Update actions/checkout action to v7 - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/checkout	action	major	v6.0.3 → v7	v7.0.0

---

Release Notes

actions/checkout (actions/checkout)

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v7

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Breaking changes:

• Fork PR checkout blocking (security hardening): v7 now blocks checking out fork PR code by default when triggered by pull_request_target or workflow_run events. This is a security improvement to prevent "pwn request" attacks. A new optional input allow-unsafe-pr-checkout is available to opt back into the old behavior if needed.
• Minimum Runner version: Requires Actions Runner v2.327.1+ (v2.329.0+ for Docker container actions with authenticated git commands). GitHub-hosted runners already satisfy this.
• ESM migration: The action's internal module system was upgraded to ESM. This is an internal change with no effect on consumers.
• Credential storage change: persist-credentials now stores credentials in $RUNNER_TEMP instead of .git/config. This is transparent to workflows — git commands work automatically.

Dependency bumps (internal, no consumer impact):

• flatted 3.3.1 → 3.4.2
• js-yaml 4.1.0 → 4.2.0
• @actions/core and @actions/tool-cache updated
• actions/publish-immutable-action 0.0.3 → 0.0.4

No changes to the action's inputs/outputs API. All existing inputs continue to work as before.

🎯 Impact Scope Investigation

Usage location: actions/checkout is used in exactly one place:

• .github/workflows/claude-renovate-review.yml (line 27)

Workflow configuration:

• Trigger: pull_request (types: opened, edited) — NOT pull_request_target or workflow_run
• Input used: persist-credentials: false only
• No other workflows in the repository use actions/checkout

Impact analysis:

• The fork PR blocking change does not affect this workflow because it uses the pull_request trigger, not pull_request_target or workflow_run. The security restriction only applies to the latter two event types.
• The persist-credentials: false input continues to work unchanged in v7.
• GitHub-hosted runners (ubuntu-latest, ubuntu-slim) already meet the minimum runner version requirement.
• No other dependencies or configuration files are affected by this change.

💡 Recommended Actions

• Merge as-is. No migration steps or code changes are required.
• The commit SHA 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 correctly corresponds to the v7 tag of actions/checkout.

🔗 Reference Links

• actions/checkout v7.0.0 CHANGELOG
• actions/checkout v6.0.3...v7.0.0 comparison
• PR #2454 - Block checking out fork PR for pull_request_target and workflow_run
• PR #2463 - Upgrade module to ESM
• GitHub Blog: Safer pull_request_target defaults for GitHub Actions checkout

Generated by koki-develop/claude-renovate-review