diff --git a/.github/workflows/ci-post-land.yml b/.github/workflows/ci-post-land.yml
index c47304ea45ee..32e88e274d95 100644
--- a/.github/workflows/ci-post-land.yml
+++ b/.github/workflows/ci-post-land.yml
@@ -25,7 +25,7 @@ jobs:
       rust-changes: ${{ steps.rust-changes.outputs.changes-found }}
       base-image-changes: ${{ steps.base-image-changes.outputs.changes-found }}
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           # This ensures that the tip of the PR is checked out instead of the merge between the base ref and the tip
           # On `push` this value will be empty and will "do-the-right-thing"
@@ -65,7 +65,7 @@ jobs:
       volumes:
         - "${{github.workspace}}:/opt/git/diem"
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           # This ensures that the tip of the PR is checked out instead of the merge between the base ref and the tip
           # On `push` this value will be empty and will "do-the-right-thing"
@@ -99,7 +99,7 @@ jobs:
       volumes:
         - "${{github.workspace}}:/opt/git/diem"
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           # This ensures that the tip of the PR is checked out instead of the merge between the base ref and the tip
           # On `push` this value will be empty and will "do-the-right-thing"
@@ -132,7 +132,7 @@ jobs:
       IMAGE_NAME: ${{ github.repository }}_build_environment
       IMAGE_TAG: ${{ needs.prepare.outputs.changes-target-branch }}
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           # This ensures that the tip of the PR is checked out instead of the merge between the base ref and the tip
           # On `push` this value will be empty and will "do-the-right-thing"
@@ -158,7 +158,7 @@ jobs:
     # The pre-release suite run time varies 1~1.5 hr.
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           fetch-depth: 0 #get all the history!!!
       - name: set_env
@@ -233,7 +233,7 @@ jobs:
       name: Docker
       url: https://hub.docker.com/u/diem
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           fetch-depth: 0 #get all the history!!!
       - name: setup_aws_ecr_login
@@ -321,7 +321,7 @@ jobs:
         - "${{github.workspace}}:/opt/git/diem"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v3.3.0
       - uses: ./.github/actions/build-setup
       - uses: actions/cache@v2.1.6
         with:
diff --git a/.github/workflows/ci-test-complete.yml b/.github/workflows/ci-test-complete.yml
index 92849f0fc0fc..812d89c57bb9 100644
--- a/.github/workflows/ci-test-complete.yml
+++ b/.github/workflows/ci-test-complete.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event.workflow_run.conclusion != 'skipped' }}
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
       - name: Download artifacts
         uses: diem/actions/get-artifacts@faadd16607b77dfa2231a8f366883e01717b3225
         with:
diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index c0d4552b931c..bdf9082733c6 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -36,7 +36,7 @@ jobs:
       test-test-coverage: ${{ steps.test-coverage.outputs.changes-found }}
       test-api-spec: ${{ steps.test-api-spec.outputs.changes-found }}
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           # This ensures that the tip of the PR is checked out instead of the merge between the base ref and the tip
           # On `push` this value will be empty and will "do-the-right-thing"
@@ -156,7 +156,7 @@ jobs:
       matrix:
         target_os: [alpine, arch, github]
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: build image with dev-setup.sh
@@ -180,7 +180,7 @@ jobs:
         target_images:
           [faucet forge, init tools validator validator-tcb]
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           fetch-depth: 0 #get all the history!!!
       - id: changes
@@ -249,7 +249,7 @@ jobs:
       # The last matrix build to succeed will set the output.   Hilarious.
       prev-tag: ${{ steps.build-extra-images.outputs.prev-tag }}
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0 #get all the history!!!
@@ -303,7 +303,7 @@ jobs:
     container:
       image: ghcr.io/diem/diem_build_environment:${{ needs.prepare.outputs.changes-target-branch }}
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: ./.github/actions/build-setup
@@ -333,7 +333,7 @@ jobs:
       volumes:
         - "${{github.workspace}}:/opt/git/diem"
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: ./.github/actions/build-setup
@@ -365,7 +365,7 @@ jobs:
       volumes:
         - "${{github.workspace}}:/opt/git/diem"
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0 #get all the history!!!
@@ -415,7 +415,7 @@ jobs:
       volumes:
         - "${{github.workspace}}:/opt/git/diem"
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0 #get all the history!!!
@@ -464,7 +464,7 @@ jobs:
       FLAKY_TESTS_FILE: /tmp/failures
       MESSAGE_PAYLOAD_FILE: /tmp/message
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0 #get all the history!!!
@@ -542,7 +542,7 @@ jobs:
       volumes:
         - "${{github.workspace}}:/opt/git/diem"
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0 #get all the history!!!
@@ -568,7 +568,7 @@ jobs:
     needs: prepare
     if: ${{ needs.prepare.outputs.test-docker-compose == 'true' }}
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: install expect
@@ -606,7 +606,7 @@ jobs:
       volumes:
         - "${{github.workspace}}:/opt/git/diem"
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: ./.github/actions/build-setup
@@ -635,7 +635,7 @@ jobs:
   #     volumes:
   #       - "${{github.workspace}}:/opt/git/diem"
   #   steps:
-  #     - uses: actions/checkout@v2.4.0
+  #     - uses: actions/checkout@v3.3.0
   #       with:
   #         ref: ${{ github.event.pull_request.head.sha }}
   #     - uses: ./.github/actions/build-setup
@@ -664,7 +664,7 @@ jobs:
     needs: prepare
     if: ${{ needs.prepare.outputs.test-helm == 'true' }}
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Check machine details for minikube
@@ -742,7 +742,7 @@ jobs:
       volumes:
         - "${{github.workspace}}:/opt/git/diem"
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v3.3.0
       - uses: ./.github/actions/build-setup
       - name:
         working-directory: api
@@ -759,7 +759,7 @@ jobs:
       volumes:
         - "${{github.workspace}}:/opt/git/diem"
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: ./.github/actions/build-setup
@@ -787,7 +787,7 @@ jobs:
       volumes:
         - "${{github.workspace}}:/opt/git/diem"
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: ./.github/actions/build-setup
@@ -817,7 +817,7 @@ jobs:
     if: ${{ needs.prepare.outputs.test-website-build == 'true' }}
     steps:
       # Checks-out the Diem website repository under $GITHUB_WORKSPACE, so job can access it
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: actions/cache@v2.1.6
@@ -859,7 +859,7 @@ jobs:
       forge-result: ${{ steps.post-test-result.outputs.forge-result }}
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           # This ensures that the tip of the PR is checked out instead of the merge between the base ref and the tip
           # On `push` this value will be empty and will "do-the-right-thing"
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index 845699233cf7..f40f7d7cff9f 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -23,7 +23,7 @@ jobs:
     env:
       AUDIT_SUMMARY_FILE: /tmp/summary
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ matrix.target-branch }}
       - uses: ./.github/actions/build-setup
@@ -67,7 +67,7 @@ jobs:
       CODECOV_OUTPUT: codecov
       MESSAGE_PAYLOAD_FILE: /tmp/message
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
       - uses: ./.github/actions/build-setup
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v1
@@ -113,7 +113,7 @@ jobs:
       matrix:
         target-branch: [main]
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
           ref: ${{ matrix.target-branch }}
       - uses: ./.github/actions/build-setup
@@ -141,7 +141,7 @@ jobs:
       name: Docker
       url: https://hub.docker.com/u/diem
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
       - name: sign in to DockerHub; install image signing cert
         uses: ./.github/actions/dockerhub_login
         with:
diff --git a/.github/workflows/dep-summaries.yml b/.github/workflows/dep-summaries.yml
index 8c4a4e346ac4..8e732166ffb6 100644
--- a/.github/workflows/dep-summaries.yml
+++ b/.github/workflows/dep-summaries.yml
@@ -26,7 +26,7 @@ jobs:
       dep-auditors-list: ${{ steps.dep-auditors.outputs.list }}
     steps:
       - name: checkout
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v3.3.0
         if: ${{ startsWith(github.event_name, 'pull_request') }}
         with:
           ref: ${{ github.event.pull_request.head.sha }}
@@ -37,18 +37,18 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: checkout base ref
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v3.3.0
         if: ${{ startsWith(github.event_name, 'pull_request') }}
         with:
           ref: ${{ steps.fetch-base-ref.outputs.ref }}
           path: libra-base
       - name: checkout
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v3.3.0
         if: ${{ github.event_name == 'push' }}
         with:
           ref: ${{ github.event.after }}
       - name: checkout base ref
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v3.3.0
         if: ${{ github.event_name == 'push' }}
         with:
           ref: ${{ github.event.before }}
diff --git a/.github/workflows/dep-update-review.yml b/.github/workflows/dep-update-review.yml
index 291abfae6639..088dc8697edf 100644
--- a/.github/workflows/dep-update-review.yml
+++ b/.github/workflows/dep-update-review.yml
@@ -18,11 +18,11 @@ jobs:
       MAX_ALLOWED_CHARS: 65536
     steps:
       - name: checkout
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: checkout base ref
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           path: diem-base
diff --git a/.github/workflows/hyperjump-comment.yml b/.github/workflows/hyperjump-comment.yml
index 7be982b329a0..0aaf1bbf533f 100644
--- a/.github/workflows/hyperjump-comment.yml
+++ b/.github/workflows/hyperjump-comment.yml
@@ -10,7 +10,7 @@ jobs:
     name: (hyperjump) comment
     steps:
       - name: checkout
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v3.3.0
       - name: comment
         uses: diem/actions/hyperjump-comment@a5fa31ff2b54a544cd88ac912cda469742592e6c
         with:
diff --git a/.github/workflows/hyperjump-labels.yml b/.github/workflows/hyperjump-labels.yml
index e45a254ae64d..51b91213dd84 100644
--- a/.github/workflows/hyperjump-labels.yml
+++ b/.github/workflows/hyperjump-labels.yml
@@ -10,7 +10,7 @@ jobs:
     name: (hyperjump) labels
     steps:
       - name: checkout
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v3.3.0
       - name: labels
         uses: diem/actions/hyperjump-labels@a5fa31ff2b54a544cd88ac912cda469742592e6c
         with:
diff --git a/.github/workflows/hyperjump-request-review.yml b/.github/workflows/hyperjump-request-review.yml
index 53fde35d5cfd..d3b67dd3ed18 100644
--- a/.github/workflows/hyperjump-request-review.yml
+++ b/.github/workflows/hyperjump-request-review.yml
@@ -10,7 +10,7 @@ jobs:
     name: (hyperjump) request-review
     steps:
       - name: checkout
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v3.3.0
       - name: request review
         uses: diem/actions/hyperjump-request-review@a5fa31ff2b54a544cd88ac912cda469742592e6c
         with:
diff --git a/.github/workflows/jsonrpc-compat.yml b/.github/workflows/jsonrpc-compat.yml
index 9a116b466242..7e83aac3b097 100644
--- a/.github/workflows/jsonrpc-compat.yml
+++ b/.github/workflows/jsonrpc-compat.yml
@@ -11,7 +11,7 @@ jobs:
     name: Warn PR author about compatibility requirements
     steps:
       - name: checkout
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v3.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: comment
diff --git a/.github/workflows/weekly.yml b/.github/workflows/weekly.yml
index d4f24e1e36c9..c4885e4f2520 100644
--- a/.github/workflows/weekly.yml
+++ b/.github/workflows/weekly.yml
@@ -13,7 +13,7 @@ jobs:
     env:
       MESSAGE_PAYLOAD_FILE: /tmp/message
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
         with:
             # fetch full history
             fetch-depth: 0
@@ -40,7 +40,7 @@ jobs:
       SAS: ""
       CONFIG: .github/workflows/transaction-replay.toml
     steps:
-      - uses: actions/checkout@v2.4.0
+      - uses: actions/checkout@v3.3.0
       - uses: ./.github/actions/build-setup
       - name: install azcopy
         run: |