⚙️ [Maintenance]: GitHub Actions checkouts use least-privilege settings (#412)

GitHub Actions workflows now use the pinned `actions/checkout` v7.0.1
release consistently, avoid unnecessary full-history downloads, and
prevent checkout credentials from persisting in the workspace. Generated
documentation is linted with Super-Linter using filesystem discovery
restricted to Markdown files.

## Changed: Workflow checkout security and efficiency

All checkout steps disable credential persistence because these
workflows do not rely on the checkout repository for authenticated Git
operations. Super-Linter uses filesystem discovery instead of Git, so
full-history fetching is not required.

## Changed: Generated documentation lint scope

The documentation build runs Super-Linter in local mode with filesystem
discovery and limits the include pattern to generated `.md` and
`.markdown` files. The default branch is not configured, avoiding Git
branch comparison and keeping the lint focused on the documentation
output.

---
<details>
<summary>Technical details</summary>

- Updated all workflow references to the pinned `actions/checkout`
v7.0.1 commit `3d3c42e5aac5ba805825da76410c181273ba90b1`.
- Applied `persist-credentials: false` to all 28 checkout steps.
- Configured `USE_FIND_ALGORITHM: true` for the Super-Linter invocations
in `Linter.yml`, `Lint-Repository.yml`, and `Build-Docs.yml`.
- Removed `DEFAULT_BRANCH` from the local documentation Super-Linter
invocation.
- Restricted `Build-Docs.yml` documentation linting to `outputs/docs`
Markdown files with `FILTER_REGEX_INCLUDE`.
- Removed all `fetch-depth: 0` settings; checkout now uses the action's
shallow fetch default.
- Updated the previously missed `.github/workflows/Test-Actions.yml`
reference.
- Standards and framework alignment:

| Changed surface | Standards checked | Framework docs checked | Result
|
| --- | --- | --- | --- |
| `.github/workflows/**` | GitHub Actions, least privilege, dependency
pinning | Reusable workflow contract | Aligned |

</details>

<details>
<summary>Relevant issues (or links)</summary>

- No linked issue; this is a Dependabot dependency maintenance update.

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marius Storhaug <marstor@hotmail.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: 3 people

.github/workflows/AfterAll-ModuleLocal.yml

@@ -26,13 +26,12 @@ jobs:
       SETTINGS: ${{ inputs.Settings }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          fetch-depth: 0
 
       - name: Checkout Process-PSModule
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}

.github/workflows/BeforeAll-ModuleLocal.yml

@@ -26,13 +26,12 @@ jobs:
       Settings: ${{ inputs.Settings }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          fetch-depth: 0
 
       - name: Checkout Process-PSModule
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}

.github/workflows/Build-Docs.yml

@@ -18,13 +18,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          fetch-depth: 0
 
       - name: Checkout Process-PSModule
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -83,9 +82,8 @@ jobs:
         uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
         env:
           RUN_LOCAL: true
-          DEFAULT_BRANCH: main
           DEFAULT_WORKSPACE: ${{ fromJson(inputs.Settings).WorkingDirectory }}
-          FILTER_REGEX_INCLUDE: ${{ fromJson(inputs.Settings).WorkingDirectory }}/outputs/docs
+          FILTER_REGEX_INCLUDE: ${{ fromJson(inputs.Settings).WorkingDirectory }}/outputs/docs/.*\.(md|markdown)$
           ENABLE_GITHUB_ACTIONS_GROUP_TITLE: true
           GITHUB_TOKEN: ${{ github.token }}
           VALIDATE_ALL_CODEBASE: true
@@ -98,6 +96,7 @@ jobs:
           VALIDATE_MARKDOWN_PRETTIER: false
           VALIDATE_YAML_PRETTIER: false
           ENABLE_GITHUB_ACTIONS_STEP_SUMMARY: false
+          USE_FIND_ALGORITHM: true
           SAVE_SUPER_LINTER_SUMMARY: true
 
       - name: Post super-linter summary

.github/workflows/Build-Module.yml

@@ -24,13 +24,12 @@ jobs:
       GH_TOKEN: ${{ github.token }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          fetch-depth: 0
 
       - name: Checkout Process-PSModule
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}

.github/workflows/Build-Site.yml

@@ -17,13 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          fetch-depth: 0
 
       - name: Checkout Process-PSModule
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}

.github/workflows/Get-CodeCoverage.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Process-PSModule
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}

.github/workflows/Get-TestResults.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Process-PSModule
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}

.github/workflows/Lint-Repository.yml

@@ -21,10 +21,9 @@ jobs:
       Settings: ${{ inputs.Settings }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          fetch-depth: 0
 
       - name: Load dynamic envs
         shell: pwsh
@@ -56,6 +55,7 @@ jobs:
           FILTER_REGEX_INCLUDE: ${{ fromJson(env.Settings).WorkingDirectory }}
           FILTER_REGEX_EXCLUDE: ${{ fromJson(env.Settings).WorkingDirectory }}/src/classes/public/.*\.ps1$
           ENABLE_GITHUB_ACTIONS_STEP_SUMMARY: false
+          USE_FIND_ALGORITHM: true
           SAVE_SUPER_LINTER_SUMMARY: true
 
       - name: Post super-linter summary

.github/workflows/Lint-SourceCode.yml

@@ -21,7 +21,7 @@ jobs:
         include: ${{ fromJson(inputs.Settings).Test.SourceCode.Suites }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/Linter.yml

@@ -19,10 +19,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          fetch-depth: 0
 
       - name: Lint code base
         uses: super-linter/super-linter@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
@@ -35,3 +34,4 @@ jobs:
           VALIDATE_JSON_PRETTIER: false
           VALIDATE_MARKDOWN_PRETTIER: false
           VALIDATE_YAML_PRETTIER: false
+          USE_FIND_ALGORITHM: true