#5 Bump actions/checkout from 4 to 7

[Anonymous]

Originally created by: dependabot[bot]

Bumps actions/checkout from 4 to 7.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout/issues/2454)
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout/issues/2458)
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout/issues/2460)
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout/issues/2461)
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout/issues/2459)
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout/issues/2463)
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout/issues/2462)
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout/issues/2464)
• update error wording by @​aiqiaoy in actions/checkout#2467](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout/issues/2467)

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout/issues/2454)

Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v7.0.0

v6.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in actions/checkout#2500](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout/issues/2500)
• backport fixes to releases-v6 by @​aiqiaoy in actions/checkout#2527](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout/issues/2527)

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v6.1.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout/issues/2357)
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout/issues/2414)
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout/issues/2439)
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout/issues/2446)

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout/issues/2414)

Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout/issues/2355)
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout/issues/2356)

Full Changelog: https://github.com/actions/checkout/compare/v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @​ericsciple in actions/checkout#2314](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout/issues/2314)
• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout/issues/2327)
• Clarify v6 README by @​ericsciple in actions/checkout#2328](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout/issues/2328)

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout/issues/2518)
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout/issues/2521)
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout/issues/2530)
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout/issues/2454)
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout/issues/2439)
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout/issues/2414)

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout/issues/2356)

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout/issues/2327)

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout/issues/2286)
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout/issues/2248)

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout/issues/2301)

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout/issues/2226)

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout/issues/2305)

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971](https://github.com/href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout/issues/1971)
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977](https://github.com/href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout/issues/1977)
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout/issues/2043)
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout/issues/2044)
• Update README.md by @​nebuk89 in actions/checkout#2194](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout/issues/2194)
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout/issues/2224)
• Update package dependencies by @​salmanmkc in actions/checkout#2236](https://github.com/href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout/issues/2236)

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941](https://github.com/href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout/issues/1941)
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946](https://github.com/href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout/issues/1946)

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924](https://github.com/href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout/issues/1924)

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531](https://github.com/href="https://redirect.github.com/actions/checkout/issues/2531">/issues/2531))
• 2880268 escape values passed to --unset (#2530](https://github.com/href="https://redirect.github.com/actions/checkout/issues/2530">/issues/2530))
• 12cd223 trim only ascii whitespace for branch (#2521](https://github.com/href="https://redirect.github.com/actions/checkout/issues/2521">/issues/2521))
• 62661c4 skip running unsafe pr check if input is default (#2518](https://github.com/href="https://redirect.github.com/actions/checkout/issues/2518">/issues/2518))
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499](https://github.com/href="https://redirect.github.com/actions/checkout/issues/2499">/issues/2499))
• 631c942 eslint 9 (#2474](https://github.com/href="https://redirect.github.com/actions/checkout/issues/2474">/issues/2474))
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476](https://github.com/href="https://redirect.github.com/actions/checkout/issues/2476">/issues/2476))
• ba09753 Bump actions/checkout from 6 to 7 (#2488](https://github.com/href="https://redirect.github.com/actions/checkout/issues/2488">/issues/2488))
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479](https://github.com/href="https://redirect.github.com/actions/checkout/issues/2479">/issues/2479))
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478](https://github.com/href="https://redirect.github.com/actions/checkout/issues/2478">/issues/2478))
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name=""> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </dependency>

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.