chore(deps): update actions/checkout action to v7.0.1

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v7.0.0 → v7.0.1

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 06:59 PM, Monday through Friday (* 9-18 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0b41fc8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🤖 Claude Dependency Review

📦 Update Summary

• Library: actions/checkout (GitHub Action)
• Version: v7.0.0 → v7.0.1
• Change Type: Patch

📝 Release Notes

https://github.com/actions/checkout/releases/tag/v7.0.1

🔐 Security Assessment

• Risk: 🟢 Low
• Known vulnerabilities: None found. v7.0.0 already addressed major security concerns by implementing secure-by-default CI/CD practices to block common "pwn request" attack patterns. v7.0.1 includes a security enhancement for git configuration (value escaping).
• Supply-chain notes: No maintainer changes, ownership transfers, or suspicious lifecycle scripts detected. This is a routine patch release from the official GitHub Actions organization with normal dependency updates and targeted bug fixes.

✨ Main Changes

🐛 Bug Fixes & Improvements

1. PR Check Optimization (#2518)

   • Skip running unsafe PR check if input is default
   • Impact: Performance improvement when using default settings

2. Branch Name Handling (#2521)

   • Trim only ASCII whitespace for branch names
   • Impact: Ensures proper formatting of branch identifiers, preventing issues with non-ASCII whitespace characters

3. Security Enhancement (#2530)

   • Escape values passed to --unset flag
   • Impact: Prevents potential injection vulnerabilities when unsetting git configuration values

4. Dependency Updates

   • Bumped various internal dependencies including github/codeql-action, actions/setup-node, docker/build-push-action, docker/login-action, actions/upload-artifact, and ESLint 9
   • Impact: Maintains compatibility and security standards

🔍 Impact Analysis

📁 Usage Locations

actions/checkout is used in 40 locations across 20 workflow files:

1. .github/workflows/deploy-drift-check.yml:43

   - uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     with:
       persist-credentials: "false"

   • Feature used: Standard checkout with credential persistence disabled
   • Impact: This PR updates this instance from v7.0.0 to v7.0.1

2. .github/workflows/deploy-drift-check.yml:69

   uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     with:
       persist-credentials: "false"

   • Feature used: Standard checkout with credential persistence disabled
   • Impact: This PR updates this instance from v7.0.0 to v7.0.1

3-40. Other workflow files (already at v7.0.1):

• .github/workflows/migration.yml (2 usages)
• .github/workflows/github-actions-lint.yml (2 usages)
• .github/workflows/generate.yml (3 usages)
• .github/workflows/sdk-e2e.yml (3 usages)
• .github/workflows/lockfile-audit.yml (1 usage)
• .github/workflows/cleanup-e2e-workspaces.yml (1 usage)
• .github/workflows/skills-sync-check.yml (1 usage)
• .github/workflows/pkg-pr-new.yml (2 usages)
• .github/workflows/release.yml (1 usage)
• .github/workflows/test.yml (2 usages)
• .github/workflows/check-license.yml (1 usage)
• .github/workflows/changeset-check.yml (1 usage)
• .github/workflows/erd-schema.yml (3 usages)
• .github/workflows/link-check.yml (1 usage)
• .github/workflows/deploy.yml (2 usages)
• .github/workflows/renovate-policy-check.yml (1 usage)
• .github/workflows/renovate-auto-review.yml (1 usage)
• .github/workflows/sdk-metrics.yml (6 usages)
• .github/workflows/docs-consistency-check.yml (1 usage)
• .github/workflows/ci.yml (1 usage)
• .github/workflows/template-tests.yml (1 usage)
• .github/workflows/add-renovate-changeset.yml (1 usage)

Note: This repository uses only the standard pull_request trigger in workflows (no pull_request_target or workflow_run), so the major security protections introduced in v7.0.0 against "pwn request" attacks do not directly apply to this codebase. However, the improvements still provide defense-in-depth.

✅ Recommended Actions

Approve and merge - This is a routine patch update that:

• Provides minor security improvements (value escaping for git config)
• Includes performance optimizations (PR check skip when using defaults)
• Fixes edge cases in branch name handling
• Maintains the action's dependencies at secure versions

No code changes are required. The update is backwards-compatible and all workflows will benefit from the bug fixes and security enhancements.

---