chore(github): Bump actions/checkout from 6.0.3 to 7.0.1

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
     name: Rustfmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Install rust nightly with rustfmt
         run: |
           rustup toolchain install nightly --profile minimal --component rustfmt
@@ -43,7 +43,7 @@ jobs:
     name: cargo-deny (licenses, advisories, bans, sources)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Install cargo-deny
         run: cargo install cargo-deny --locked
       - name: Restore helper manifest
@@ -65,7 +65,7 @@ jobs:
     name: Compliance (copyright headers)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Check copyright headers
         run: bash scripts/check_copyright_headers.sh
 
@@ -80,7 +80,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Install rust stable with clippy
         shell: bash
         run: |
@@ -216,7 +216,7 @@ jobs:
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Install rust stable with clippy
         run: |
           rustup toolchain install stable --profile minimal --component clippy
@@ -269,7 +269,7 @@ jobs:
         if: runner.os != 'Windows'
         run: chmod +x bin/${{ matrix.binary }}
       - name: Checkout openjd-specifications
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           repository: OpenJobDescription/openjd-specifications
           path: openjd-specifications
@@ -293,7 +293,7 @@ jobs:
     name: MSRV
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Install MSRV toolchain
         run: |
           rustup toolchain install 1.94.1 --profile minimal
@@ -315,7 +315,7 @@ jobs:
     name: Documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Install rust stable
         run: |
           rustup toolchain install stable --profile minimal
@@ -343,7 +343,7 @@ jobs:
       matrix:
         variant: [localuser, ldap]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Run cross-user tests
         run: |
           if [ "${{ matrix.variant }}" = "ldap" ]; then
@@ -362,7 +362,7 @@ jobs:
     needs: build-test
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Install rust stable
         shell: bash
         run: |
@@ -423,7 +423,7 @@ jobs:
     name: openjd-for-js (WASM + JS tests)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Install rust stable with wasm32 target
         shell: bash
         run: |

.github/workflows/codeql.yml

@@ -22,7 +22,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4.37.8

.github/workflows/eval_crate.yml

@@ -211,15 +211,15 @@ jobs:
       # The skill resolves sibling repos relative to the openjd-rs root, so
       # everything is checked out as siblings INSIDE the workspace.
       - name: Check out openjd-rs
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.0
         with:
           # In PR mode evaluate the PR's own code; otherwise the default ref.
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
           path: openjd-rs
           persist-credentials: false
 
       - name: Check out openjd-specifications (canonical specs)
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.0
         with:
           repository: OpenJobDescription/openjd-specifications
           ref: mainline
@@ -232,7 +232,7 @@ jobs:
       # no feature branches: this job holds Bedrock credentials, so what it
       # checks out is a trust decision, not a convenience.
       - name: Check out Python reference
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.0
         with:
           repository: ${{ fromJSON('{"expr":"OpenJobDescription/openjd-model-for-python","model":"OpenJobDescription/openjd-model-for-python","sessions":"OpenJobDescription/openjd-sessions-for-python","cli":"OpenJobDescription/openjd-cli"}')[matrix.crate] }}
           ref: mainline
@@ -266,7 +266,7 @@ jobs:
 
       # ---- Bedrock auth: the same shape as the org's review workflow ----
       - name: Check out workflow tooling (pinned requirements)
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.0
         with:
           repository: aws-deadline/.github
           ref: mainline
@@ -460,7 +460,7 @@ jobs:
       # writes only FETCH_HEAD, so a later `git checkout <branch>` would fail and
       # silently recreate the branch from the shallow tip.
       - name: Check out the default branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.0
         with:
           ref: ${{ github.event.repository.default_branch }}
           fetch-depth: 0

.github/workflows/release-plz.yml

@@ -61,7 +61,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -121,7 +121,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false