chore(ci): bump actions/checkout from 4.3.1 to 7.0.0

[dependabot]

Bumps actions/checkout from 4.3.1 to 7.0.0.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @​ericsciple in actions/checkout#2314
• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327
• Clarify v6 README by @​ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248
• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• v6-beta by @​ericsciple in actions/checkout#2298

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 9c091bb update error wording (#2467)
• 1044a6d getting ready for checkout v7 release (#2464)
• f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
• d914b26 upgrade module to esm and update dependencies (#2463)
• 537c7ef Bump @​actions/core and @​actions/tool-cache and Remove uuid (#2459)
• 130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
• 7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
• 0f9f3aa Bump actions/publish-immutable-action (#2458)
• f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
• df4cb1c Update changelog for v6.0.3 (#2446)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

This pull request has been automatically marked as stale due to inactivity. Please add an update or it will be closed.

[lml2468]

Dispatch

• Assigned to: qa-engineer
• Stage: review
• Reason: PR chore(ci): bump actions/checkout from 4.3.1 to 7.0.0 #36 (dependabot: bump actions/checkout 4.3.1 → 7.0.0) requires QA review as part of the three-piece review fan-out.
• Scope: Verify CI workflow correctness after the major version bump. Check that all workflow references to actions/checkout@v7 are compatible, no breaking changes in usage patterns, and test matrix still functions.
• Waiting on: QA verdict (CLEARED / BLOCKED / CLEARED_WITH_RISK)

[lml2468]

Dispatch

• Assigned to: security-engineer
• Stage: review
• Reason: PR chore(ci): bump actions/checkout from 4.3.1 to 7.0.0 #36 (dependabot: bump actions/checkout 4.3.1 → 7.0.0) requires security review as part of the three-piece review fan-out.
• Scope: Assess supply-chain risk of major version bump (v4 → v7) for actions/checkout. Check for known CVEs in intermediate versions, verify pinned hash vs tag usage, and confirm no new permissions or token scopes required.
• Waiting on: Security verdict (CLEARED / BLOCKED / CLEARED_WITH_RISK)

[lml2468]

Dispatch

• Assigned to: code-reviewer
• Stage: review
• Reason: PR chore(ci): bump actions/checkout from 4.3.1 to 7.0.0 #36 (dependabot: bump actions/checkout 4.3.1 → 7.0.0) requires code review as part of the three-piece review fan-out.
• Scope: Review the diff for correctness of the version bump. Verify all uses: actions/checkout@ references are updated, no stale configurations, and the change is limited to the intended scope.
• Waiting on: Code review verdict (CLEARED / BLOCKED / CLEARED_WITH_RISK)

[lml2468]

QA-Engineer Verdict: APPROVE

Scope: 4 additions / 4 deletions across 3 workflow files (.github/workflows/ci.yml, npm-publish.yml, release-publish.yml). Mechanical SHA pin update for actions/checkout v4.3.1 → v7.0.0.

CI Evidence (referenced, not local):

• build & test (1.24.x) ✅ SUCCESS
• npm test ✅ SUCCESS
• actionlint ✅ SUCCESS
• osv-scan ✅ SUCCESS
• check-sprint ❌ FAILURE — no linked issue (expected for Dependabot PRs, not a code defect)

Assessment: No test coverage concerns for CI configuration changes. The CI pipeline itself confirms the change works. All functional checks pass.

Verdict: approve

[lml2468]

QA-Engineer Verdict: APPROVE

Mechanical SHA pin update for actions/checkout v4.3.1 → v7.0.0. All functional CI checks pass (build & test, npm test, actionlint, osv-scan). check-sprint failure is due to missing linked issue (Dependabot PR characteristic, not a code defect). No test coverage concerns for CI config changes.

[lml2468]

Security-Engineer Verdict: CLEARED

Change: actions/checkout v4.3.1 → v7.0.0 (major version bump across 3 workflow files).

Security Analysis:

• Credential handling: v6 improves credential persistence (separate file). No regression.
• Fork PR protection: v7 blocks checkout of fork PRs for pull_request_target/workflow_run — this is a security hardening measure. Not directly applicable to this repo's trigger events, but beneficial if workflows are extended.
• Runtime: v5 upgrades to Node 24 (current LTS). No EOL runtime concerns.
• Supply chain: SHA pinned to 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 — immutable reference, immune to tag mutation. ✅
• OSV scan: ✅ SUCCESS — no known vulnerabilities in the dependency.
• Permissions: No new permissions introduced. Checkout action scope unchanged.

STRIDE check: No new attack surface. No auth/authZ changes. No data handling changes. No cryptographic changes.

Verdict: approve (CLEARED)

[lml2468]

Security-Engineer Verdict: CLEARED

actions/checkout v4.3.1 → v7.0.0. SHA-pinned to immutable commit. OSV scan clean. v7 adds fork PR checkout protection (security hardening). No new permissions, no credential regressions, no new attack surface. STRIDE: clear.

[lml2468]

Code-Reviewer Verdict: APPROVED

Change pattern: Identical across all 3 files — replace SHA pin 34e114876b0b11c390a56381ad16ebd13914f8d5 with 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0, update version comment from # v4 to # v7.0.0.

Correctness: ✅ No logic or behavioral changes. The actions/checkout action is invoked identically (no new inputs used).

Consistency: ✅ Follows repo's established SHA-pin convention for GitHub Actions.

Readability: ✅ Version comment accurately reflects the new version.

Maintainability: ✅ No concerns. Standard Dependabot maintenance PR.

Verdict: approve

[lml2468]

Code-Reviewer Verdict: APPROVED

Standard Dependabot SHA pin update across 3 workflow files. Consistent pattern, follows repo convention. No logic or behavioral changes. Clean.

[lml2468]

Aggregate Verdict: APPROVED — 等人工合并

Reviewer	Verdict	Summary
qa-engineer	approve	Mechanical SHA pin update, all functional CI checks pass (build & test, npm test, actionlint, osv-scan). check-sprint failure is expected (no linked issue for Dependabot PR).
security-engineer	approve (CLEARED)	SHA-pinned to immutable commit. OSV scan clean. v7 adds fork PR protection (hardening). No new permissions or attack surface. STRIDE: clear.
code-reviewer	approve (APPROVED)	Standard Dependabot SHA pin update across 3 workflow files. Consistent pattern, follows repo convention. No logic or behavioral changes.

Next step: Ready for human merge.

[lml2468]

Formal Verdict Aggregate Report — Round 1 — HEAD b4dc486

Formal Verdict: APPROVE

Reviewer Summary

Reviewer	Verdict	Headline finding
qa-engineer	pass-with-risk	机械式 actions/checkout SHA pin 升级 (v4.3.1 → v7.0.0)，4 处引用一致、PR CI 用 v7 跑绿；dep-bump 无新增测试上限为 pass-with-risk。
security-engineer	cleared	供应链 full-SHA pin，新 SHA 对上游官方 v7.0.0 tag 双向核验、无凭据/无扩权、v7 行为变化对本仓触发方式无回归。
code-reviewer	approved	五维评审无 Must/Should/Nit；4/4 引用同步升级、0 处残留旧 pin、注释与 SHA 匹配、input 签名 v4→v7 稳定。

Critical Findings (P0-P1)

无 Critical / High priority findings — all reviewers converged on lower-severity items.

Should-Fix (P2)

无 P2 findings。

Suggestions (P3)

无 P3 findings。

Questions for Author

无 blocking question。（QA risk #2 属运行时观测建议，非需作者修复的问题——见下方 Rationale。）

Verdict Rationale

三方 reviewer 收敛一致，零 finding：security cleared（无安全面变更，severity n/a）、code-reviewer approved（Must=0 · Should=0 · Nit=0）、qa pass-with-risk。按 dedupe-verdict 规则表首匹配——无 P0、无 P1、无 P2、无 material Question——落入最后一行 APPROVE。

QA 的 pass-with-risk 三条 risk 均为非阻断项：(1) dep-bump / config-only 豁免新增测试，升级正确性由 build & test (1.24.x) 用 v7 checkout 跑绿提供运行时证据；(2) npm-publish.yml（workflow_call）与 release-publish.yml（workflow_dispatch）的 ref: refs/tags/… checkout 未被本 PR CI 触发——ref/fetch-depth input 在 v4→v7 语义稳定，风险低，建议合并后首次 release 走查一次（运行时观测建议，非代码缺陷）；(3) check-sprint 治理门禁失败系 Dependabot PR 无关联 sprint issue 所致，非 test 失败、非代码缺陷。三条均不构成 P0-P2，不改变 verdict。

跨 reviewer 无分歧：security、code-reviewer 与 qa 对「供应链 SHA↔tag 双向核验」「全仓 4/4 引用一致、0 处残留旧 pin 34e1148…」「v7 新行为（阻断 fork-PR checkout on pull_request_target/workflow_run）不适用于本仓触发方式，方向为净收益」三点结论完全一致。

Round Context

First-round review — no prior round context.

---

Generated by review-leader · v5.1 chain terminal (Round 1 aggregate) · dedupe/verdict deterministic per skill

[lml2468]

APPROVE — Round 1

三方 reviewer 收敛一致、零 finding（security cleared · code approved Must/Should/Nit=0 · qa pass-with-risk）：actions/checkout v4.3.1 → v7.0.0 full-SHA pin 升级，全仓 4/4 引用一致、上游 v7.0.0 tag 双向核验、无 P0-P2。

Aggregate: #36 (comment)
See the aggregate comment on this PR for full findings and rationale.

Automated bot review; human sign-off still required.