From 0d6a416ec3af2884980d3c238acbf2d36bf749ce Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 27 Jul 2026 15:42:07 +0000
Subject: [PATCH] chore(deps): update actions/checkout action to v7.0.1

---
 .github/workflows/ci.yml      | 2 +-
 .github/workflows/pages.yml   | 2 +-
 .github/workflows/release.yml | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e8a0320..2fb4f8e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
       # close the supply-chain hole a force-pushed tag/branch would open. The
       # trailing comment tracks the human-readable version; Renovate
       # (.github/renovate.json5) bumps the SHAs so the pins don't rot.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
       # All gate tooling (bun + uv) comes from the flake's lean .#ci shell, so
       # the Python gate (//#test:hermes) resolves uv the same way locally and
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 74541fa..d9b616d 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -45,7 +45,7 @@ jobs:
       # supply-chain hole a force-pushed tag would open. The trailing comment
       # tracks the human-readable version; Renovate (.github/renovate.json5)
       # bumps the SHAs so the pins don't rot.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: site
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b3b3a02..211e8d7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -70,7 +70,7 @@ jobs:
       tag: ${{ steps.detect.outputs.tag }}
     steps:
       # SHA-pinned like ci.yml; Renovate (.github/renovate.json5) bumps it.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
       # Same module the unit tests cover, run with the flake-pinned bun. It reads
       # plugin.json, checks the notes file, queries the remote for the tag, and
@@ -92,7 +92,7 @@ jobs:
       VERSION: ${{ needs.detect.outputs.version }}
     steps:
       # SHA-pinned like ci.yml; Renovate (.github/renovate.json5) bumps them.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: