chore(deps): bump actions/checkout from 6 to 7

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
         node-version: ${{ fromJson(github.event_name == 'pull_request' && '[20]' || '[20, 22]') }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/definition-of-done.yml

@@ -22,7 +22,7 @@ jobs:
     name: Lint — no mocks in runtime-e2e/
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Run lint
         run: |
           if [ -x scripts/lint-no-mocks-in-runtime-e2e.sh ]; then
@@ -35,7 +35,7 @@ jobs:
     name: Runtime E2E required for user-facing changes
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/heartbeat-real-stack.yml

@@ -43,7 +43,7 @@ jobs:
     env:
       AXONFLOW_TELEMETRY: "off"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Node ${{ matrix.node }}
         uses: actions/setup-node@v6
         with:

.github/workflows/install-smoke.yml

@@ -70,7 +70,7 @@ jobs:
       AXONFLOW_TELEMETRY: 'off'
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/install-to-use-smoke.yml

@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout plugin
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Node.js 20
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/manifest-envvars-coverage.yml

@@ -38,7 +38,7 @@ jobs:
   coverage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Compute three-way envVars coverage
         run: |

.github/workflows/manifest-tools-coverage.yml

@@ -29,7 +29,7 @@ jobs:
   coverage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Verify contracts.tools matches agent-tools.ts
         run: |

.github/workflows/publish.yml

@@ -30,7 +30,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.VERSION }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Resolve version
         id: version
@@ -135,7 +135,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -197,7 +197,7 @@ jobs:
       # a dispatch run from `main` (e.g. to retry after a workflow fix)
       # would publish whatever's on main HEAD, not the code on npm at
       # the requested version. On tag-push, ref defaults to the tag.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && format('v{0}', github.event.inputs.version) || github.ref }}
 

.github/workflows/security-scan.yml

@@ -63,7 +63,7 @@ jobs:
       AXONFLOW_TELEMETRY: 'off'
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/smoke-e2e.yml

@@ -31,7 +31,7 @@ jobs:
       AXONFLOW_CLIENT_SECRET: demo-secret
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/wire-shape-contract.yml

@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout plugin (full history for SHA-bump guard)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -105,7 +105,7 @@ jobs:
           exit 1
 
       - name: Checkout OpenAPI specs (pinned to baseline SHA)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: getaxonflow/axonflow
           ref: ${{ steps.specs_sha.outputs.sha }}