chore(deps): bump actions/checkout from 6.0.3 to 7.0.0

[dependabot]

Bumps actions/checkout from 6.0.3 to 7.0.0.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 9c091bb update error wording (#2467)
• 1044a6d getting ready for checkout v7 release (#2464)
• f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
• d914b26 upgrade module to esm and update dependencies (#2463)
• 537c7ef Bump @​actions/core and @​actions/tool-cache and Remove uuid (#2459)
• 130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
• 7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
• 0f9f3aa Bump actions/publish-immutable-action (#2458)
• f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
• See full diff in compare view

[operon-ensemble-reviewer]

Ensemble Code Review

Verdict: approve

Summary: Mechanical Dependabot bump of actions/checkout from v6.0.3 to v7.0.0 across all 7 workflow files. The SHA pin, tag comment, and consistency across files were verified, and no remaining references to the old SHA exist. The one flagged behavioral concern (v7's fork-PR restrictions) does not apply, since none of the workflows use pull_request_target or workflow_run.

Findings (none — all reviewers approved)

No correctness, security, or contract issues. Verified the new SHA 9c091bb… matches the # v7.0.0 tag comment, the old SHA has zero remaining references, and all 7 workflows are updated consistently. The Architect/Pattern-Matcher concern about v7 blocking fork-PR checkout in pull_request_target/workflow_run was checked and does not apply — neither trigger is used in any workflow in this repo.

---

Suggestions (1)

• (Informational) actions/checkout v7 adds a security hardening that blocks checking out fork PRs under pull_request_target and workflow_run. This repo uses neither trigger today, so there is no impact — but worth keeping in mind if those event types are added later. (Pattern, Architect; Judge-verified no current usage)

---

Generated by Operon Ensemble Code Review.

[operon-ensemble-reviewer]

Ensemble Code Review

Verdict: approve

Summary: Mechanical Dependabot bump of actions/checkout from v6.0.3 to v7.0.0 across all 7 SHA-pinned workflow files. The Verifier confirmed the old SHA has zero remaining references and all workflows are updated consistently. The only behavioral change in v7 (fork-PR checkout restrictions under pull_request_target/workflow_run) does not apply, since none of the workflows use those triggers.

Findings (none — all reviewers approved)

No correctness, security, or contract issues. All three reviewers approved. Verified that the old SHA df4cb1c… has zero remaining references, all 7 workflows are updated consistently, and v7's fork-PR restriction is irrelevant because no workflow uses pull_request_target or workflow_run.

---

Suggestions (1)

• (Informational) actions/checkout v7 adds security hardening that blocks checking out fork PRs under pull_request_target and workflow_run. This repo uses neither trigger today, so there is no impact — but worth keeping in mind (or noting in CONTRIBUTING/workflow docs) if those event types are added later. (Pattern, Architect; Verifier confirmed no current usage)

---

Generated by Operon Ensemble Code Review.

[operon-ensemble-reviewer]

Ensemble Code Review

Verdict: approve

Summary: Mechanical Dependabot bump of actions/checkout from v6.0.3 to v7.0.0 across all 7 SHA-pinned workflow files. The Verifier confirmed the new SHA 9c091bb… matches the # v7.0.0 tag comment, the old SHA has zero remaining references, and all workflows are updated consistently. The only behavioral change in v7 (fork-PR checkout restrictions under pull_request_target/workflow_run) does not apply, since none of the workflows use those triggers.

Findings (none — all reviewers approved)

No correctness, security, or contract issues. All three reviewers approved. Verified that the new SHA matches the tag comment, the old SHA has zero remaining references, all 7 workflows are updated consistently, and v7's fork-PR restriction is irrelevant because no workflow uses pull_request_target or workflow_run.

---

Suggestions (1)

• (Informational) actions/checkout v7 adds security hardening that blocks checking out fork PRs under pull_request_target and workflow_run. This repo uses neither trigger today, so there is no impact — but worth revisiting the checkout configuration (and documenting expected behavior for forked contributors) if those event types are added later. (Pattern, Architect; Verifier confirmed no current usage)

---

Generated by Operon Ensemble Code Review.