Update github actions (major)

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v4 → v7
dependabot/fetch-metadata	action	major	v2 → v3

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Various dependency updates

v7

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v6.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in #​2500
• backport fixes to releases-v6 by @​aiqiaoy in #​2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

v6.0.0

Compare Source

• Persist creds to a separate file by @​ericsciple in #​2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in #​2248

v6

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v5.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v5 by @​aiqiaoy in #​2501
• backport fixes to releases-v5 by @​aiqiaoy in #​2523

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v5.0.1...v5.1.0

v5.0.1

Compare Source

• Port v6 cleanup to v5 by @​ericsciple in #​2301

v5.0.0

Compare Source

• Update actions checkout to use node 24 by @​salmanmkc in #​2226

v5

Compare Source

• Port v6 cleanup to v5 by @​ericsciple in #​2301

dependabot/fetch-metadata (dependabot/fetch-metadata)

v3.1.0

Compare Source

What's Changed

• Add permissions to all workflows by @​truggeri in #​687
• build(deps-dev): bump globals from 16.0.0 to 17.4.0 by @​dependabot[bot] in #​690
• build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 by @​dependabot[bot] in #​693
• build(deps-dev): bump @​hono/node-server from 1.19.10 to 1.19.13 by @​dependabot[bot] in #​694
• build(deps-dev): bump hono from 4.12.7 to 4.12.12 by @​dependabot[bot] in #​695
• Dynamically update the tracking tag in action by @​truggeri in #​696
• fix: handle duplicate dependency names in parseMetadataLinks by @​devantler in #​700
• fix: remove $ anchor from updateFragment regex to handle pip directory suffixes by @​devantler in #​698
• Updates to README for permissions clarification by @​truggeri in #​697
• fix: resolve update-type null for Python, Composer, and Terraform PRs by @​vitorsdcs in #​704
• build(deps-dev): bump globals from 17.4.0 to 17.5.0 by @​dependabot[bot] in #​703
• build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 by @​dependabot[bot] in #​701
• build(deps): bump @​actions/github from 9.0.0 to 9.1.0 in the dependencies group across 1 directory by @​dependabot[bot] in #​702
• build(deps-dev): bump hono from 4.12.12 to 4.12.14 by @​dependabot[bot] in #​705
• v3.1.0 by @​fetch-metadata-action-automation[bot] in #​692

New Contributors

• @​devantler made their first contribution in #​700
• @​vitorsdcs made their first contribution in #​704

Full Changelog: dependabot/fetch-metadata@v3...v3.1.0

v3.0.0

Compare Source

The breaking change is requiring Node.js version v24 as the Actions runtime.

What's Changed

• feat: Parse versions from metadata links by @​ppkarwasz in #​632
• Upgrade actions core and actions github packages by @​truggeri in #​649
• docs: Add notes for using alert-lookup with App Token by @​sue445 in #​656
• feat!: update Node.js version to v24 by @​sturman in #​671
• Switch build tooling from ncc to esbuild by @​truggeri in #​676
• Add --legal-comments=none to esbuild build commands by @​jeffwidman in #​679
• Bump tsconfig target from es2022 to es2024 by @​jeffwidman in #​680
• Remove vestigial outDir from tsconfig.json by @​jeffwidman in #​681
• Switch tsconfig module resolution to bundler by @​jeffwidman in #​682
• Remove skipLibCheck from tsconfig.json by @​jeffwidman in #​683
• Add typecheck step to CI by @​jeffwidman in #​685
• Enable noImplicitAny in tsconfig.json by @​jeffwidman in #​684
• Upgrade @​actions/core to ^3.0.0 by @​truggeri in #​677
• Upgrade @​actions/github to ^9.0.0 and @​octokit/request-error to ^7.1.0 by @​truggeri in #​678
• Bump qs from 6.14.0 to 6.14.1 by @​dependabot[bot] in #​651
• Bump hono from 4.11.1 to 4.11.4 by @​dependabot[bot] in #​652
• Bump hono from 4.11.4 to 4.11.7 by @​dependabot[bot] in #​653
• Bump hono from 4.11.7 to 4.12.0 by @​dependabot[bot] in #​657
• Bump qs from 6.14.1 to 6.14.2 by @​dependabot[bot] in #​655
• Bump @​modelcontextprotocol/sdk from 1.25.1 to 1.26.0 by @​dependabot[bot] in #​654
• Bump @​hono/node-server from 1.19.9 to 1.19.10 by @​dependabot[bot] in #​665
• Bump hono from 4.12.2 to 4.12.5 by @​dependabot[bot] in #​664
• Bump minimatch from 3.1.2 to 3.1.5 by @​dependabot[bot] in #​667
• Bump hono from 4.12.5 to 4.12.7 by @​dependabot[bot] in #​668
• Bump actions/create-github-app-token from 2.2.1 to 3.0.0 by @​dependabot[bot] in #​669
• Bump flatted from 3.3.3 to 3.4.2 by @​dependabot[bot] in #​670
• build(deps-dev): bump picomatch from 2.3.1 to 2.3.2 by @​dependabot[bot] in #​674

New Contributors

• @​ppkarwasz made their first contribution in #​632
• @​truggeri made their first contribution in #​649
• @​sue445 made their first contribution in #​656
• @​sturman made their first contribution in #​671

Full Changelog: dependabot/fetch-metadata@v2...v3.0.0

v3

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR.

I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[bmeng]

/ok-to-test

[bmeng]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bmeng, red-hat-konflux-kflux-prd-rh02[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bmeng]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment