chore(deps): weekly safe github-actions updates · 1 package

[mendral-app]

Packages bumped

Package	Old	New	Released
actions/checkout	v4.2.2	v7.0.0	2026-06-18

actions/checkout v4.2.2 → v7.0.0

• v5.0.0: Updated to Node 24 runtime (transparent on GitHub-hosted runners)
• v6.0.0: Credential persistence moved to a separate file (internal change, no user impact)
• v7.0.0: Blocks checkout of fork PRs on pull_request_target/workflow_run events by default (new allow-unsafe-pr-checkout input)

Impact on this repo: None. This workflow triggers on [push, pull_request] and only uses submodules: true — all inputs and defaults are unchanged across these versions. Runs on GitHub-hosted macOS runners which already support Node 24.

Files modified

• .github/workflows/CI.yml — updated pinned SHA

Skipped this ecosystem

No other GitHub Actions dependencies found in this repository.

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session

[mendral-app]

CI Note

The macos-14 job failure is a pre-existing runner environment issue — the xcodes formula installed on the GitHub-hosted macos-14 runner has no bottle available for that platform, causing brew upgrade to exit non-zero.

This is unrelated to the actions/checkout bump:

• ✅ macos-15 passes cleanly, confirming the v7.0.0 checkout action works correctly
• ❌ macos-14 fails at brew upgrade (not at checkout), same error in both triggered runs
• ⏭️ macos-13 cancelled due to fail-fast: true (default matrix behavior)

This issue would reproduce identically on the main branch if CI.yml were triggered there today.

Note

Tag @mendral-app with feedback or questions.