⚙️ [Maintenance]: GitHub Actions checkouts use least-privilege settings

[dependabot]

GitHub Actions workflows now use the pinned actions/checkout v7.0.1 release consistently, avoid unnecessary full-history downloads, and prevent checkout credentials from persisting in the workspace. Generated documentation is linted with Super-Linter using filesystem discovery restricted to Markdown files.

Changed: Workflow checkout security and efficiency

All checkout steps disable credential persistence because these workflows do not rely on the checkout repository for authenticated Git operations. Super-Linter uses filesystem discovery instead of Git, so full-history fetching is not required.

Changed: Generated documentation lint scope

The documentation build runs Super-Linter in local mode with filesystem discovery and limits the include pattern to generated .md and .markdown files. The default branch is not configured, avoiding Git branch comparison and keeping the lint focused on the documentation output.

---

Technical details

• Updated all workflow references to the pinned actions/checkout v7.0.1 commit 3d3c42e5aac5ba805825da76410c181273ba90b1.
• Applied persist-credentials: false to all 28 checkout steps.
• Configured USE_FIND_ALGORITHM: true for the Super-Linter invocations in Linter.yml, Lint-Repository.yml, and Build-Docs.yml.
• Removed DEFAULT_BRANCH from the local documentation Super-Linter invocation.
• Restricted Build-Docs.yml documentation linting to outputs/docs Markdown files with FILTER_REGEX_INCLUDE.
• Removed all fetch-depth: 0 settings; checkout now uses the action's shallow fetch default.
• Updated the previously missed .github/workflows/Test-Actions.yml reference.
• Standards and framework alignment:

Changed surface	Standards checked	Framework docs checked	Result
.github/workflows/**	GitHub Actions, least privilege, dependency pinning	Reusable workflow contract	Aligned

Relevant issues (or links)

• No linked issue; this is a Dependabot dependency maintenance update.

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter