From 786904fd4ca9eccd133e0c109d96f973dcac1839 Mon Sep 17 00:00:00 2001
From: qnbs <155236708+qnbs@users.noreply.github.com>
Date: Wed, 19 Aug 2026 13:35:40 +0200
Subject: [PATCH] docs(ci): fix stale actions/checkout version annotation
 across remaining workflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to the CodeRabbit finding on PR #398 (already fixed there for
ci.yml and cef-learning-harness.yml): the same actions/checkout SHA
(3d3c42e5aac5ba805825da76410c181273ba90b1) is pinned throughout the repo
with a stale "# v6" comment. Independently verified by dereferencing both
tags — v6 resolves to a different commit (d23441a4...), v7.0.1 resolves
to this exact SHA. Comment-only change, no behavior change.
---
 .github/workflows/codeql.yml          | 2 +-
 .github/workflows/docker.yml          | 2 +-
 .github/workflows/mutation.yml        | 2 +-
 .github/workflows/scorecard.yml       | 2 +-
 .github/workflows/storybook-debug.yml | 2 +-
 .github/workflows/tauri-build.yml     | 2 +-
 .github/workflows/voice-nightly.yml   | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7cd52e466..eaf1f661c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,7 +27,7 @@ jobs:
         language: [javascript-typescript]
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 0c90c768a..8820b0fab 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -23,7 +23,7 @@ jobs:
       packages: write
     steps:
       # QNBS-v3: SHA-pinned to prevent supply-chain attacks via mutable tags
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 5924ca599..5fa3a32a1 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -63,7 +63,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 6b619c9df..db7ad3005 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -23,7 +23,7 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/storybook-debug.yml b/.github/workflows/storybook-debug.yml
index cfbfb832b..966071a38 100644
--- a/.github/workflows/storybook-debug.yml
+++ b/.github/workflows/storybook-debug.yml
@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 35
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup
diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml
index ba8aa6aa8..9b427dbe3 100644
--- a/.github/workflows/tauri-build.yml
+++ b/.github/workflows/tauri-build.yml
@@ -37,7 +37,7 @@ jobs:
           - os: macos-latest
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # QNBS-v3: composite action handles pnpm/node setup + frozen install.
diff --git a/.github/workflows/voice-nightly.yml b/.github/workflows/voice-nightly.yml
index d801b0977..7ee1b55b7 100644
--- a/.github/workflows/voice-nightly.yml
+++ b/.github/workflows/voice-nightly.yml
@@ -25,7 +25,7 @@ jobs:
     # Never gate anything — informational nightly signal only.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup