ci(deps): bump actions/checkout from 4.2.2 to 7.0.1

.github/workflows/api-contract-check.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout PR HEAD
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/benchmarks.yml

@@ -58,7 +58,7 @@ jobs:
       RESULT_DIR: /tmp/benchmark-results
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-go@v7
         with:

.github/workflows/ci-failure-pci.yml

@@ -76,7 +76,7 @@ jobs:
 
       - name: Checkout (for pci-send)
         if: ${{ steps.app-check.outputs.skip == 'false' }}
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           token: ${{ steps.app-token.outputs.token }}
 

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@v7
@@ -50,7 +50,7 @@ jobs:
       GOFLAGS: -mod=vendor
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@v7
@@ -107,7 +107,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@v7
@@ -212,7 +212,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@v7
@@ -302,7 +302,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Notify build status via Slack
         env:

.github/workflows/counts-vendor-sync.yml

@@ -38,10 +38,10 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout cli
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Checkout plugins (public, no token required)
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           repository: nself-org/plugins
           path: .plugins-canonical

.github/workflows/coverage.yml

@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-go@v7
         with:

.github/workflows/credential-rotation-reminder.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout cli repo (script source)
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           repository: nself-org/cli
           path: cli

.github/workflows/deep-qa-block.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@v7

.github/workflows/default-images-pullable.yml

@@ -52,7 +52,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:

.github/workflows/deploy-sim.yml

@@ -16,7 +16,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:

.github/workflows/deprecation-check.yml

@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 3
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0  # need full history to diff against base
 

.github/workflows/doc-sync.yml

@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@v7
@@ -83,7 +83,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/docker-publish.yml

@@ -55,7 +55,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       # Single source of proceed/version/latest. Fails closed: secrets absent, a
       # non-tag head_branch, a tag with no GitHub release, or a failed Release

.github/workflows/e2e-golden-path.yml

@@ -56,7 +56,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go (for any CLI build steps)
         uses: actions/setup-go@v7

.github/workflows/embedded-pg-bench.yml

@@ -33,7 +33,7 @@ jobs:
           - macos-14          # Apple Silicon — primary deployment target
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-go@v7
         with:

.github/workflows/embedded-pg-matrix.yml

@@ -36,7 +36,7 @@ jobs:
           - macos-15-intel    # Intel (darwin/amd64) — macos-13 retired Dec 2025
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-go@v7
         with:
@@ -68,7 +68,7 @@ jobs:
           - macos-14
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-go@v7
         with:

.github/workflows/endpoint-auth-gate.yml

@@ -36,7 +36,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-go@v7
         with:

.github/workflows/go-list-updates-monthly.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@v7

.github/workflows/govuln.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@v7

.github/workflows/govulncheck-nightly.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@v7

.github/workflows/hadolint.yml

@@ -22,7 +22,7 @@ jobs:
   hadolint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Run hadolint
         uses: hadolint/hadolint-action@v3.5.0
         with:

.github/workflows/hygiene.yml

@@ -50,7 +50,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/image-pin-bump.yml

@@ -71,7 +71,7 @@ jobs:
       DRY_RUN_PR: ${{ inputs.dry_run_pr == true && 'true' || 'false' }}
       BRANCH: ${{ inputs.dry_run_pr == true && 'chore/image-pins-dry-run' || 'chore/image-pins' }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
@@ -259,7 +259,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Skip unless the owner switch is on
         if: vars.IMAGE_MIRROR_APPLY != 'true'

.github/workflows/license-audit.yml

@@ -32,7 +32,7 @@ jobs:
     name: Check Go dependency licenses
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-go@v7
         with:

.github/workflows/license-gate-unit-test.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-go@v7
         with:

.github/workflows/license-gate.yml

@@ -34,7 +34,7 @@ jobs:
     name: Go Dependency License Gate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-go@v7
         with:

.github/workflows/license-mutation.yml

@@ -33,7 +33,7 @@ jobs:
     timeout-minutes: 90
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@v7

.github/workflows/migration-fixture.yml

@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@v7

.github/workflows/multi-arch-check.yml

@@ -39,7 +39,7 @@ jobs:
             goarch: arm64
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-go@v7
         with:

.github/workflows/nightly-registry-perf.yml

@@ -15,7 +15,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-go@v7
         with:

.github/workflows/nself-first-check.yml

@@ -19,7 +19,7 @@ jobs:
   compose-header-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/ollama-pin-drift.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@v7

.github/workflows/p93-soak-monitor.yml

@@ -50,7 +50,7 @@ jobs:
       HETZNER_NSELF_TOKEN: ${{ secrets.HETZNER_NSELF_TOKEN }}
       SOAK_RUN_T09: ${{ inputs.run_t09 == 'true' && '1' || '0' }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Install deps
         run: |

.github/workflows/perf.yml

@@ -65,7 +65,7 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0  # need full history to find the merge-base
           # The PR head, not the synthetic merge commit: HEAD must be the
@@ -294,7 +294,7 @@ jobs:
       RUN_RUNS: "30"
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           # The PR head, not the synthetic merge commit (see Binary Size Gate).
@@ -527,7 +527,7 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-go@v7
         with:

.github/workflows/ping-api-deploy.yml

@@ -50,7 +50,7 @@ jobs:
     # Valid job-level `if:` (github context only — no secrets reference).
     if: github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Verify ping_api service directory exists
         run: |