chore(actions): bump actions/checkout from 4 to 7

[dependabot]

Bumps actions/checkout from 4 to 7.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in actions/checkout#2500
• backport fixes to releases-v6 by @​aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @​ericsciple in actions/checkout#2314
• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327
• Clarify v6 README by @​ericsciple in actions/checkout#2328

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🛰️ PR Sweeper report

Risk: 🟠 MEDIUM · Security gate: ✅ passing · Files: 4

🔒 Automated guardrails (authoritative)

	Category	Location	Finding
⚠️	scope	—	Touches security-sensitive path(s): .github/workflows/build-catalog.yml, .github/workflows/content-spring-cleaning.yml, .github/workflows/traffic-stats.yml, .github/workflows/update-message-center.yml. Maintainer + security review required.

🤖 Dual-model AI review (advisory)

Deep-reasoning reviewer — openai/o3 · verdict: comment · risk: low

Changes only bump actions/checkout to v7 and one setup-node SHA. No secrets or malicious logic present. Main concern is the use of floating action tags in several workflows, which can introduce supply-chain risk and version inconsistency compared with the SHA-pinned usage in update-message-center.yml.

Security notes:

• low .github/workflows/build-catalog.yml:5 — actions/checkout is referenced by floating tag v7; pinning to a full commit SHA is safer to prevent supply-chain surprises.
• low .github/workflows/content-spring-cleaning.yml:5 — actions/checkout is referenced by floating tag v7; consider pinning.
• low .github/workflows/traffic-stats.yml:6 — actions/checkout is referenced by floating tag v7; consider pinning.
• low .github/workflows/update-message-center.yml:4 — Mixed pinning strategy: checkout is pinned to SHA, but setup-node in other workflows is unpinned. Consistency helps security posture.

Quality notes:

• .github/workflows/build-catalog.yml — setup-node is still on v4 here while update-message-center.yml uses v5; consider aligning versions or documenting the difference.
• .github/workflows/* — Updating to a new major of actions/checkout (v7) can change default behaviors (e.g., submodules, fetch-depth default). Make sure workflows were tested end-to-end.

✅ Suggested next steps

• Pin all critical GitHub Actions (checkout, setup-node) to specific commit SHAs for reproducibility and supply-chain safety.
• Verify that actions/checkout@​v7 behavior matches previous versions for these workflows (e.g., default fetch-depth, sparse-checkout) to avoid runtime surprises.
• Consider standardizing setup-node version across workflows or documenting why different versions are required.

---

The automated guardrails are authoritative and gate the security status. The AI review is advisory and never auto-merges. Thanks for contributing to FastTrack! 🛩️

[soyalejolopez]

@dependabot merge