build(deps): bump actions/checkout from 4.2.2 to 7.0.1

[dependabot]

Bumps actions/checkout from 4.2.2 to 7.0.1.

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in actions/checkout#2500
• backport fixes to releases-v6 by @​aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

[steipete]

Landed with the Dependabot author preserved.

Verified on the byte-identical reviewed patch and final exact head c549006957e0bb3c4ca427b3225abf6a5457f385:

• v7.0.1 is the latest stable checkout release; tag v7 and v7.0.1 both resolve to signed commit 3d3c42e5aac5ba805825da76410c181273ba90b1
• upstream action uses Node 24; minimum runner is v2.327.1
• 24 of 25 changed sites already used actions/checkout@v7, so pinning v7.0.1 does not change their effective runtime; the updater's GitHub-hosted runner is v2.335.1
• no affected workflow uses pull_request_target or workflow_run, so v7's unsafe-fork default does not break an existing checkout contract
• all 12 workflows parsed; all 25 checkout refs match the intended tag/SHA; actionlint passed
• all extracted translation shell blocks passed bash syntax; 79/79 i18n control-plane tests passed
• AutoReview: clean, no accepted/actionable findings (0.99 confidence)

Hosted exact-head proof after the final sync rebase:

• Docs Code CI run 29795734320: passed, including checkout, install, Worker dry-run, shell build/smoke, and browser visual smoke
• CodeQL run 29795734316: Actions and JavaScript/TypeScript analyzers passed
• Mintlify deployment: skipped; no deploy/translation/production workflow was dispatched

Rebase merge commit 71c26e9e51f99318c7a7f9c7ef62628442b0b555 retains dependabot[bot] as author. The landed tree is byte-equivalent to the reviewed PR head.