chore(deps): bump actions/checkout from 7.0.0 to 7.0.1

[dependabot]

Bumps actions/checkout from 7.0.0 to 7.0.1.

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 14, 2026, 12:23 PM ET / 16:23 UTC.

ClawSweeper review

What this changes

Updates the pinned checkout action to v7.0.1 in OCM’s runtime-install reproduction workflow.

Merge readiness

✅ Ready for maintainer review

Keep open: this workflow still uses v7.0.0 on current main, so the update remains useful. No blocking correctness or security concern was found.

Priority: P3
Reviewed head: dd055d10a8ebd479c68a901178feec57766567e1

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, officially pinned dependency update with no actionable defects found.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored workflow update is exempt from contributor runtime proof; upstream inspection supports compatibility, while supplied CI results do not establish execution of this dispatch-only reproduction job.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot-authored workflow update is exempt from contributor runtime proof; upstream inspection supports compatibility, while supplied CI results do not establish execution of this dispatch-only reproduction job.
Evidence reviewed	6 items	Introduced change: The pinned base-to-head diff changes only the checkout action SHA and version comment; full-history fetching and disabled credential persistence remain unchanged. Current-main necessity: Current main retains v7.0.0 in this workflow, although other workflows already use v7.0.1. GitHub confirmed the fetched main SHA remains current; the latest release tag lacks this reproduction workflow. Official dependency identity: The official v7.0.1 tag resolves exactly to the proposed SHA. The target workflow directly executes this dependency, establishing the relevant dependency boundary.
Findings	None	None.
Security	None	None.

How this fits together

This GitHub Actions workflow checks out OCM with full history, builds current and historical binaries, and runs an isolated runtime-install reproduction. It uploads the resulting diagnostic artifacts for review.

flowchart TD
  A[Manual dispatch or designated branch push] --> B[Read-only repository checkout]
  B --> C[Fetch complete history]
  C --> D[Build current and historical OCM]
  D --> E[Run isolated reproduction]
  E --> F[Upload diagnostic artifacts]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep the reproduction workflow aligned with the official checkout pin already used elsewhere, preserving its isolated execution settings.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency maintenance PR with no reported OCM runtime defect.

Is this the best way to solve the issue?

Yes: updating the existing immutable pin is the narrowest solution and preserves the workflow’s established inputs and permissions.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 3cb61a7d1751.

Labels

Label changes:

• add P3: This is a bounded dependency maintenance update to one reproduction workflow, with no product runtime changes.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored workflow update is exempt from contributor runtime proof; upstream inspection supports compatibility, while supplied CI results do not establish execution of this dispatch-only reproduction job.

Label justifications:

• P3: This is a bounded dependency maintenance update to one reproduction workflow, with no product runtime changes.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored workflow update is exempt from contributor runtime proof; upstream inspection supports compatibility, while supplied CI results do not establish execution of this dispatch-only reproduction job.

Evidence

What I checked:

• Introduced change: The pinned base-to-head diff changes only the checkout action SHA and version comment; full-history fetching and disabled credential persistence remain unchanged. (.github/workflows/reproduce-ocm-98.yml:18, dd055d10a8eb)
• Current-main necessity: Current main retains v7.0.0 in this workflow, although other workflows already use v7.0.1. GitHub confirmed the fetched main SHA remains current; the latest release tag lacks this reproduction workflow. (.github/workflows/reproduce-ocm-98.yml:18, 3cb61a7d1751)
• Official dependency identity: The official v7.0.1 tag resolves exactly to the proposed SHA. The target workflow directly executes this dependency, establishing the relevant dependency boundary. (3d3c42e5aac5)
• Upstream runtime and security review: Reviewed the source and bundled runtime changes: escaped Git configuration cleanup values, safer ref classification, and default-checkout handling. The fork guard applies to pull_request_target/workflow_run; neither triggers the affected OCM workflow. The action retains Node 24 and the existing inputs. Upstream comparison: actions/checkout@9c091bb...3d3c42e. (src/input-helper.ts:185, 3d3c42e5aac5)
• Workflow history and routing: GitHub’s commit patch records this workflow as added in merged fix: isolate runtime install lifecycle state #131, authored by MertBasar0 and merged by shakkernerd. Local follow-history encountered an unavailable object; API history and raw commit parent records supplied the relevant provenance. (.github/workflows/reproduce-ocm-98.yml:21, 3cb61a7d1751)
• Policy and validation scope: Read the full root AGENTS.md and contribution guidance; no nested .github AGENTS.md or maintainer-notes directory was found. The checkout remains clean. No builds, tests, or workflow dispatches were executed during this read-only review. (AGENTS.md:1, dd055d10a8eb)

Likely related people:

• Mert Başar: Raw commit 3cb61a7 adds .github/workflows/reproduce-ocm-98.yml:21 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 3cb61a7d1751; files: .github/workflows/reproduce-ocm-98.yml)
• shakkernerd: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[dependabot]

Superseded by #236.