln\n 71\t\n 72\t - name: Build\n 73\t env:\n 74\t VERSION: ${{ steps.version.outputs.version }}\n 75\t run: dotnet build FirstClassErrors.sln -c Release --no-restore -p:Version=\"$VERSION\"\n 76\t\n 77\t - name: Test\n 78\t run: dotnet test FirstClassErrors.sln -c Release --no-build --logger \"console;verbosity=normal\"\n 79\t\n 80\t # Only the two projects that carry NuGet identity are packed. The analyzer ships\n 81\t # bundled inside the main package, and the CLI / worker / samples are not published.\n 82\t - name: Pack\n 83\t env:\n 84\t VERSION: ${{ steps.version.outputs.version }}\n 85\t run: |\n 86\t dotnet pack FirstClassErrors/FirstClassErrors.csproj -c Release --no-build -p:Version=\"$VERSION\" -o artifacts\n 87\t dotnet pack FirstClassErrors.Testing/FirstClassErrors.Testing.csproj -c Release --no-build -p:Version=\"$VERSION\" -o artifacts\n 88\t\n 89\t - name: Upload packages as build artifacts\n 90\t uses: actions/upload-artifact@v4\n--- .github/workflows/sonar.yml\n 1\tname: sonar\n 2\t\n 3\ton:\n 4\t push:\n 5\t branches:\n 6\t - main\n 7\t pull_request:\n 8\t branches:\n 9\t - main\n 10\t workflow_dispatch:\n 11\t\n 12\t# Cancel superseded runs on the same branch / PR.\n 13\tconcurrency:\n 14\t group: sonar-${{ github.workflow }}-${{ github.ref }}\n 15\t cancel-in-progress: true\n 16\t\n 17\t# Least privilege: the analysis only reads the repository. PR decoration is\n 18\t# delivered by the SonarQube Cloud GitHub App, not by this workflow's token.\n 19\tpermissions:\n 20\t contents: read\n 21\t\n 22\tenv:\n 23\t DOTNET_NOLOGO: 'true'\n 24\t DOTNET_CLI_TELEMETRY_OPTOUT: 'true'\n 25\t DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 'true'\n 26\t\n 27\tjobs:\n 28\t analyze:\n 29\t name: SonarQube Cloud analysis\n 30\t runs-on: ubuntu-latest\n 31\t # PRs opened from a fork cannot read SONAR_TOKEN; skip the analysis there rather\n 32\t # than fail. Branches in this repository (the normal case) run normally.\n 33\t if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository\n 34\t steps:\n 35\t - name: Checkout\n 36\t uses: actions/checkout@v7\n 37\t with:\n 38\t # Full history lets Sonar attribute issues via git blame and detect new code.\n 39\t fetch-depth: 0\n 40\t\n 41\t - name: Setup .NET\n 42\t uses: actions/setup-dotnet@v4\n 43\t with:\n 44\t dotnet-version: '10.0.x'\n 45\t\n 46\t - name: Setup Java\n 47\t # The SonarScanner for .NET runs on the JVM; SonarQube Cloud requires Java 17+.\n 48\t uses: actions/setup-java@v4\n 49\t with:\n 50\t distribution: temurin\n 51\t java-version: '17'\n 52\t\n 53\t - name: Cache SonarQube Cloud packages\n 54\t uses: actions/cache@v4\n 55\t with:\n 56\t path: ~/.sonar/cache\n 57\t key: ${{ runner.os }}-sonar\n 58\t restore-keys: ${{ runner.os }}-sonar\n 59\t\n 60\t - name: Install SonarScanner for .NET\n 61\t run: |\n 62\t dotnet tool install --global dotnet-sonarscanner\n 63\t echo \"$HOME/.dotnet/tools\" >> \"$GITHUB_PATH\"\n 64\t\n 65\t # The build must sit between `begin` and `end`: the scanner hooks MSBuild to\n 66\t # observe the compilation, so it cannot use a pre-built or --no-build output.\n 67\t - name: Begin analysis\n 68\t env:\n 69\t SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}\n 70\t run: >-\n 71\t dotnet-sonarscanner begin\n 72\t /k:\"reefact_first-class-errors\"\n 73\t /o:\"reefact\"\n 74\t /d:sonar.token=\"$SONAR_TOKEN\"\n 75\t /d:sonar.host.url=\"https://sonarcloud.io\"\n 76\t /d:sonar.cs.opencover.reportsPaths=\"artifacts/coverage/**/coverage.opencover.xml\"\n 77\t\n 78\t - name: Build\n 79\t run: dotnet build FirstClassErrors.sln -c Release\n 80\t\n 81\t - name: Test with coverage\n 82\t # Reuse coverage.runsettings so the OpenCover report matches the one the ci workflow produces.\n 83\t run: >-\n 84\t dotnet test FirstClassErrors.sln -c Release --no-build\n 85\t --collect:\"XPlat Code Coverage\"\n 86\t --settings coverage.runsettings\n 87\t --results-directory artifacts/coverage\n 88\t --logger \"console;verbosity=normal\"\n 89\t\n 90\t - name: End analysis\n",{"_372":449,"_353":354,"_374":360},{"_411":450,"_413":451,"_415":452,"_417":418,"_358":32,"_419":32,"_42":446,"_420":453,"_422":423,"_365":113,"_92":424},"--- .github/workflows/analyzers.yml\n 1\tname: analyzers\n 2\t\n 3\ton:\n 4\t push:\n 5\t branches:\n 6\t - main\n 7\t pull_request:\n 8\t branches:\n 9\t - main\n 10\t workflow_dispatch:\n 11\t\n 12\t# Cancel superseded runs on the same branch / PR.\n 13\tconcurrency:\n 14\t group: analyzers-${{ github.workflow }}-${{ github.ref }}\n 15\t cancel-in-progress: true\n 16\t\n 17\t# Least privilege: this workflow only checks out and builds, so the token\n 18\t# needs nothing beyond read access to the repository contents.\n 19\tpermissions:\n 20\t contents: read\n 21\t\n 22\tenv:\n 23\t DOTNET_NOLOGO: 'true'\n 24\t DOTNET_CLI_TELEMETRY_OPTOUT: 'true'\n 25\t DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 'true'\n 26\t\n 27\tjobs:\n 28\t dogfood:\n 29\t name: Dogfood analyzers\n 30\t runs-on: ubuntu-latest\n 31\t steps:\n 32\t - name: Checkout\n 33\t uses: actions/checkout@v7\n 34\t\n 35\t - name: Setup .NET\n 36\t uses: actions/setup-dotnet@v4\n 37\t with:\n 38\t dotnet-version: '10.0.x'\n 39\t\n 40\t # Dogfood: build the sample with the analyzers wired in (FirstClassErrors.Usage.csproj references\n 41\t # them with OutputItemType=Analyzer). Fails the build on any Error-severity FCExxx diagnostic and\n 42\t # surfaces the warnings in the log. The analyzer unit-test suite itself runs as part of the ci\n 43\t # workflow, which builds and tests the whole solution.\n 44\t - name: Build usage (dogfood analyzers)\n 45\t run: dotnet build FirstClassErrors.Usage/FirstClassErrors.Usage.csproj -c Release\n 46\t\n 47\t floor:\n 48\t name: Dogfood analyzers on the Roslyn floor\n 49\t runs-on: ubuntu-latest\n 50\t steps:\n 51\t - name: Checkout\n 52\t uses: actions/checkout@v7\n 53\t\n 54\t - name: Setup floor .NET SDK\n 55\t uses: actions/setup-dotnet@v4\n 56\t with:\n 57\t # Exactly 8.0.100 (Roslyn 4.8.0 == VS 2022 17.8), the oldest supported host. A wildcard like\n 58\t # 8.0.x would install a later feature band whose bundled Roslyn is newer than the floor, so the\n 59\t # job would stop testing the actual floor. Paired with rollForward: disable in the nested global.json.\n 60\t dotnet-version: '8.0.100'\n 61\t\n 62\t - name: Build on the floor SDK\n 63\t # tools/floor-check/global.json selects the .NET 8 (Roslyn 4.8) SDK: the repo-root global.json pins\n 64\t # .NET 10 and rollForward: latestFeature never rolls down to a lower major, so building from this\n 65\t # directory is what makes the CLI pick the nested pin. ReportAnalyzer AND detailed verbosity are both\n 66\t # required for Roslyn's per-analyzer table to reach the log (it is silent at default verbosity);\n 67\t # --no-incremental guarantees a real compilation so that table is always produced. The (verbose) log\n 68\t # is echoed only on failure to keep a green run readable.\n 69\t working-directory: tools/floor-check\n 70\t run: dotnet build -c Release --no-incremental -p:ReportAnalyzer=true -v detailed > build.log 2>&1 || { cat build.log; exit 1; }\n 71\t\n 72\t - name: Prove the analyzer actually loaded\n 73\t # A never-loaded analyzer would otherwise leave the build green: CS8032 is emitted only when loading\n 74\t # is attempted. The assembly name alone appears in ordinary build lines (\"FirstClassErrors.Analyzers ->\n 75\t # ...dll\" / paths), so match a fully-qualified analyzer *type* (`...Analyzer`): it appears only in\n 76\t # the ReportAnalyzer table, i.e. only if the analyzer really loaded and ran. The pattern deliberately\n 77\t # does not depend on the trailing diagnostic-id list, which is a Roslyn-version formatting detail.\n 78\t working-directory: tools/floor-check\n 79\t run: grep -qE 'FirstClassErrors\\.Analyzers\\.[A-Za-z]+Analyzer' build.log\n--- .github/workflows/ci.yml\n 1\tname: ci\n 2\t\n 3\ton:\n 4\t push:\n 5\t branches:\n 6\t - main\n 7\t pull_request:\n 8\t branches:\n 9\t - main\n 10\t workflow_dispatch:\n 11\t\n 12\t# Cancel superseded runs on the same branch / PR.\n 13\tconcurrency:\n 14\t group: ci-${{ github.workflow }}-${{ github.ref }}\n 15\t cancel-in-progress: true\n 16\t\n 17\t# Least privilege: this workflow only checks out and builds/tests, so the token\n 18\t# needs nothing beyond read access to the repository contents.\n 19\tpermissions:\n 20\t contents: read\n 21\t\n 22\tenv:\n 23\t DOTNET_NOLOGO: 'true'\n 24\t DOTNET_CLI_TELEMETRY_OPTOUT: 'true'\n 25\t DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 'true'\n 26\t\n 27\tjobs:\n 28\t build-test:\n 29\t name: Build & test (${{ matrix.os }})\n 30\t runs-on: ${{ matrix.os }}\n 31\t strategy:\n 32\t # Run both legs to completion so a platform-specific failure is always visible.\n 33\t fail-fast: false\n 34\t matrix:\n 35\t # The doc generator spawns the worker as a separate process and manipulates\n 36\t # file-system paths, so the whole solution is exercised on both platforms.\n 37\t os: [ubuntu-latest, windows-latest]\n 38\t steps:\n 39\t - name: Checkout\n 40\t uses: actions/checkout@v7\n 41\t\n 42\t - name: Setup .NET\n 43\t uses: actions/setup-dotnet@v4\n 44\t with:\n 45\t dotnet-version: '10.0.x'\n 46\t\n 47\t - name: Restore\n 48\t run: dotnet restore FirstClassErrors.sln\n 49\t\n 50\t - name: Build\n 51\t run: dotnet build FirstClassErrors.sln -c Release --no-restore\n 52\t\n 53\t - name: Test\n 54\t # Collect OpenCover coverage via coverlet.collector (configured in coverage.runsettings).\n 55\t # Reports land under artifacts/coverage//coverage.opencover.xml, ready for a Sonar scan.\n 56\t run: >-\n 57\t dotnet test FirstClassErrors.sln -c Release --no-build\n 58\t --collect:\"XPlat Code Coverage\"\n 59\t --settings coverage.runsettings\n 60\t --results-directory artifacts/coverage\n 61\t --logger \"console;verbosity=normal\"\n 62\t\n 63\t - name: Upload coverage report\n 64\t uses: actions/upload-artifact@v4\n 65\t with:\n 66\t # Per-OS name so the two matrix legs do not clash when uploading.\n 67\t name: coverage-${{ matrix.os }}\n 68\t path: artifacts/coverage/**/coverage.opencover.xml\n 69\t if-no-files-found: error\n--- .github/workflows/codeql.yml\n 1\tname: codeql\n 2\t\n 3\ton:\n 4\t push:\n 5\t branches:\n 6\t - main\n 7\t pull_request:\n 8\t branches:\n 9\t - main\n 10\t schedule:\n 11\t # Weekly re-scan so newly shipped CodeQL queries run against unchanged code.\n 12\t - cron: '17 6 * * 1'\n 13\t workflow_dispatch:\n 14\t\n 15\t# Cancel superseded runs on the same branch / PR.\n 16\tconcurrency:\n 17\t group: codeql-${{ github.workflow }}-${{ github.ref }}\n 18\t cancel-in-progress: true\n 19\t\n 20\tpermissions:\n 21\t contents: read\n 22\t\n 23\tjobs:\n 24\t analyze:\n 25\t name: CodeQL analyze (C#)\n 26\t runs-on: ubuntu-latest\n 27\t permissions:\n 28\t # Required to upload results to the code-scanning dashboard.\n 29\t security-events: write\n 30\t # Needed by the action on private repositories; harmless on public ones.\n 31\t actions: read\n 32\t contents: read\n 33\t steps:\n 34\t - name: Checkout\n 35\t uses: actions/checkout@v7\n 36\t\n 37\t - name: Initialize CodeQL\n 38\t uses: github/codeql-action/init@v4\n 39\t with:\n 40\t languages: csharp\n 41\t # Buildless extraction: no .NET SDK or build step is needed, and it sidesteps\n 42\t # compiler-tracing issues on a very new SDK. Switch to `manual` (with a\n 43\t # dotnet build step) later if deeper data-flow analysis is ever wanted.\n 44\t build-mode: none\n 45\t\n 46\t - name: Perform CodeQL analysis\n 47\t uses: github/codeql-action/analyze@v4\n 48\t with:\n 49\t category: \"/language:csharp\"\n--- .github/workflows/dependabot-automerge.yml\n 1\tname: dependabot-automerge\n 2\t\n 3\t# Palier A of the Dependabot automation policy: for Dependabot PRs, enable\n 4\t# GitHub auto-merge on patch and minor updates so they merge on their own once\n 5\t# the required checks pass. Major updates are deliberately left untouched for\n 6\t# human review.\n 7\t#\n 8\t# IMPORTANT — this workflow only *enables* auto-merge; it does not decide when to\n 9\t# merge. GitHub merges the PR only once the branch's REQUIRED status checks pass.\n 10\t# Without a branch-protection rule on `main` that marks the CI checks as required,\n 11\t# auto-merge would merge immediately. The required checks are therefore the safety\n 12\t# gate, not this workflow.\n 13\t\n 14\ton:\n 15\t pull_request:\n 16\t branches:\n 17\t - main\n 18\t\n 19\t# Least privilege by default; the job widens only what it needs.\n 20\tpermissions:\n 21\t contents: read\n 22\t\n 23\tjobs:\n 24\t automerge:\n 25\t name: Auto-merge Dependabot patch/minor\n 26\t runs-on: ubuntu-latest\n 27\t # Only act on PRs raised by Dependabot.\n 28\t if: github.actor == 'dependabot[bot]'\n 29\t permissions:\n 30\t # Enable auto-merge (contents) on the pull request (pull-requests).\n 31\t contents: write\n 32\t pull-requests: write\n 33\t steps:\n 34\t - name: Fetch Dependabot metadata\n 35\t id: meta\n 36\t uses: dependabot/fetch-metadata@v2\n 37\t\n 38\t - name: Enable auto-merge for patch and minor updates\n 39\t # Major updates fall through this condition, so they never get auto-merge\n 40\t # and stay open for a human to review.\n 41\t if: steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor'\n 42\t env:\n 43\t GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n 44\t PR_URL: ${{ github.event.pull_request.html_url }}\n 45\t run: gh pr merge --auto --merge \"$PR_URL\"\n--- .github/workflows/release.yml\n 1\tname: release\n 2\t\n 3\ton:\n 4\t push:\n 5\t # Publish on semantic-version tags, e.g. v1.2.3 or v1.2.3-beta.1.\n 6\t tags:\n 7\t - 'v*.*.*'\n 8\t workflow_dispatch:\n 9\t inputs:\n 10\t version:\n 11\t description: 'Package version to publish, without the leading \"v\" (e.g. 1.2.3)'\n 12\t required: true\n 13\t\n 14\t# Never publish the same ref twice concurrently.\n 15\tconcurrency:\n 16\t group: release-${{ github.ref }}\n 17\t cancel-in-progress: false\n 18\t\n 19\tpermissions:\n 20\t contents: read\n 21\t # Allow the job to request a GitHub OIDC token, exchanged for a short-lived NuGet API key\n 22\t # via trusted publishing (no long-lived NUGET_API_KEY secret is stored).\n 23\t id-token: write\n 24\t\n 25\tenv:\n 26\t DOTNET_NOLOGO: 'true'\n 27\t DOTNET_CLI_TELEMETRY_OPTOUT: 'true'\n 28\t DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 'true'\n 29\t NUGET_FEED: 'https://api.nuget.org/v3/index.json'\n 30\t\n 31\tjobs:\n 32\t pack-push:\n 33\t name: Pack & push NuGet\n 34\t runs-on: ubuntu-latest\n 35\t steps:\n 36\t - name: Checkout\n 37\t uses: actions/checkout@v7\n 38\t\n 39\t - name: Setup .NET\n 40\t uses: actions/setup-dotnet@v4\n 41\t with:\n 42\t dotnet-version: '10.0.x'\n 43\t\n 44\t - name: Resolve version\n 45\t id: version\n 46\t shell: bash\n 47\t # Read the (attacker-controllable) tag name and manual input via the environment rather than interpolating\n 48\t # ${{ ... }} straight into the script, and validate the result against a strict SemVer allowlist. A tag such\n 49\t # as \"v1.2.3;id\" is a valid Git ref that matches the v*.*.* trigger, so an unchecked value could inject shell\n 50\t # commands into every step that uses it.\n 51\t env:\n 52\t EVENT_NAME: ${{ github.event_name }}\n 53\t INPUT_VERSION: ${{ github.event.inputs.version }}\n 54\t REF_NAME: ${{ github.ref_name }}\n 55\t run: |\n 56\t if [ \"$EVENT_NAME\" = \"workflow_dispatch\" ]; then\n 57\t VERSION=\"$INPUT_VERSION\"\n 58\t else\n 59\t # REF_NAME is the tag name (e.g. v1.2.3); strip the leading \"v\".\n 60\t VERSION=\"${REF_NAME#v}\"\n 61\t fi\n 62\t if ! printf '%s' \"$VERSION\" | grep -Eq '^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?$'; then\n 63\t echo \"::error::Invalid version '$VERSION'; expected a SemVer value like 1.2.3 or 1.2.3-beta.1.\"\n 64\t exit 1\n 65\t fi\n 66\t echo \"version=$VERSION\" >> \"$GITHUB_OUTPUT\"\n 67\t echo \"Resolved package version: $VERSION\"\n 68\t\n 69\t - name: Restore\n 70\t run: dotnet restore FirstClassErrors.sln\n 71\t\n 72\t - name: Build\n 73\t env:\n 74\t VERSION: ${{ steps.version.outputs.version }}\n 75\t run: dotnet build FirstClassErrors.sln -c Release --no-restore -p:Version=\"$VERSION\"\n 76\t\n 77\t - name: Test\n 78\t run: dotnet test FirstClassErrors.sln -c Release --no-build --logger \"console;verbosity=normal\"\n 79\t\n 80\t # Only the two projects that carry NuGet identity are packed. The analyzer ships\n 81\t # bundled inside the main package, and the CLI / worker / samples are not published.\n 82\t - name: Pack\n 83\t env:\n 84\t VERSION: ${{ steps.version.outputs.version }}\n 85\t run: |\n 86\t dotnet pack FirstClassErrors/FirstClassErrors.csproj -c Release --no-build -p:Version=\"$VERSION\" -o artifacts\n 87\t dotnet pack FirstClassErrors.Testing/FirstClassErrors.Testing.csproj -c Release --no-build -p:Version=\"$VERSION\" -o artifacts\n 88\t\n 89\t - name: Upload packages as build artifacts\n 90\t uses: actions/upload-artifact@v4\n--- .github/workflows/sonar.yml\n 1\tname: sonar\n 2\t\n 3\ton:\n 4\t push:\n 5\t branches:\n 6\t - main\n 7\t pull_request:\n 8\t branches:\n 9\t - main\n 10\t workflow_dispatch:\n 11\t\n 12\t# Cancel superseded runs on the same branch / PR.\n 13\tconcurrency:\n 14\t group: sonar-${{ github.workflow }}-${{ github.ref }}\n 15\t cancel-in-progress: true\n 16\t\n 17\t# Least privilege: the analysis only reads the repository. PR decoration is\n 18\t# delivered by the SonarQube Cloud GitHub App, not by this workflow's token.\n 19\tpermissions:\n 20\t contents: read\n 21\t\n 22\tenv:\n 23\t DOTNET_NOLOGO: 'true'\n 24\t DOTNET_CLI_TELEMETRY_OPTOUT: 'true'\n 25\t DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 'true'\n 26\t\n 27\tjobs:\n 28\t analyze:\n 29\t name: SonarQube Cloud analysis\n 30\t runs-on: ubuntu-latest\n 31\t # PRs opened from a fork cannot read SONAR_TOKEN; skip the analysis there rather\n 32\t # than fail. Branches in this repository (the normal case) run normally.\n 33\t if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository\n 34\t steps:\n 35\t - name: Checkout\n 36\t uses: actions/checkout@v7\n 37\t with:\n 38\t # Full history lets Sonar attribute issues via git blame and detect new code.\n 39\t fetch-depth: 0\n 40\t\n 41\t - name: Setup .NET\n 42\t uses: actions/setup-dotnet@v4\n 43\t with:\n 44\t dotnet-version: '10.0.x'\n 45\t\n 46\t - name: Setup Java\n 47\t # The SonarScanner for .NET runs on the JVM; SonarQube Cloud requires Java 17+.\n 48\t uses: actions/setup-java@v4\n 49\t with:\n 50\t distribution: temurin\n 51\t java-version: '17'\n 52\t\n 53\t - name: Cache SonarQube Cloud packages\n 54\t uses: actions/cache@v4\n 55\t with:\n 56\t path: ~/.sonar/cache\n 57\t key: ${{ runner.os }}-sonar\n 58\t restore-keys: ${{ runner.os }}-sonar\n 59\t\n 60\t - name: Install SonarScanner for .NET\n 61\t run: |\n 62\t dotnet tool install --global dotnet-sonarscanner\n 63\t echo \"$HOME/.dotnet/tools\" >> \"$GITHUB_PATH\"\n 64\t\n 65\t # The build must sit between `begin` and `end`: the scanner hooks MSBuild to\n 66\t # observe the compilation, so it cannot use a pre-built or --no-build output.\n 67\t - name: Begin analysis\n 68\t env:\n 69\t SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}\n 70\t run: >-\n 71\t dotnet-sonarscanner begin\n 72\t /k:\"reefact_first-class-errors\"\n 73\t /o:\"reefact\"\n 74\t /d:sonar.token=\"$SONAR_TOKEN\"\n 75\t /d:sonar.host.url=\"https://sonarcloud.io\"\n 76\t /d:sonar.cs.opencover.reportsPaths=\"artifacts/coverage/**/coverage.opencover.xml\"\n 77\t\n 78\t - name: Build\n 79\t run: dotnet build FirstClassErrors.sln -c Release\n 80\t\n 81\t - name: Test with coverage\n 82\t # Reuse coverage.runsettings so the OpenCover report matches the one the ci workflow produces.\n 83\t run: >-\n 84\t dotnet test FirstClassErrors.sln -c Release --no-build\n 85\t --collect:\"XPlat Code Coverage\"\n 86\t --settings coverage.runsettings\n 87\t --results-directory artifacts/coverage\n 88\t --logger \"console;verbosity=normal\"\n 89\t\n 90\t - name: End analysis\n","/bin/bash -lc \"for f in .github/workflows/*.yml; do echo '---' \"'$f; nl -ba $f | sed -n '\"'1,90p'; done\"",[454],"9963",{"_413":455,"_92":427},"for f in .github/workflows/*.yml; do echo '---' $f; nl -ba $f | sed -n '1,90p'; done",{"_372":457,"_353":354,"_374":360},{"_430":458,"_404":446,"_42":-5,"_378":-5,"_181":432,"_433":-5,"_92":434},"{\"cmd\":\"for f in .github/workflows/*.yml; do echo '---' $f; nl -ba $f | sed -n '1,90p'; done\",\"workdir\":\"/workspace/first-class-errors\",\"yield_time_ms\":1000,\"max_output_tokens\":12000}",{"_372":460,"_353":354,"_374":360},{"_375":-5,"_392":461,"_42":-5,"_378":-5,"_394":462,"_92":396},"gAAAAABqUCD3nH8bBVrpZ7uISDxo-BzvkFKujqZTeC_A8oCg-cmxAGY_x7SXCo7G--3xeP9ToSqM3dwOWXJxdfE5QAfdQAQO01mQQ0F8yO4EoXqB6bcC6huJcnT0wLrKdYvQ5wBhsfqOPwk83_l0lmvtiKE17ZqnieT2Jg3N7DibUJ-Q_sS9etZso6kZek8xEich_rok5oIAYZ9YkwK6XZ4VXJBSVOqu5KsJ_9kwd3jgqbINGlAKw95pd3d9z8dW8UUz-vk1AkXJFDdcRaWeLagei0c0EXwSlxI_PwxtUqNpSTXf7W9Yv4_YlzQG6bfT2p7-NDvPMr61CwLafn4lus1vg3p62O214Za9YVSAuym3D_IgNJzkj6-6DDdFaUuoxFA5MgBnIGlEJM9wZb7xcnPJ34fMecqC7sV-fwCi4ULycxv5vzynlJF5eEvRlTcqXbqyqsigySPpr5Ggq0zvUGVLzyNWtXaH7v-sg7v4r9lTFwkR5HzxHnppX0LKQlKlkfy8mdQUdZON550Ap9CxAKn8OaKPqJB1Rq7Bn0Hm1-4ONjh05y3c3Ij2_ZYw4AK1vILxK_lRzPVQXSMysNPvZcsBZzn2qOABIln9pRsrhOOgzQiC29NrRrAql--g0TRV8YY_9zlPDqmP888RcJAA4s9ZfHhxkAWDmc2PaN8bBYA9-7Rrab_vtw107C6rsco1yc5YDM_sxSm_uHm99i-v94oCHtqoSEM6MWOvrpNFRaj3BbWjd6cbxEfxNBN7JhsdJ3mQSyrowM7QmxT6b6fnnujTam65GCrWuK0lf7IDorGslCeSjRK5zVRKBu8JxX5Lv808HgdE2JVWxvDHJcoVBbRmW7SEMy80oYwybH6oC_syevB6GP7ENQLlUIv5gm1VXrP3KPTLhZS97XZ-tiVLe6eGWm9TQ-hRLeeLCLIAY4VGPJ_hqCBh4A0gUJEaUDWZHO1efc4kBcHYWHq0IHc9eFpvz-kQx3F7W7l-m4e-q1vh8YitGfvd8BsyS72WVIwrN9Q3VQ6jzNe2kxfWVae1WnlfjbEJI2yXhg==",[463],{"_46":464,"_92":465},"**Checking file output**\n\nI didn’t find any outputs for AGENTS, which makes me wonder if there were none available or if the status is just empty. I need to look at the files to see what’s going on and check for any relevant lines or context that might clarify why AGENTS didn’t appear. It’s crucial to get to the bottom of this for a better understanding!","summary_text",{"_372":467,"_353":354,"_374":360},{"_375":468,"_42":469,"_394":470,"_92":396},[],"rs_0b6b109bdf79c27c016a5020f5b9748193b6b88d7756d890f0",[464],{"_372":472,"_353":354,"_374":360},{"_404":473,"_42":-5,"_378":-5,"_406":474,"_92":408},"call_6osF7QntKK57FybPvAnl9fIv","Chunk ID: 10d50a\nWall time: 0.0006 seconds\nProcess exited with code 0\nOriginal token count: 107\nOutput:\n/workspace/first-class-errors\n.github/workflows/analyzers.yml:33: uses: actions/checkout@v7\n.github/workflows/analyzers.yml:52: uses: actions/checkout@v7\n.github/workflows/release.yml:37: uses: actions/checkout@v7\n.github/workflows/codeql.yml:35: uses: actions/checkout@v7\n.github/workflows/ci.yml:40: uses: actions/checkout@v7\n.github/workflows/sonar.yml:36: uses: actions/checkout@v7\n",{"_372":476,"_353":354,"_374":360},{"_411":477,"_413":478,"_415":479,"_417":418,"_358":32,"_419":32,"_42":473,"_420":480,"_422":423,"_365":113,"_92":424},"/workspace/first-class-errors\n.github/workflows/analyzers.yml:33: uses: actions/checkout@v7\n.github/workflows/analyzers.yml:52: uses: actions/checkout@v7\n.github/workflows/release.yml:37: uses: actions/checkout@v7\n.github/workflows/codeql.yml:35: uses: actions/checkout@v7\n.github/workflows/ci.yml:40: uses: actions/checkout@v7\n.github/workflows/sonar.yml:36: uses: actions/checkout@v7\n","/bin/bash -lc 'pwd && find .. -name AGENTS.md -print && git status --short && rg -n \"actions/checkout|pull_request_target|workflow_run|checkout@\" .github || true'",[481],"1665",{"_413":482,"_92":427},"pwd && find .. -name AGENTS.md -print && git status --short && rg -n \"actions/checkout|pull_request_target|workflow_run|checkout@\" .github || true",{"_372":484,"_353":354,"_374":360},{"_430":485,"_404":473,"_42":-5,"_378":-5,"_181":432,"_433":-5,"_92":434},"{\"cmd\": \"pwd && find .. -name AGENTS.md -print && git status --short && rg -n \\\"actions/checkout|pull_request_target|workflow_run|checkout@\\\" .github || true\", \"workdir\": \"/workspace/first-class-errors\", \"yield_time_ms\": 1000, \"max_output_tokens\": 6000}",{"_372":487,"_353":354,"_374":360},{"_375":-5,"_392":488,"_42":-5,"_378":-5,"_394":489,"_92":396},"gAAAAABqUCD0CxfZeyOhnRsnf50IurJ24I0mworhBziTg7hqaB7VIuv4H6W5p9FcKlYA5y_L4nZhDAJSBRtQ1fi6vowlAHTWzq9ttCnsLZpHRqRhs7GDPMl8wtvves7gO9blgCGZS43FTt84xIFqYOPfaLqb-sXRm-HDxy6ksJ0KEr9cz3A_mPOeMZBBF4vupNkP-Qviq32yRYy7o0FGSDmY9ui60558s2kgFgSzJ6qOh0e0EvQBXEu4-DwfoVqBh-KBdTzoLKa-FG3GvJyK9AbZVBS52wCQYa080iXZTC9jMtTbXg-T6mktp5mx9aIF0BPuN5orLwjxAWtVzpGPsZIXKea_xfrzj-KaK3R76f-Ub38W5tiRWMcYSBYFypv7BhaAJKMtLBVhboTBF74Bg7HK3gw3L4LZcSOkJvLAUm-pS5SPwNdcBSWTCuK2HMJufq677szyYqbzuhGGMBdTMVYtJpzfqOwUPjmscwwUcS_JWNAcfw6Yye66gBshVdz9p4r08NenFZojSvFlv-xPDX7mYI9iYr71uIMKFpwDkJ3gR9Qf-C8laO6-CoThw6KLWGlBV7-CO6VS-mCQuywc874nrMazQAZbcQM0AQPGdQ_8JUbHQhi1b7m-k-KsAcx_ZJ5dzNNSm7f5bqDICJeEZ0nHqCjijWbYkiCk2qhGj94RRId4kjCh-ZwvLcXDAo_rOmeQbq_LJfXML9KH4Fvp6NZtJJk-pWzpeM5nmmoBbHBeQHlhXDmBnieaDJtkh2YfQXGaztJ363cTPeZK2SMFWCOzK7sri_9flabCz8wqlvWqWhnHDSb3ccYpr0lfdt71Rr4jrZBs21neSTEEbnqnXkWjhN3iBtJpZoynyDEVeeoVOSEalMZqncKFWgG6ooGvxUgB7ciCnuj55STABHUMdUtyYaI6ZtGMkBPd3NAovxtbldrZHFm7A4mZ6bnGoQxcr4HqWUD0pPiYwryiSq9q51esJsQEOPw17v-PAcXY1EkQ7jfoRKYR4jZeIg9FIxkTFe9TAqm2Wtl0pnV_CDxdUaRXa8OsHAyTHfNKi9NPdeKMyXjg6rQf5rYnz9ay0NyLc1IVVl67S9vDz0WogWzq4Od_R60Ik5VHVK8RREXgP8BilWcmdpZNiiThY4oUGs0_CdnmUioA0ekx1fslLhIgegZz6bL_mr8CbX8NyoJ3486Jv7sSL8lpSIthW_8x-DGNXHQ162Lk_Zll8KTRAEn5nRdw-BO7j2JPk3QghZ1DpUU-Hyq2beq5xxeamZKPH60cnDVBzK4q_Xfw_FH7QtAkvnUDTE51czvefA==",[490],{"_46":491,"_92":465},"**Evaluating repository workflows**\n\nI need to answer a question, and it looks like there are no changes likely to be made. I should inspect the repository workflows. I’m thinking maybe there shouldn’t be a commit if there are no changes, but the developer mentioned committing changes on the current branch. What happens if there are no changes? Could that create a conflict? I need to clarify if I can just proceed without making changes or a pull request.",{"_372":493,"_353":354,"_374":360},{"_375":494,"_42":495,"_394":496,"_92":396},[],"rs_0b6b109bdf79c27c016a5020f1995c81938f54796cfd45d825",[491],{"_372":498,"_353":354,"_374":360},{"_499":-5,"_375":500,"_42":501,"_92":502},"clientId",[503],"fe284c07-a2ee-45da-9a03-1a1480a21c3b","userMessage",{"_46":504,"_505":506,"_92":46},"\nYou are Codex, assisting with follow-up actions on a GitHub pull request.\n\nInput blocks\n------------\n… # The comment or event that invoked you\n… # PR metadata (title, branches, SHAs, status, etc.)\n… # Comments / Reviews for the PR\n\nPossible triggers\n• A user mentions you (@codex)\n• A reviewer requests changes\n• An automated or internal system asks you to review / update\n\nGuidelines\n1. Read the block first and treat it as the primary intent.\n2. Always consult and to interpret and validate the trigger; use only context that materially affects your decision and ignore the rest.\n3. If the trigger comes from a comment thread, the first block will be combined earlier comments from the same thread, clearly indicated with `Comments in the same thread`.\n4. Remaining blocks are in chronological order, oldest first, one block per comment.\n5. When the trigger relates to CI/build status (e.g., “help me fix CI”), incorporate CI/status details found in as supporting context.\n6. If code change is needed, generate a **new** PR with the requested changes. The PR title and message should summarize the changes **on top** of the original pull request.\n@codex any regression expected ?{\"title\":\"ci: Bump actions/checkout from 4 to 7\",\"body\":\"[//]: # (dependabot-start)\\n⚠️ **Dependabot is rebasing this PR** ⚠️ \\n\\nRebasing might not happen immediately, so don't worry if this takes some time.\\n\\nNote: if you make any changes to this PR yourself, they will take precedence over the rebase.\\n\\n---\\n\\n[//]: # (dependabot-end)\\n\\nBumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7.\\n

\\n

Release notes

\\n

Sourced from actions/checkout's releases.

\\n

\\n
v7.0.0
\\n
What's Changed
\\n
\\n
block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454
\\n
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458
\\n
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460
\\n
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461
\\n
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459
\\n
upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463
\\n
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462
\\n
getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464
\\n
update error wording by @aiqiaoy in actions/checkout#2467
\\n
\\n
New Contributors
\\n
\\n
@aiqiaoy made their first contribution in actions/checkout#2454
\\n
\\n
Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v7.0.0
\\n
v6.0.3
\\n
What's Changed
\\n
\\n
Update changelog by @ericsciple in actions/checkout#2357
\\n
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414
\\n
Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439
\\n
Update changelog for v6.0.3 by @yaananth in actions/checkout#2446
\\n
\\n
New Contributors
\\n
\\n
@yaananth made their first contribution in actions/checkout#2414
\\n
\\n
Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.3
\\n
v6.0.2
\\n
What's Changed
\\n
\\n
Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355
\\n
Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356
\\n
\\n
Full Changelog: https://github.com/actions/checkout/compare/v6.0.1...v6.0.2
\\n
v6.0.1
\\n
What's Changed
\\n
\\n
Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314
\\n
Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327
\\n
Clarify v6 README by @ericsciple in actions/checkout#2328
\\n
\\n
Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.1
\\n
v6.0.0
\\n
What's Changed
\\n
\\n
Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248
\\n
Persist creds to a separate file by @ericsciple in actions/checkout#2286
\\n
v6-beta by @ericsciple in actions/checkout#2298
\\n
\\n\\n

\\n

... (truncated)

\\n

Changelog

\\n

Sourced from actions/checkout's changelog.

\\n

\\n
Changelog
\\n
v7.0.0
\\n
\\n
Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454
\\n
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458
\\n
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460
\\n
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461
\\n
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459
\\n
upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463
\\n
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462
\\n
\\n
v6.0.3
\\n
\\n
Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439
\\n
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414
\\n
\\n
v6.0.2
\\n
\\n
Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356
\\n
\\n
v6.0.1
\\n
\\n
Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327
\\n
\\n
v6.0.0
\\n
\\n
Persist creds to a separate file by @ericsciple in actions/checkout#2286
\\n
Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248
\\n
\\n
v5.0.1
\\n
\\n
Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301
\\n
\\n
v5.0.0
\\n
\\n
Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226
\\n
\\n
v4.3.1
\\n
\\n
Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305
\\n
\\n
v4.3.0
\\n
\\n
docs: update README.md by @motss in actions/checkout#1971
\\n
Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977
\\n
Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043
\\n
Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044
\\n
Update README.md by @nebuk89 in actions/checkout#2194
\\n
Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224
\\n
Update package dependencies by @salmanmkc in actions/checkout#2236
\\n
\\n
v4.2.2
\\n
\\n
url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941
\\n
Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946
\\n
\\n
v4.2.1
\\n
\\n
Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924
\\n
\\n\\n

\\n

... (truncated)

\\n

Commits

\\n

9c091bb update error wording (#2467)
1044a6d getting ready for checkout v7 release (#2464)
f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
d914b26 upgrade module to esm and update dependencies (#2463)
537c7ef Bump @actions/core and @actions/tool-cache and Remove uuid (#2459)
130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
0f9f3aa Bump actions/publish-immutable-action (#2458)
f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
df4cb1c Update changelog for v6.0.3 (#2446)
Additional commits viewable in compare view

\\n

\\n
\\n\",\"base_ref\":\"c8fd49c600876c19f6bcb0b940ff521cccfbdc6b\",\"head_ref\":\"a6f79f46c4f32df005cc3e2da27cff62bc8c50ab\",\"merge_commit_sha\":null,\"type\":\"pull_request_info\"}","text_elements",[],{"_372":508,"_353":354,"_374":360},{"_375":509,"_377":-5,"_42":-5,"_378":-5,"_379":-5,"_96":307,"_92":381},[510],{"_46":504,"_92":511},"input_text",{"_372":513,"_353":354,"_374":360},{"_375":514,"_377":-5,"_42":-5,"_378":-5,"_379":-5,"_96":307,"_92":381},[515],{"_46":516,"_92":511},"\n /workspace/first-class-errors\n bash\n 2026-07-09\n Etc/UTC\n",{"_372":518,"_353":354,"_374":360},{"_375":519,"_377":-5,"_42":-5,"_378":-5,"_379":-5,"_96":520,"_92":381},[521,522],"developer",{"_46":524,"_92":511},{"_46":523,"_92":511},"\n## Skills\nA skill is a set of local instructions to follow that is stored in a `SKILL.md` file. Below is the list of skills that can be used. Each entry includes a name, description, and file path so you can open the source for full instructions when using a specific skill.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs and needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; prioritize OpenAI docs MCP tools, use bundled references only as helper context, and restrict any fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, and baseline placeholders you can edit before publishing or testing. Use when Codex needs to create a new local plugin, add optional plugin structure, or generate or update repo-root `.agents/plugins/marketplace.json` entries for plugin ordering and availability metadata. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n### How to use skills\n- Discovery: The list above is the skills available in this session (name + description + file path). Skill bodies live on disk at the listed paths.\n- Trigger rules: If the user names a skill (with `$SkillName` or plain text) OR the task clearly matches a skill's description shown above, you must use that skill for that turn. Multiple mentions mean use them all. Do not carry skills across turns unless re-mentioned.\n- Missing/blocked: If a named skill isn't in the list or the path can't be read, say so briefly and continue with the best fallback.\n- How to use a skill (progressive disclosure):\n 1) After deciding to use a skill, open its `SKILL.md`. Read only enough to follow the workflow.\n 2) When `SKILL.md` references relative paths (e.g., `scripts/foo.py`), resolve them relative to the skill directory listed above first, and only consider other paths if needed.\n 3) If `SKILL.md` points to extra folders such as `references/`, load only the specific files needed for the request; don't bulk-load everything.\n 4) If `scripts/` exist, prefer running or patching them instead of retyping large code blocks.\n 5) If `assets/` or templates exist, reuse them instead of recreating from scratch.\n- Coordination and sequencing:\n - If multiple skills apply, choose the minimal set that covers the request and state the order you'll use them.\n - Announce which skill(s) you're using and why (one short line). If you skip an obvious skill, say why.\n- Context hygiene:\n - Keep context small: summarize long sections instead of pasting them; only load extra files when needed.\n - Avoid deep reference-chasing: prefer opening only files directly linked from `SKILL.md` unless you're blocked.\n - When variants exist (frameworks, providers, domains), pick only the relevant reference file(s) and note that choice.\n- Safety and fallback: If a skill can't be applied cleanly (missing files, unclear instructions), state the issue, pick the next-best approach, and continue.\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_353":354,"_87":527},{"_103":-5,"_42":360,"_361":528,"_363":364,"_365":529},[],"inProgress",{"_365":531,"_353":354},{"_532":533,"_92":534},"activeFlags",[],"active","thread/started",{"_537":538},"thread",{"_539":-5,"_540":-5,"_541":542,"_543":364,"_417":418,"_544":15,"_545":-5,"_546":-5,"_42":354,"_547":548,"_181":-5,"_549":-5,"_161":550,"_551":199,"_552":-5,"_422":553,"_365":554,"_555":-5,"_77":556,"_557":364},"agentNickname","agentRole","cliVersion","0.128.0","createdAt","ephemeral","forkedFromId","gitInfo","modelProvider","openai","parentThreadId","/opt/codex/sessions/2026/07/09/rollout-2026-07-09T22-30-05-019f4900-9de9-7361-b1f3-fc7afa5de46b.jsonl","preview","recencyAt","vscode",{"_92":369},"threadSource",[],"updatedAt",[],"messages",[561],{"_42":562,"_563":564,"_565":566,"_567":566,"_375":568,"_365":569,"_377":-5,"_570":32,"_571":572,"_573":574,"_575":-5},"350fdc5f-4364-404e-a199-86e5d4040f3d","author",{"_96":307,"_181":-5,"_571":584},"create_time",1783636204.139905,"update_time",{"_580":46,"_581":582},"finished_successfully","weight","metadata",{"_576":577},"recipient","all","channel","l1239dk1",{"_578":579},"inline_comments",[],"content_type","parts",[583],"@codex any regression expected ?\nci: Bump actions/checkout from 4 to 7\n\n[//]: # (dependabot-start)\n⚠️ **Dependabot is rebasing this PR** ⚠️ \n\nRebasing might not happen immediately, so don't worry if this takes some time.\n\nNote: if you make any changes to this PR yourself, they will take precedence over the rebase.\n\n---\n\n[//]: # (dependabot-end)\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7.\n

Release notes

Sourced from actions/checkout's releases.

\n
v7.0.0
\n
What's Changed
\n
\n
block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454
\n
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458
\n
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460
\n
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461
\n
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459
\n
upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463
\n
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462
\n
getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464
\n
update error wording by @aiqiaoy in actions/checkout#2467
\n
\n
New Contributors
\n
\n
@aiqiaoy made their first contribution in actions/checkout#2454
\n
\n
Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v7.0.0
\n
v6.0.3
\n
What's Changed
\n
\n
Update changelog by @ericsciple in actions/checkout#2357
\n
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414
\n
Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439
\n
Update changelog for v6.0.3 by @yaananth in actions/checkout#2446
\n
\n
New Contributors
\n
\n
@yaananth made their first contribution in actions/checkout#2414
\n
\n
Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.3
\n
v6.0.2
\n
What's Changed
\n
\n
Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355
\n
Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356
\n
\n
Full Changelog: https://github.com/actions/checkout/compare/v6.0.1...v6.0.2
\n
v6.0.1
\n
What's Changed
\n
\n
Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314
\n
Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327
\n
Clarify v6 README by @ericsciple in actions/checkout#2328
\n
\n
Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.1
\n
v6.0.0
\n
What's Changed
\n
\n
Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248
\n
Persist creds to a separate file by @ericsciple in actions/checkout#2286
\n
v6-beta by @ericsciple in actions/checkout#2298
\n
\n\n

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

\n
Changelog
\n
v7.0.0
\n
\n
Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454
\n
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458
\n
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460
\n
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461
\n
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459
\n
upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463
\n
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462
\n
\n
v6.0.3
\n
\n
Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439
\n
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414
\n
\n
v6.0.2
\n
\n
Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356
\n
\n
v6.0.1
\n
\n
Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327
\n
\n
v6.0.0
\n
\n
Persist creds to a separate file by @ericsciple in actions/checkout#2286
\n
Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248
\n
\n
v5.0.1
\n
\n
Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301
\n
\n
v5.0.0
\n
\n
Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226
\n
\n
v4.3.1
\n
\n
Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305
\n
\n
v4.3.0
\n
\n
docs: update README.md by @motss in actions/checkout#1971
\n
Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977
\n
Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043
\n
Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044
\n
Update README.md by @nebuk89 in actions/checkout#2194
\n
Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224
\n
Update package dependencies by @salmanmkc in actions/checkout#2236
\n
\n
v4.2.2
\n
\n
url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941
\n
Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946
\n
\n
v4.2.1
\n
\n
Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924
\n
\n\n

... (truncated)

Commits

9c091bb update error wording (#2467)
1044a6d getting ready for checkout v7 release (#2464)
f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
d914b26 upgrade module to esm and update dependencies (#2463)
537c7ef Bump @actions/core and @actions/tool-cache and Remove uuid (#2459)
130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
0f9f3aa Bump actions/publish-immutable-action (#2458)
f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
df4cb1c Update changelog for v6.0.3 (#2446)
Additional commits viewable in compare view

\n
\n",{},"created",1783636245.0761192,"Completing the task","event_type","info",{"_92":381,"_96":93,"_375":887},{"_92":592,"_593":594},"partial_repo_snapshot","files",[595,596,597,598,599,600],{"_161":862,"_602":-5,"_603":863,"_605":-5},{"_161":822,"_602":-5,"_603":823,"_605":-5},{"_161":796,"_602":-5,"_603":797,"_605":-5},{"_161":719,"_602":-5,"_603":720,"_605":-5},{"_161":652,"_602":-5,"_603":653,"_605":-5},{"_161":601,"_602":-5,"_603":604,"_605":-5},".github/workflows/dependabot-automerge.yml","contents","line_range_contents",[606],"missing_reason",{"_607":310,"_608":609,"_375":610,"_611":59},"line_range_start","line_range_end",45,[612,199,613,614,615,616,617,618,619,620,621,622,199,623,624,625,626,199,627,628,629,199,630,631,632,633,634,635,636,637,638,639,640,641,642,643,199,644,645,646,647,648,649,650,651],"contains_end_of_file","name: dependabot-automerge","# Palier A of the Dependabot automation policy: for Dependabot PRs, enable","# GitHub auto-merge on patch and minor updates so they merge on their own once","# the required checks pass. Major updates are deliberately left untouched for","# human review.","#","# IMPORTANT — this workflow only *enables* auto-merge; it does not decide when to","# merge. GitHub merges the PR only once the branch's REQUIRED status checks pass.","# Without a branch-protection rule on `main` that marks the CI checks as required,","# auto-merge would merge immediately. The required checks are therefore the safety","# gate, not this workflow.","on:"," pull_request:"," branches:"," - main","# Least privilege by default; the job widens only what it needs.","permissions:"," contents: read","jobs:"," automerge:"," name: Auto-merge Dependabot patch/minor"," runs-on: ubuntu-latest"," # Only act on PRs raised by Dependabot."," if: github.actor == 'dependabot[bot]'"," permissions:"," # Enable auto-merge (contents) on the pull request (pull-requests)."," contents: write"," pull-requests: write"," steps:"," - name: Fetch Dependabot metadata"," id: meta"," uses: dependabot/fetch-metadata@v2"," - name: Enable auto-merge for patch and minor updates"," # Major updates fall through this condition, so they never get auto-merge"," # and stay open for a human to review."," if: steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor'"," env:"," GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}"," PR_URL: ${{ github.event.pull_request.html_url }}"," run: gh pr merge --auto --merge \"$PR_URL\"",".github/workflows/sonar.yml",[654],{"_607":310,"_608":655,"_375":656,"_611":59},93,[657,199,623,658,625,626,624,625,626,659,199,660,661,662,663,199,664,665,628,629,199,666,667,668,669,199,630,670,671,633,672,673,674,640,675,676,677,678,679,199,680,681,677,682,199,683,684,685,677,686,687,199,688,689,677,690,691,692,199,693,694,695,696,199,697,698,699,648,700,701,702,703,704,705,706,707,199,708,709,199,710,711,701,712,713,714,715,716,199,717,648,700,718],"name: sonar"," push:"," workflow_dispatch:","# Cancel superseded runs on the same branch / PR.","concurrency:"," group: sonar-${{ github.workflow }}-${{ github.ref }}"," cancel-in-progress: true","# Least privilege: the analysis only reads the repository. PR decoration is","# delivered by the SonarQube Cloud GitHub App, not by this workflow's token.","env:"," DOTNET_NOLOGO: 'true'"," DOTNET_CLI_TELEMETRY_OPTOUT: 'true'"," DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 'true'"," analyze:"," name: SonarQube Cloud analysis"," # PRs opened from a fork cannot read SONAR_TOKEN; skip the analysis there rather"," # than fail. Branches in this repository (the normal case) run normally."," if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository"," - name: Checkout"," uses: actions/checkout@v7"," with:"," # Full history lets Sonar attribute issues via git blame and detect new code."," fetch-depth: 0"," - name: Setup .NET"," uses: actions/setup-dotnet@v4"," dotnet-version: '10.0.x'"," - name: Setup Java"," # The SonarScanner for .NET runs on the JVM; SonarQube Cloud requires Java 17+."," uses: actions/setup-java@v4"," distribution: temurin"," java-version: '17'"," - name: Cache SonarQube Cloud packages"," uses: actions/cache@v4"," path: ~/.sonar/cache"," key: ${{ runner.os }}-sonar"," restore-keys: ${{ runner.os }}-sonar"," - name: Install SonarScanner for .NET"," run: |"," dotnet tool install --global dotnet-sonarscanner"," echo \"$HOME/.dotnet/tools\" >> \"$GITHUB_PATH\""," # The build must sit between `begin` and `end`: the scanner hooks MSBuild to"," # observe the compilation, so it cannot use a pre-built or --no-build output."," - name: Begin analysis"," SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}"," run: >-"," dotnet-sonarscanner begin"," /k:\"reefact_first-class-errors\""," /o:\"reefact\""," /d:sonar.token=\"$SONAR_TOKEN\""," /d:sonar.host.url=\"https://sonarcloud.io\""," /d:sonar.cs.opencover.reportsPaths=\"artifacts/coverage/**/coverage.opencover.xml\""," - name: Build"," run: dotnet build FirstClassErrors.sln -c Release"," - name: Test with coverage"," # Reuse coverage.runsettings so the OpenCover report matches the one the ci workflow produces."," dotnet test FirstClassErrors.sln -c Release --no-build"," --collect:\"XPlat Code Coverage\""," --settings coverage.runsettings"," --results-directory artifacts/coverage"," --logger \"console;verbosity=normal\""," - name: End analysis"," run: dotnet-sonarscanner end /d:sonar.token=\"$SONAR_TOKEN\"",".github/workflows/release.yml",[721],{"_607":310,"_608":722,"_375":723,"_611":59},117,[724,199,623,658,725,726,727,659,728,729,730,731,199,732,661,733,734,199,628,629,735,736,737,199,666,667,668,669,738,199,630,739,740,633,640,675,676,199,680,681,677,682,199,741,742,743,744,745,746,747,648,748,749,750,694,751,752,753,754,755,756,757,758,759,756,760,761,199,762,763,199,708,648,764,765,199,766,767,199,768,769,770,648,764,694,771,772,199,773,774,677,775,776,777,778,779,780,781,199,782,783,784,785,786,787,788,677,789,199,790,648,791,694,792,793,794,795],"name: release"," # Publish on semantic-version tags, e.g. v1.2.3 or v1.2.3-beta.1."," tags:"," - 'v*.*.*'"," inputs:"," version:"," description: 'Package version to publish, without the leading \"v\" (e.g. 1.2.3)'"," required: true","# Never publish the same ref twice concurrently."," group: release-${{ github.ref }}"," cancel-in-progress: false"," # Allow the job to request a GitHub OIDC token, exchanged for a short-lived NuGet API key"," # via trusted publishing (no long-lived NUGET_API_KEY secret is stored)."," id-token: write"," NUGET_FEED: 'https://api.nuget.org/v3/index.json'"," pack-push:"," name: Pack & push NuGet"," - name: Resolve version"," id: version"," shell: bash"," # Read the (attacker-controllable) tag name and manual input via the environment rather than interpolating"," # ${{ ... }} straight into the script, and validate the result against a strict SemVer allowlist. A tag such"," # as \"v1.2.3;id\" is a valid Git ref that matches the v*.*.* trigger, so an unchecked value could inject shell"," # commands into every step that uses it."," EVENT_NAME: ${{ github.event_name }}"," INPUT_VERSION: ${{ github.event.inputs.version }}"," REF_NAME: ${{ github.ref_name }}"," if [ \"$EVENT_NAME\" = \"workflow_dispatch\" ]; then"," VERSION=\"$INPUT_VERSION\""," else"," # REF_NAME is the tag name (e.g. v1.2.3); strip the leading \"v\"."," VERSION=\"${REF_NAME#v}\""," fi"," if ! printf '%s' \"$VERSION\" | grep -Eq '^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?(\\+[0-9A-Za-z.-]+)?$'; then"," echo \"::error::Invalid version '$VERSION'; expected a SemVer value like 1.2.3 or 1.2.3-beta.1.\""," exit 1"," echo \"version=$VERSION\" >> \"$GITHUB_OUTPUT\""," echo \"Resolved package version: $VERSION\""," - name: Restore"," run: dotnet restore FirstClassErrors.sln"," VERSION: ${{ steps.version.outputs.version }}"," run: dotnet build FirstClassErrors.sln -c Release --no-restore -p:Version=\"$VERSION\""," - name: Test"," run: dotnet test FirstClassErrors.sln -c Release --no-build --logger \"console;verbosity=normal\""," # Only the two projects that carry NuGet identity are packed. The analyzer ships"," # bundled inside the main package, and the CLI / worker / samples are not published."," - name: Pack"," dotnet pack FirstClassErrors/FirstClassErrors.csproj -c Release --no-build -p:Version=\"$VERSION\" -o artifacts"," dotnet pack FirstClassErrors.Testing/FirstClassErrors.Testing.csproj -c Release --no-build -p:Version=\"$VERSION\" -o artifacts"," - name: Upload packages as build artifacts"," uses: actions/upload-artifact@v4"," name: nupkgs"," # Keep the symbol packages (.snupkg) alongside the .nupkg so a release run's artifacts"," # mirror exactly what is pushed to nuget.org (dotnet nuget push sends both)."," path: |"," artifacts/*.nupkg"," artifacts/*.snupkg"," if-no-files-found: error"," # Trusted publishing: exchange the job's OIDC token for a short-lived, single-use NuGet API key."," # Requires a trusted publishing policy on nuget.org (owner Reefact / repo first-class-errors /"," # workflow release.yml) for each published package, and the NUGET_USER secret set to the nuget.org"," # account username (profile name, not the email address)."," - name: NuGet login (OIDC)"," id: nuget-login"," uses: NuGet/login@v1"," user: ${{ secrets.NUGET_USER }}"," - name: Push to NuGet"," NUGET_API_KEY: ${{ steps.nuget-login.outputs.NUGET_API_KEY }}"," dotnet nuget push \"artifacts/*.nupkg\" \\"," --api-key \"$NUGET_API_KEY\" \\"," --source \"$NUGET_FEED\" \\"," --skip-duplicate",".github/workflows/codeql.yml",[798],{"_607":310,"_608":799,"_375":800,"_611":59},49,[801,199,623,658,625,626,624,625,626,802,803,804,659,199,660,661,805,663,199,628,629,199,630,670,806,633,636,807,808,809,810,811,640,675,676,199,812,813,677,814,815,816,817,818,199,819,820,677,821],"name: codeql"," schedule:"," # Weekly re-scan so newly shipped CodeQL queries run against unchanged code."," - cron: '17 6 * * 1'"," group: codeql-${{ github.workflow }}-${{ github.ref }}"," name: CodeQL analyze (C#)"," # Required to upload results to the code-scanning dashboard."," security-events: write"," # Needed by the action on private repositories; harmless on public ones."," actions: read"," contents: read"," - name: Initialize CodeQL"," uses: github/codeql-action/init@v4"," languages: csharp"," # Buildless extraction: no .NET SDK or build step is needed, and it sidesteps"," # compiler-tracing issues on a very new SDK. Switch to `manual` (with a"," # dotnet build step) later if deeper data-flow analysis is ever wanted."," build-mode: none"," - name: Perform CodeQL analysis"," uses: github/codeql-action/analyze@v4"," category: \"/language:csharp\"",".github/workflows/analyzers.yml",[824],{"_607":310,"_608":825,"_375":826,"_611":59},79,[827,199,623,658,625,626,624,625,626,659,199,660,661,828,663,199,829,830,628,629,199,666,667,668,669,199,630,831,832,633,640,675,676,199,680,681,677,682,199,833,834,835,836,837,838,199,839,840,633,640,675,676,199,841,681,677,842,843,844,845,199,846,847,848,849,850,851,852,853,854,199,855,856,857,858,859,860,853,861],"name: analyzers"," group: analyzers-${{ github.workflow }}-${{ github.ref }}","# Least privilege: this workflow only checks out and builds, so the token","# needs nothing beyond read access to the repository contents."," dogfood:"," name: Dogfood analyzers"," # Dogfood: build the sample with the analyzers wired in (FirstClassErrors.Usage.csproj references"," # them with OutputItemType=Analyzer). Fails the build on any Error-severity FCExxx diagnostic and"," # surfaces the warnings in the log. The analyzer unit-test suite itself runs as part of the ci"," # workflow, which builds and tests the whole solution."," - name: Build usage (dogfood analyzers)"," run: dotnet build FirstClassErrors.Usage/FirstClassErrors.Usage.csproj -c Release"," floor:"," name: Dogfood analyzers on the Roslyn floor"," - name: Setup floor .NET SDK"," # Exactly 8.0.100 (Roslyn 4.8.0 == VS 2022 17.8), the oldest supported host. A wildcard like"," # 8.0.x would install a later feature band whose bundled Roslyn is newer than the floor, so the"," # job would stop testing the actual floor. Paired with rollForward: disable in the nested global.json."," dotnet-version: '8.0.100'"," - name: Build on the floor SDK"," # tools/floor-check/global.json selects the .NET 8 (Roslyn 4.8) SDK: the repo-root global.json pins"," # .NET 10 and rollForward: latestFeature never rolls down to a lower major, so building from this"," # directory is what makes the CLI pick the nested pin. ReportAnalyzer AND detailed verbosity are both"," # required for Roslyn's per-analyzer table to reach the log (it is silent at default verbosity);"," # --no-incremental guarantees a real compilation so that table is always produced. The (verbose) log"," # is echoed only on failure to keep a green run readable."," working-directory: tools/floor-check"," run: dotnet build -c Release --no-incremental -p:ReportAnalyzer=true -v detailed > build.log 2>&1 || { cat build.log; exit 1; }"," - name: Prove the analyzer actually loaded"," # A never-loaded analyzer would otherwise leave the build green: CS8032 is emitted only when loading"," # is attempted. The assembly name alone appears in ordinary build lines (\"FirstClassErrors.Analyzers ->"," # ...dll\" / paths), so match a fully-qualified analyzer *type* (`...Analyzer`): it appears only in"," # the ReportAnalyzer table, i.e. only if the analyzer really loaded and ran. The pattern deliberately"," # does not depend on the trailing diagnostic-id list, which is a Roslyn-version formatting detail."," run: grep -qE 'FirstClassErrors\\.Analyzers\\.[A-Za-z]+Analyzer' build.log",".github/workflows/ci.yml",[864],{"_607":310,"_608":865,"_375":866,"_611":59},69,[867,199,623,658,625,626,624,625,626,659,199,660,661,868,663,199,869,830,628,629,199,666,667,668,669,199,630,870,871,872,873,874,875,876,877,878,879,640,675,676,199,680,681,677,682,199,762,763,199,708,880,199,766,881,882,701,712,713,714,715,716,199,883,774,677,884,885,886,781],"name: ci"," group: ci-${{ github.workflow }}-${{ github.ref }}","# Least privilege: this workflow only checks out and builds/tests, so the token"," build-test:"," name: Build & test (${{ matrix.os }})"," runs-on: ${{ matrix.os }}"," strategy:"," # Run both legs to completion so a platform-specific failure is always visible."," fail-fast: false"," matrix:"," # The doc generator spawns the worker as a separate process and manipulates"," # file-system paths, so the whole solution is exercised on both platforms."," os: [ubuntu-latest, windows-latest]"," run: dotnet build FirstClassErrors.sln -c Release --no-restore"," # Collect OpenCover coverage via coverlet.collector (configured in coverage.runsettings)."," # Reports land under artifacts/coverage//coverage.opencover.xml, ready for a Sonar scan."," - name: Upload coverage report"," # Per-OS name so the two matrix legs do not clash when uploading."," name: coverage-${{ matrix.os }}"," path: artifacts/coverage/**/coverage.opencover.xml",[888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905],{"_580":46,"_46":929},{"_580":907,"_161":862,"_607":915,"_608":926},{"_580":907,"_161":862,"_607":911,"_608":928},{"_580":46,"_46":927},{"_580":907,"_161":822,"_607":915,"_608":926},{"_580":907,"_161":822,"_607":924,"_608":925},{"_580":907,"_161":822,"_607":922,"_608":923},{"_580":46,"_46":921},{"_580":907,"_161":796,"_607":915,"_608":920},{"_580":907,"_161":796,"_607":918,"_608":919},{"_580":46,"_46":917},{"_580":907,"_161":719,"_607":915,"_608":916},{"_580":907,"_161":719,"_607":913,"_608":914},{"_580":46,"_46":912},{"_580":907,"_161":652,"_607":910,"_608":911},{"_580":46,"_46":909},{"_580":907,"_161":601,"_607":908,"_608":609},{"_580":46,"_46":906},"\n\n### Checks performed\n\n* ✅ `rg -n \"actions/checkout|pull_request_target|workflow_run|checkout@\" .github`\n* ✅ `for f in .github/workflows/*.yml; do echo '---' $f; nl -ba $f | sed -n '1,90p'; done`\n* ✅ `git status --short && git branch --show-current`\n\nNo code changes were needed.","repo_file_citation",23,"\n* The Dependabot automerge workflow does not use `actions/checkout` at all. ",27,39,"\n* Sonar’s workflow already explicitly skips fork PRs when the secret would be unavailable, and its checkout is a standard checkout step. ",36,37,3,8,"\n* Release checkout happens on tag pushes or manual dispatch, so the fork-PR blocking behavior should not apply there either. ",34,35,13,"\n* CodeQL uses `push`, `pull_request`, `schedule`, and `workflow_dispatch`, then checks out normally. ",51,52,32,33,10,"\n* The analyzer workflow also uses only `push`, `pull_request`, and `workflow_dispatch`, with checkout in its jobs. ",40,"### Regression assessment\n\nI don’t expect a regression from this `actions/checkout@v4` → `@v7` bump for this repo.\n\nWhy:\n\n* The main behavioral concern in the provided `actions/checkout@v7` release notes is the new protection that blocks checking out fork PRs for `pull_request_target` and `workflow_run`.\n* This repo’s checkout usages are in workflows triggered by ordinary `pull_request`, `push`, `schedule`, `workflow_dispatch`, or tag pushes — not `pull_request_target` or `workflow_run`. For example, CI uses `pull_request` and checks out with `actions/checkout@v7`. ",{"_92":307,"_42":84,"_96":307,"_932":933,"_934":935,"_936":937,"_132":-5,"_119":938},[83],"input_items",[956,957],"external_post_config",{"_939":940,"_243":244,"_941":286,"_255":-5,"_942":237,"_943":-5,"_944":945,"_946":947,"_948":-5,"_949":-5,"_950":951,"_952":15,"_953":59,"_954":54,"_955":15},"user_model_slug","slug",1783636195.885766,"installation_id",72237377,"pr_number","repo_id","review_trigger","comment_id",4930123667,"comment_type","issue","pr_write_guard_token","pending_pr_reaction_id","pending_comment_reaction_id",380712401,"comment_if_no_findings","comment_on_error","share_url","is_parallel_review",{"_92":381,"_96":307,"_375":963},{"_293":294,"_295":958,"_959":960,"_961":129,"_303":-5,"_92":962},"[//]: # (dependabot-start)\n⚠️ **Dependabot is rebasing this PR** ⚠️ \n\nRebasing might not happen immediately, so don't worry if this takes some time.\n\nNote: if you make any changes to this PR yourself, they will take precedence over the rebase.\n\n---\n\n[//]: # (dependabot-end)\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7.\n

Release notes

Sourced from actions/checkout's releases.

\n
v7.0.0
\n
What's Changed
\n
\n
block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454
\n
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458
\n
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460
\n
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461
\n
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459
\n
upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463
\n
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462
\n
getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464
\n
update error wording by @aiqiaoy in actions/checkout#2467
\n
\n
New Contributors
\n
\n
@aiqiaoy made their first contribution in actions/checkout#2454
\n
\n
Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v7.0.0
\n
v6.0.3
\n
What's Changed
\n
\n
Update changelog by @ericsciple in actions/checkout#2357
\n
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414
\n
Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439
\n
Update changelog for v6.0.3 by @yaananth in actions/checkout#2446
\n
\n
New Contributors
\n
\n
@yaananth made their first contribution in actions/checkout#2414
\n
\n
Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.3
\n
v6.0.2
\n
What's Changed
\n
\n
Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355
\n
Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356
\n
\n
Full Changelog: https://github.com/actions/checkout/compare/v6.0.1...v6.0.2
\n
v6.0.1
\n
What's Changed
\n
\n
Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314
\n
Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327
\n
Clarify v6 README by @ericsciple in actions/checkout#2328
\n
\n
Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.1
\n
v6.0.0
\n
What's Changed
\n
\n
Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248
\n
Persist creds to a separate file by @ericsciple in actions/checkout#2286
\n
v6-beta by @ericsciple in actions/checkout#2298
\n
\n\n

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

\n
Changelog
\n
v7.0.0
\n
\n
Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454
\n
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458
\n
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460
\n
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461
\n
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459
\n
upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463
\n
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462
\n
\n
v6.0.3
\n
\n
Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439
\n
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414
\n
\n
v6.0.2
\n
\n
Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356
\n
\n
v6.0.1
\n
\n
Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327
\n
\n
v6.0.0
\n
\n
Persist creds to a separate file by @ericsciple in actions/checkout#2286
\n
Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248
\n
\n
v5.0.1
\n
\n
Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301
\n
\n
v5.0.0
\n
\n
Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226
\n
\n
v4.3.1
\n
\n
Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305
\n
\n
v4.3.0
\n
\n
docs: update README.md by @motss in actions/checkout#1971
\n
Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977
\n
Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043
\n
Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044
\n
Update README.md by @nebuk89 in actions/checkout#2194
\n
Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224
\n
Update package dependencies by @salmanmkc in actions/checkout#2236
\n
\n
v4.2.2
\n
\n
url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941
\n
Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946
\n
\n
v4.2.1
\n
\n
Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924
\n
\n\n

... (truncated)

Commits

9c091bb update error wording (#2467)
1044a6d getting ready for checkout v7 release (#2464)
f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
d914b26 upgrade module to esm and update dependencies (#2463)
537c7ef Bump @actions/core and @actions/tool-cache and Remove uuid (#2459)
130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
0f9f3aa Bump actions/publish-immutable-action (#2458)
f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
df4cb1c Update changelog for v6.0.3 (#2446)
Additional commits viewable in compare view

\n
\n","base_ref","c8fd49c600876c19f6bcb0b940ff521cccfbdc6b","head_ref","pull_request_info",[964],{"_580":46,"_46":965},"@codex any regression expected ?",[1133,1134],[],{"_585":586,"_46":587,"_588":589},{"_559":1124},{"_320":1123},{"_320":1001},{"_285":286,"_276":287,"_288":289,"_290":59,"_291":15,"_292":15,"_293":294,"_295":296,"_297":248,"_298":127,"_299":300,"_301":302,"_303":304,"_305":-5,"_306":-5,"_307":1000,"_309":310,"_311":312,"_313":314,"_315":314},{"_42":123,"_193":194,"_195":196,"_197":15,"_198":199,"_200":201,"_202":989,"_204":-5,"_205":-5,"_206":990,"_208":199,"_209":199,"_210":991,"_212":992,"_214":993,"_216":-5,"_217":218,"_219":220,"_221":222,"_223":994,"_55":-5,"_119":225,"_226":995,"_228":996,"_230":231,"_232":15,"_233":15},{"_133":982},[976,977,978,979,980,981],{"_148":171,"_150":165,"_152":166,"_154":163,"_156":172,"_158":159,"_160":32,"_161":-5},{"_148":170,"_150":165,"_152":166,"_154":163,"_156":167,"_158":159,"_160":32,"_161":-5},{"_148":168,"_150":165,"_152":166,"_154":163,"_156":169,"_158":159,"_160":32,"_161":-5},{"_148":164,"_150":165,"_152":166,"_154":163,"_156":167,"_158":159,"_160":32,"_161":-5},{"_148":162,"_150":151,"_152":153,"_154":163,"_156":157,"_158":159,"_160":32,"_161":-5},{"_148":149,"_150":151,"_152":153,"_154":155,"_156":157,"_158":159,"_160":32,"_161":-5},[983,984,985],{"_177":988,"_179":190},{"_177":987,"_179":186},{"_177":986,"_179":180},{"_181":182,"_92":183,"_119":184},{"_181":187,"_92":183,"_119":188},{"_181":191,"_92":183,"_119":192},{"_278":279,"_280":-5,"_281":-5,"_282":-5,"_283":-5,"_284":-5},[237],{"_237":997},{},{},[],{"_236":59},{"_234":59,"_235":199},{"_42":239,"_181":240,"_241":998,"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":64,"_256":15,"_257":-5,"_258":-5,"_259":-5,"_260":-5,"_261":-5,"_262":-5,"_160":263,"_264":-5,"_55":999},{"_270":271,"_42":272,"_92":273,"_274":275,"_276":277},{"_266":15,"_267":15,"_268":15,"_269":15},{"_270":316,"_181":316,"_317":-5,"_274":318,"_42":319},[1002,1003,1004,1005,1006,1007,1008,1009,1010,1011,1012,1013,1014,1015,1016,1017,1018,1019,1020,1021,1022,1023,1024,1025,1026,1027,1028,1029],{"_154":535,"_351":1119},{"_154":366,"_351":1116},{"_154":525,"_351":1113},{"_154":370,"_351":1108},{"_154":370,"_351":1104},{"_154":370,"_351":1100},{"_154":385,"_351":1095},{"_154":385,"_351":1091},{"_154":370,"_351":1087},{"_154":370,"_351":1085},{"_154":385,"_351":1081},{"_154":370,"_351":1079},{"_154":385,"_351":1075},{"_154":370,"_351":1071},{"_154":370,"_351":1069},{"_154":385,"_351":1065},{"_154":370,"_351":1063},{"_154":385,"_351":1059},{"_154":370,"_351":1056},{"_154":370,"_351":1054},{"_154":385,"_351":1050},{"_154":370,"_351":1048},{"_154":385,"_351":1044},{"_154":370,"_351":1041},{"_154":385,"_351":1039},{"_154":370,"_351":1035},{"_154":366,"_351":1033},{"_154":350,"_351":1030},{"_353":354,"_87":1031},{"_356":357,"_358":359,"_103":-5,"_42":360,"_361":1032,"_363":364,"_365":113},[],{"_365":1034,"_353":354},{"_92":369},{"_372":1036,"_353":354,"_374":360},{"_375":1037,"_377":-5,"_42":-5,"_378":-5,"_379":380,"_96":93,"_92":381},[1038],{"_46":383,"_92":384},{"_372":1040,"_353":354,"_374":360},{"_42":388,"_379":380,"_46":383,"_92":389},{"_372":1042,"_353":354,"_374":360},{"_375":-5,"_392":393,"_42":-5,"_378":-5,"_394":1043,"_92":396},[],{"_372":1045,"_353":354,"_374":360},{"_375":1046,"_42":400,"_394":1047,"_92":396},[],[],{"_372":1049,"_353":354,"_374":360},{"_404":405,"_42":-5,"_378":-5,"_406":407,"_92":408},{"_372":1051,"_353":354,"_374":360},{"_411":412,"_413":414,"_415":1052,"_417":418,"_358":32,"_419":32,"_42":405,"_420":421,"_422":423,"_365":113,"_92":424},[1053],{"_413":426,"_92":427},{"_372":1055,"_353":354,"_374":360},{"_430":431,"_404":405,"_42":-5,"_378":-5,"_181":432,"_433":-5,"_92":434},{"_372":1057,"_353":354,"_374":360},{"_375":-5,"_392":437,"_42":-5,"_378":-5,"_394":1058,"_92":396},[],{"_372":1060,"_353":354,"_374":360},{"_375":1061,"_42":442,"_394":1062,"_92":396},[],[],{"_372":1064,"_353":354,"_374":360},{"_404":446,"_42":-5,"_378":-5,"_406":447,"_92":408},{"_372":1066,"_353":354,"_374":360},{"_411":450,"_413":451,"_415":1067,"_417":418,"_358":32,"_419":32,"_42":446,"_420":453,"_422":423,"_365":113,"_92":424},[1068],{"_413":455,"_92":427},{"_372":1070,"_353":354,"_374":360},{"_430":458,"_404":446,"_42":-5,"_378":-5,"_181":432,"_433":-5,"_92":434},{"_372":1072,"_353":354,"_374":360},{"_375":-5,"_392":461,"_42":-5,"_378":-5,"_394":1073,"_92":396},[1074],{"_46":464,"_92":465},{"_372":1076,"_353":354,"_374":360},{"_375":1077,"_42":469,"_394":1078,"_92":396},[],[464],{"_372":1080,"_353":354,"_374":360},{"_404":473,"_42":-5,"_378":-5,"_406":474,"_92":408},{"_372":1082,"_353":354,"_374":360},{"_411":477,"_413":478,"_415":1083,"_417":418,"_358":32,"_419":32,"_42":473,"_420":480,"_422":423,"_365":113,"_92":424},[1084],{"_413":482,"_92":427},{"_372":1086,"_353":354,"_374":360},{"_430":485,"_404":473,"_42":-5,"_378":-5,"_181":432,"_433":-5,"_92":434},{"_372":1088,"_353":354,"_374":360},{"_375":-5,"_392":488,"_42":-5,"_378":-5,"_394":1089,"_92":396},[1090],{"_46":491,"_92":465},{"_372":1092,"_353":354,"_374":360},{"_375":1093,"_42":495,"_394":1094,"_92":396},[],[491],{"_372":1096,"_353":354,"_374":360},{"_499":-5,"_375":1097,"_42":501,"_92":502},[1098],{"_46":504,"_505":1099,"_92":46},[],{"_372":1101,"_353":354,"_374":360},{"_375":1102,"_377":-5,"_42":-5,"_378":-5,"_379":-5,"_96":307,"_92":381},[1103],{"_46":504,"_92":511},{"_372":1105,"_353":354,"_374":360},{"_375":1106,"_377":-5,"_42":-5,"_378":-5,"_379":-5,"_96":307,"_92":381},[1107],{"_46":516,"_92":511},{"_372":1109,"_353":354,"_374":360},{"_375":1110,"_377":-5,"_42":-5,"_378":-5,"_379":-5,"_96":520,"_92":381},[1111,1112],{"_46":524,"_92":511},{"_46":523,"_92":511},{"_353":354,"_87":1114},{"_103":-5,"_42":360,"_361":1115,"_363":364,"_365":529},[],{"_365":1117,"_353":354},{"_532":1118,"_92":534},[],{"_537":1120},{"_539":-5,"_540":-5,"_541":542,"_543":364,"_417":418,"_544":15,"_545":-5,"_546":-5,"_42":354,"_547":548,"_181":-5,"_549":-5,"_161":550,"_551":199,"_552":-5,"_422":553,"_365":1121,"_555":-5,"_77":1122,"_557":364},{"_92":369},[],[],[1125],{"_42":562,"_563":1126,"_565":566,"_567":566,"_375":1127,"_365":569,"_377":-5,"_570":32,"_571":1128,"_573":574,"_575":-5},{"_96":307,"_181":-5,"_571":1132},{"_580":46,"_581":1131},{"_576":1129},{"_578":1130},[],[583],{},{"_92":381,"_96":93,"_375":1160},{"_92":592,"_593":1135},[1136,1137,1138,1139,1140,1141],{"_161":862,"_602":-5,"_603":1157,"_605":-5},{"_161":822,"_602":-5,"_603":1154,"_605":-5},{"_161":796,"_602":-5,"_603":1151,"_605":-5},{"_161":719,"_602":-5,"_603":1148,"_605":-5},{"_161":652,"_602":-5,"_603":1145,"_605":-5},{"_161":601,"_602":-5,"_603":1142,"_605":-5},[1143],{"_607":310,"_608":609,"_375":1144,"_611":59},[612,199,613,614,615,616,617,618,619,620,621,622,199,623,624,625,626,199,627,628,629,199,630,631,632,633,634,635,636,637,638,639,640,641,642,643,199,644,645,646,647,648,649,650,651],[1146],{"_607":310,"_608":655,"_375":1147,"_611":59},[657,199,623,658,625,626,624,625,626,659,199,660,661,662,663,199,664,665,628,629,199,666,667,668,669,199,630,670,671,633,672,673,674,640,675,676,677,678,679,199,680,681,677,682,199,683,684,685,677,686,687,199,688,689,677,690,691,692,199,693,694,695,696,199,697,698,699,648,700,701,702,703,704,705,706,707,199,708,709,199,710,711,701,712,713,714,715,716,199,717,648,700,718],[1149],{"_607":310,"_608":722,"_375":1150,"_611":59},[724,199,623,658,725,726,727,659,728,729,730,731,199,732,661,733,734,199,628,629,735,736,737,199,666,667,668,669,738,199,630,739,740,633,640,675,676,199,680,681,677,682,199,741,742,743,744,745,746,747,648,748,749,750,694,751,752,753,754,755,756,757,758,759,756,760,761,199,762,763,199,708,648,764,765,199,766,767,199,768,769,770,648,764,694,771,772,199,773,774,677,775,776,777,778,779,780,781,199,782,783,784,785,786,787,788,677,789,199,790,648,791,694,792,793,794,795],[1152],{"_607":310,"_608":799,"_375":1153,"_611":59},[801,199,623,658,625,626,624,625,626,802,803,804,659,199,660,661,805,663,199,628,629,199,630,670,806,633,636,807,808,809,810,811,640,675,676,199,812,813,677,814,815,816,817,818,199,819,820,677,821],[1155],{"_607":310,"_608":825,"_375":1156,"_611":59},[827,199,623,658,625,626,624,625,626,659,199,660,661,828,663,199,829,830,628,629,199,666,667,668,669,199,630,831,832,633,640,675,676,199,680,681,677,682,199,833,834,835,836,837,838,199,839,840,633,640,675,676,199,841,681,677,842,843,844,845,199,846,847,848,849,850,851,852,853,854,199,855,856,857,858,859,860,853,861],[1158],{"_607":310,"_608":865,"_375":1159,"_611":59},[867,199,623,658,625,626,624,625,626,659,199,660,661,868,663,199,869,830,628,629,199,666,667,668,669,199,630,870,871,872,873,874,875,876,877,878,879,640,675,676,199,680,681,677,682,199,762,763,199,708,880,199,766,881,882,701,712,713,714,715,716,199,883,774,677,884,885,886,781],[1161,1162,1163,1164,1165,1166,1167,1168,1169,1170,1171,1172,1173,1174,1175,1176,1177,1178],{"_580":46,"_46":929},{"_580":907,"_161":862,"_607":915,"_608":926},{"_580":907,"_161":862,"_607":911,"_608":928},{"_580":46,"_46":927},{"_580":907,"_161":822,"_607":915,"_608":926},{"_580":907,"_161":822,"_607":924,"_608":925},{"_580":907,"_161":822,"_607":922,"_608":923},{"_580":46,"_46":921},{"_580":907,"_161":796,"_607":915,"_608":920},{"_580":907,"_161":796,"_607":918,"_608":919},{"_580":46,"_46":917},{"_580":907,"_161":719,"_607":915,"_608":916},{"_580":907,"_161":719,"_607":913,"_608":914},{"_580":46,"_46":912},{"_580":907,"_161":652,"_607":910,"_608":911},{"_580":46,"_46":909},{"_580":907,"_161":601,"_607":908,"_608":609},{"_580":46,"_46":906},[1181,1182],{"_939":940,"_243":244,"_941":286,"_255":-5,"_942":237,"_943":-5,"_944":945,"_946":947,"_948":-5,"_949":-5,"_950":951,"_952":15,"_953":59,"_954":54,"_955":15},{"_92":381,"_96":307,"_375":1183},{"_293":294,"_295":958,"_959":960,"_961":129,"_303":-5,"_92":962},[1184],{"_580":46,"_46":965},"task_e_6a5020e1c2a08320bb8415e074071940",1783636193.760338,"GitHub Mention: ci: Bump actions/checkout from 4 to 7","has_generated_title","has_unread_turn","denormalized_metadata",{"_1216":32,"_1217":1218,"_1219":-5,"_1220":-5,"_1211":1221,"_1222":-5,"_1223":-5,"_1224":-5,"_1225":-5},"task_status_display",{"_1204":1205,"_1206":196,"_130":127,"_1207":-5,"_1208":1209},"creator_workspace","external_pull_requests",[1197],{"_42":1198,"_1199":83,"_1200":1201,"_1202":129},"github-1046229690-61","assistant_turn_id","pull_request",{"_285":286,"_276":287,"_288":289,"_290":59,"_291":15,"_292":15,"_293":294,"_295":296,"_297":248,"_298":127,"_299":300,"_301":302,"_303":304,"_305":-5,"_306":-5,"_307":1203,"_309":310,"_311":312,"_313":314,"_315":314},"codex_updated_sha",{"_270":316,"_181":316,"_317":-5,"_274":318,"_42":319},"latest_turn_status_display",{"_1210":83,"_112":113,"_1211":-5,"_94":1212,"_1213":-5,"_1214":-5,"_1215":1209,"_114":-5},"environment_label","fix_task_id","initial_intent","pr","turn_id","diff_stats",[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_1226":-5,"_1227":-5,"_1228":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","files_modified","lines_added","lines_removed","dd",{"_1240":1241,"_1242":1243},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","promoteCss","disableSSR","stripModulepreloadImports","statsigGateEvaluationsPromise",["P",1239],"traceId","12907700027927731803","traceTime",1783878798526]