build(deps): bump actions/checkout from 6.1.0 to 7.0.1

.github/workflows/benchmark.yml

@@ -38,7 +38,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: main
@@ -132,7 +132,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: main

.github/workflows/build-native-matrix.yml

@@ -59,7 +59,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@v7.0.0

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Lint
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@v7.0.0
@@ -54,7 +54,7 @@ jobs:
     outputs:
       native_changed: ${{ steps.check.outputs.native_changed }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
@@ -112,7 +112,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     name: Native host build (${{ matrix.os }})
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@v7.0.0
@@ -169,7 +169,7 @@ jobs:
     name: Test Node ${{ matrix.node-version }} (${{ matrix.os }})
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@v7.0.0
@@ -212,7 +212,7 @@ jobs:
     runs-on: ubuntu-latest
     name: TypeScript type check
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@v7.0.0
@@ -243,7 +243,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Security audit
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Audit production dependencies
         # --package-lock-only reads the lock file directly — no npm install needed.
@@ -261,7 +261,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Verify dynamic imports
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@v7.0.0
@@ -277,7 +277,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Grammar version parity
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@v7.0.0
@@ -302,7 +302,7 @@ jobs:
     name: Engine parity (${{ matrix.os }})
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@v7.0.0
@@ -394,7 +394,7 @@ jobs:
     name: Rust compile check
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -440,7 +440,7 @@ jobs:
       CODEGRAPH_FAST_SKIP_DIAG: "1"
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/claude.yml

@@ -22,7 +22,7 @@ jobs:
     outputs:
       trivial: ${{ steps.check.outputs.trivial }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
@@ -103,7 +103,7 @@ jobs:
           exit 1
 
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
 
@@ -265,7 +265,7 @@ jobs:
           exit 1
 
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
 

.github/workflows/codegraph-impact.yml

@@ -12,7 +12,7 @@ jobs:
   impact:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
       - uses: actions/setup-node@v7.0.0

.github/workflows/commitlint.yml

@@ -12,7 +12,7 @@ jobs:
     name: Validate commits
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/embedding-regression.yml

@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@v7.0.0

.github/workflows/perf-canary.yml

@@ -42,7 +42,7 @@ jobs:
       CODEGRAPH_FAST_SKIP_DIAG: "1"
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7.0.0
         with:

.github/workflows/publish.yml

@@ -33,7 +33,7 @@ jobs:
       # Only the scheduled path below actually reads repo history (git rev-list);
       # release/workflow_dispatch exit immediately with should_run=true and never
       # touch the checkout, so skip the full-depth clone for those triggers.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         if: github.event_name == 'schedule'
         with:
           fetch-depth: 0
@@ -87,7 +87,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-node@v7.0.0
         with:
           node-version: "22"
@@ -130,7 +130,7 @@ jobs:
       version: ${{ steps.compute.outputs.version }}
       npm_tag: ${{ steps.compute.outputs.npm_tag }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
@@ -211,7 +211,7 @@ jobs:
       CODEGRAPH_FAST_SKIP_DIAG: "1"
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
@@ -373,7 +373,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7.0.0
         with:
@@ -548,7 +548,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: main

.github/workflows/shield-license-compliance.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@v7.0.0

.github/workflows/update-recall-floors.yml

@@ -34,7 +34,7 @@ jobs:
       # with contents:write + pull-requests:write and passes its write-scoped
       # token straight into the checkout step — an upstream tag compromise
       # would otherwise run unreviewed code with that authority.
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}