actions/checkout

Treat actions/checkout as infrastructure you pin and occasionally re-read, not a tool you evaluate and adopt. Upgrading across major versions is worth a deliberate look, because v5-v7 changed runtime requirements and the default behavior around fork pull requests.

The problem

A workflow needs the repository's files in $GITHUB_WORKSPACE before it can build, test or lint, but the runner starts empty. Adding this action changes that: the code appears on the runner, with a single triggering commit by default, and later steps can run git and their build commands against it. Without it, every workflow would need its own clone step and its own handling of tokens, refs and cleanup.

What's different

The action fetches only the commit that triggered the workflow unless you set fetch-depth: 0, which keeps jobs fast but means history-dependent tooling needs that input adjusted. Authentication is handled for you: the token or SSH key is configured so authenticated git commands work, then removed during post-job cleanup. Since v6, persist-credentials stores credentials in a separate file under $RUNNER_TEMP rather than in .git/config, and persist-credentials: false opts out entirely.

The most consequential change is v7's default refusal to check out fork pull-request code when a workflow is triggered by pull_request_target or workflow_run, because those triggers run with the base repository's token, secrets and runner access. Opting back in requires setting allow-unsafe-pr-checkout: true after reviewing the linked risks. That flip is a real workflow-behavior change: jobs that relied on checking out fork code under those triggers will fail until adjusted deliberately.

Who should try it

Anyone writing a GitHub Actions workflow that needs repository contents should use it; it is the conventional first step. Maintainers of workflows using pull_request_target or workflow_run should treat the v7 upgrade as a review item, since the new default can stop previously working fork-checkout jobs. Teams running Docker container actions that need authenticated git commands should check their runner version, since v6 requires Actions Runner v2.329.0 or later. Anyone wanting to change the action itself is out of luck: the README states the repository is not taking contributions right now.

Requirements and limitations

Version compatibility is the main thing to pin down. v5 requires runner v2.327.1 or later for the node24 runtime; v6's separate credential file requires runner v2.329.0 or later for authenticated git inside Docker container actions. Self-hosted runners left on older versions can break after an upgrade.

Operationally, the token persists in the local git config by default so scripts can push, and is removed in post-job cleanup; set persist-credentials: false if jobs should not have that access. Workflows needing full history must set fetch-depth: 0, which costs time on large repositories. The change history is on the release page, and the fork-checkout trade-off is explained in GitHub's guidance.

HotRepo's take

HotRepo recorded this repository at 8,966 stars on 2026-10-24 and 8,967 on 2026-10-25, with +4 stars on each of those two days; the sample is too short to say anything about momentum. The useful check before upgrading is whether your workflows use pull_request_target or workflow_run to check out fork code, and whether your runners meet the v5/v6 minimums.