Update actions/checkout action to v7

[Coldaine]

User description

Review required: check dependency impact and CI before merging. Routine domain groups and separate major upgrades share two PR slots per repository; queued updates wait for a slot and the next Monday run.

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v4 → v7

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Various dependency updates

v6.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in #​2500
• backport fixes to releases-v6 by @​aiqiaoy in #​2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

v6.0.0

Compare Source

• Persist creds to a separate file by @​ericsciple in #​2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in #​2248

v5.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v5 by @​aiqiaoy in #​2501
• backport fixes to releases-v5 by @​aiqiaoy in #​2523

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v5.0.1...v5.1.0

v5.0.1

Compare Source

• Port v6 cleanup to v5 by @​ericsciple in #​2301

v5.0.0

Compare Source

• Update actions checkout to use node 24 by @​salmanmkc in #​2226

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

---

CodeAnt-AI Description

Upgrade CI checkout and prevent credential persistence in test workflows

What Changed

• CI, lint, visual-test, and overlay unit-test jobs now use the pinned actions/checkout v7 release
• Test workflows no longer leave checkout credentials configured in the working directory
• Existing test, lint, and screenshot validation jobs continue to run across their current Python versions

Impact

✅ Reduced credential exposure in CI jobs
✅ Consistent checkout behavior across workflows
✅ Safer test and lint runs

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Note

Update actions/checkout to v7 with persist-credentials: false in CI

• Pins actions/checkout to the v7 commit SHA in ci.yml and visual-tests.yml across all jobs (test, lint, visual-test, overlay-unit-tests).
• Adds persist-credentials: false to every updated checkout step so GITHUB_TOKEN credentials are not saved in the local Git config.

^{Macroscope summarized 0c17c70.}

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Incremental review completed	0c17c70	Sep 23, 2026 · 20:19	20:19
✅ Reviewed your PR	4c3c02b	Sep 22, 2026 · 17:01	17:03

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[Coldaine]

Reviewed the actions/checkout v7 pin on 0c17c70.

All four checkout steps use 3d3c42e5aac5ba805825da76410c181273ba90b1. That commit is the current actions/checkout v7 tag, and its message is the v7.0.1 release prep. The action runs on node24. persist-credentials still defaults to true. CI and the visual-test jobs install, lint, and test, and they do not push, so each checkout now sets persist-credentials to false.

The workflows were not executed.

No prior inline comments were open.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Model / thinking level: kilo/deepseek/deepseek-v4.1-flash at default reasoning effort.

Overview

The PR is a minimal Renovate dependency bump (actions/checkout v4 → pinned v7 SHA 3d3c42e5aac5ba805825da76410c181273ba90b1) plus a follow-up commit adding persist-credentials: false to all four checkout steps. All four call sites (ci.yml test + lint jobs, visual-tests.yml visual-test + overlay-unit-tests jobs) are updated consistently and are valid YAML. None of these jobs push to a remote or use Git credentials after checkout, so disabling credential persistence is safe here and is a genuine hardening improvement. No runtime, logic, security, or typo issues were found in the changed lines.

Documentation review (context, not part of this PR's diff)

Per review directives I inspected the docs landscape. These are not findings against this PR's diff, but they are worth acting on separately, in a dedicated docs PR:

• No AGENTS.md at the repo root. There is no top-level routing document describing the workflow or the key documents under /docs. A root AGENTS.md (or equivalent) should exist to route contributors/agents to the northstar and architecture docs.
• No northstar/goals document. I did not find a document enumerating the repo's aspirations and guiding instructions.
• Plans live under docs/plans/ and appear already executed. StagedImplementation.md describes the PR-00…PR-05 stack, PR-05-overlay-checklist.md is dated 2025-11-08 with all deliverables checked ✅ Done, and visual-test-checklist.md describes already-shipped visual-test tooling. Per the executed-plan rule these should be removed, with their still-relevant content promoted into live docs.
• Sprawling / stray docs. docs/plans/Possible plan.txt is an empty file (0 bytes) and should be deleted. docs/updates/* and implementation-plan.md overlap with each other and with docs/plans/, and the top-level shortcut-sage-bible.md is a large catch-all — a consolidation pass would reduce stale-doc risk.
• Scheduling/eligibility caveat (advisory): the PR description notes that major upgrades share PR slots and that this is a major-upgrade update, so confirm the merge slot/timing before merging. This is process guidance, not a code defect.

Files Reviewed (2 files)

• .github/workflows/ci.yml - 0 issues
• .github/workflows/visual-tests.yml - 0 issues

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

[Coldaine]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.