chore(deps): bump actions/checkout from 7.0.0 to 7.0.1

[dependabot]

Bumps actions/checkout from 7.0.0 to 7.0.1.

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• See full diff in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 0cfa18f6-e964-4e9b-9b6a-6e0e330a59c8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: f0aadaf114c59c88aeefe57fbb1594779b6aea96
Cascade: triage → deep (triage: haiku 4.5 [sonnet 5] → deep: opus 4.8 [sonnet 5] + duck: o4-mini → audit: fable 5)

Summary

Dependabot patch bump of actions/checkout 7.0.0 -> 7.0.1 across two workflows, kept SHA-pinned. The new pin 3d3c42e5aac5ba805825da76410c181273ba90b1 was verified against the upstream v7.0.1 tag via the GitHub API (no typosquat, no unpinning, comment matches), and the upstream release is security-hardening (skip unsafe PR check, escape --unset values). No secret exposure (SONAR_TOKEN env unchanged), no injection/crypto/permission changes; all safety-check hard-stops false and CI is green. The triage DESCRIPTION_MISSING signal is a Dependabot-body artifact, not a security concern.

Findings

• info: actions/checkout bumped 7.0.0 -> 7.0.1; new pin 3d3c42e5aac5ba805825da76410c181273ba90b1 verified to equal the upstream v7.0.1 tag. Both old and new refs are SHA-pinned with matching version comments.
• info: Same verified checkout SHA bump in sonarcloud.yml; SONAR_TOKEN env is unchanged and not piped into any run step.
• info: run_secret_scanning MCP tool unavailable in this environment; the diff adds no secret material (SHA-only change), so no secret scan was applicable.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 [sonnet 5] → deep: opus 4.8 [sonnet 5] + duck: o4-mini → audit: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: d5c6e20de9f1b52aac6b62fd59eb393965a617fb
Cascade: triage → deep (triage: haiku 4.5 [sonnet 5] → deep: opus 4.8 [sonnet 5] + duck: o4-mini → audit: fable 5)

Summary

Dependabot semver-patch bump of actions/checkout 7.0.0 -> 7.0.1 across copilot-setup-steps.yml and sonarcloud.yml, kept SHA-pinned. New pin 3d3c42e5aac5ba805825da76410c181273ba90b1 verified equal to the upstream v7.0.1 tag and old pin 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 equal to v7.0.0 via the GitHub API (no typosquat, no unpinning, comments match); upstream v7.0.1 is security-hardening. Paranoid pass found no new exposure: SONAR_TOKEN env unchanged and not piped into any run step, no permission/injection/crypto changes, both deterministic hard-stops false and security CI (gitleaks/CodeQL/SonarCloud/AgentShield/build) green.

Findings

• info: actions/checkout bumped 7.0.0 -> 7.0.1; new pin 3d3c42e5aac5ba805825da76410c181273ba90b1 verified against upstream v7.0.1 tag and old pin against v7.0.0. Both refs SHA-pinned with accurate version comments; semver-patch, security-hardening upstream. (.github/workflows/copilot-setup-steps.yml:92)
• info: Same verified checkout SHA bump in sonarcloud.yml; SONAR_TOKEN env is unchanged and not forwarded into any run step, so no secret exposure introduced. (.github/workflows/sonarcloud.yml:41)
• info: run_secret_scanning MCP tool unavailable in this environment; the diff is a SHA-only change adding no secret material, so no secret scan was applicable. Not fabricated.
• minor: Triage flagged 3 of 5 required description sections missing (risk/rollback/monitoring); this is a Dependabot auto-generated body artifact for a patch bump, not a security concern.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 [sonnet 5] → deep: opus 4.8 [sonnet 5] + duck: o4-mini → audit: fable 5). Reply if you need a human review.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 2843299944777d04df592063354b2b206974b5e2
Cascade: triage → deep (triage: haiku 4.5 [sonnet 5] → deep: opus 4.8 [sonnet 5] + duck: o4-mini → audit: fable 5)

Summary

Dependabot patch bump of actions/checkout 7.0.0 -> 7.0.1 in two workflows. The new pin 3d3c42e5aac5ba805825da76410c181273ba90b1 was verified against the upstream v7.0.1 tag on the canonical actions/checkout repo (no typosquat), and the release is itself security-hardening. No hard-stops, workflow-only, no secret in run steps, no third-party reusable added; all meaningful CI (build/test, gitleaks, CodeQL, SonarCloud) is green and the PR is already approved. Downstream impact: none.

Findings

• info: actions/checkout pinned by SHA to 3d3c42e5aac5ba805825da76410c181273ba90b1, which matches the upstream refs/tags/v7.0.1 commit exactly (verified via GitHub API). Official first-party action, no typosquat.
• info: sonarcloud.yml checkout retains fetch-depth: 0 and unchanged SONAR_TOKEN env; no new secret exposure or pull_request_target introduced by the bump.
• minor: PR body (auto-generated Dependabot) omits risk/rollback/monitoring sections. Cosmetic for a bot dependency bump; not a security exposure.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 [sonnet 5] → deep: opus 4.8 [sonnet 5] + duck: o4-mini → audit: fable 5). Reply if you need a human review.