From cd2aca3eeedb257b77ce05562f502dd211b8d13c Mon Sep 17 00:00:00 2001
From: Aevum <aevum@decess.us>
Date: Mon, 14 Sep 2026 12:05:42 -0400
Subject: [PATCH 1/4] Update all workflows to use actions/checkout:v7

- Replace v6 commit hash with v7 tag in 10 workflow files
---
 .github/workflows/aevum-dev-images.yaml   | 2 +-
 .github/workflows/codeql.yaml             | 2 +-
 .github/workflows/coverage.yaml           | 2 +-
 .github/workflows/create-release.yaml     | 2 +-
 .github/workflows/dev-images.yaml         | 2 +-
 .github/workflows/prod-images.yaml        | 2 +-
 .github/workflows/ruff-check.yaml         | 2 +-
 .github/workflows/sonar.yaml              | 2 +-
 .github/workflows/sync-dev-to-master.yaml | 2 +-
 .github/workflows/validate-release.yaml   | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/aevum-dev-images.yaml b/.github/workflows/aevum-dev-images.yaml
index 490b1770..ae3647b7 100644
--- a/.github/workflows/aevum-dev-images.yaml
+++ b/.github/workflows/aevum-dev-images.yaml
@@ -23,7 +23,7 @@ jobs:
         dockerfile: [ "web", "worker", "beat" ]
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v7
         with:
           lfs: true
 
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 4f3789a3..24086b00 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index 85db04cb..e61da888 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/create-release.yaml b/.github/workflows/create-release.yaml
index a1077761..d809be81 100644
--- a/.github/workflows/create-release.yaml
+++ b/.github/workflows/create-release.yaml
@@ -20,7 +20,7 @@ jobs:
           private-key: ${{ secrets.FRAGFORCE_AUTOMATION_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v7
         with:
           fetch-tags: true
 
diff --git a/.github/workflows/dev-images.yaml b/.github/workflows/dev-images.yaml
index 8cac6810..8fec0652 100644
--- a/.github/workflows/dev-images.yaml
+++ b/.github/workflows/dev-images.yaml
@@ -24,7 +24,7 @@ jobs:
         dockerfile: [ "web", "worker", "beat" ]
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v7
         with:
           lfs: true
       - name: Debug
diff --git a/.github/workflows/prod-images.yaml b/.github/workflows/prod-images.yaml
index 6c18b858..a37d2b30 100644
--- a/.github/workflows/prod-images.yaml
+++ b/.github/workflows/prod-images.yaml
@@ -26,7 +26,7 @@ jobs:
         dockerfile: [ "web", "worker", "beat" ]
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v7
         with:
           lfs: true
       - name: Debug
diff --git a/.github/workflows/ruff-check.yaml b/.github/workflows/ruff-check.yaml
index 704efd81..9789c09a 100644
--- a/.github/workflows/ruff-check.yaml
+++ b/.github/workflows/ruff-check.yaml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml
index 629f8b74..5c381e13 100644
--- a/.github/workflows/sonar.yaml
+++ b/.github/workflows/sonar.yaml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout PR code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
diff --git a/.github/workflows/sync-dev-to-master.yaml b/.github/workflows/sync-dev-to-master.yaml
index 4b4a3bdd..d76b5e56 100644
--- a/.github/workflows/sync-dev-to-master.yaml
+++ b/.github/workflows/sync-dev-to-master.yaml
@@ -21,7 +21,7 @@ jobs:
           private-key: ${{ secrets.FRAGFORCE_AUTOMATION_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/validate-release.yaml b/.github/workflows/validate-release.yaml
index 3303ddae..482bb8f0 100644
--- a/.github/workflows/validate-release.yaml
+++ b/.github/workflows/validate-release.yaml
@@ -13,7 +13,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

From 69fd9e8dedd01615d1757776b337d543ee5fb99e Mon Sep 17 00:00:00 2001
From: Aevum <aevum@decess.us>
Date: Mon, 14 Sep 2026 13:48:51 -0400
Subject: [PATCH 2/4] Update all workflows to use actions/checkout@v7 (SHA:
 3d3c42e5aac5ba805825da76410c181273ba90b1)

- Pin to v7.0.1 SHA hash for supply chain security
- Add allow-fork-pr-checkout: true to sonar.yaml (workflow_run triggers need this in v7)
- v7 breaks fork PR checkout by default when using pull_request_target + workflow_run
---
 .github/workflows/aevum-dev-images.yaml   | 2 +-
 .github/workflows/codeql.yaml             | 2 +-
 .github/workflows/coverage.yaml           | 2 +-
 .github/workflows/create-release.yaml     | 2 +-
 .github/workflows/dev-images.yaml         | 2 +-
 .github/workflows/prod-images.yaml        | 2 +-
 .github/workflows/ruff-check.yaml         | 2 +-
 .github/workflows/sonar.yaml              | 3 ++-
 .github/workflows/sync-dev-to-master.yaml | 2 +-
 .github/workflows/validate-release.yaml   | 2 +-
 10 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/aevum-dev-images.yaml b/.github/workflows/aevum-dev-images.yaml
index ae3647b7..547df216 100644
--- a/.github/workflows/aevum-dev-images.yaml
+++ b/.github/workflows/aevum-dev-images.yaml
@@ -23,7 +23,7 @@ jobs:
         dockerfile: [ "web", "worker", "beat" ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: true
 
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 24086b00..d71f3d0d 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index e61da888..e301b4f9 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/create-release.yaml b/.github/workflows/create-release.yaml
index d809be81..10667136 100644
--- a/.github/workflows/create-release.yaml
+++ b/.github/workflows/create-release.yaml
@@ -20,7 +20,7 @@ jobs:
           private-key: ${{ secrets.FRAGFORCE_AUTOMATION_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-tags: true
 
diff --git a/.github/workflows/dev-images.yaml b/.github/workflows/dev-images.yaml
index 8fec0652..4a839797 100644
--- a/.github/workflows/dev-images.yaml
+++ b/.github/workflows/dev-images.yaml
@@ -24,7 +24,7 @@ jobs:
         dockerfile: [ "web", "worker", "beat" ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: true
       - name: Debug
diff --git a/.github/workflows/prod-images.yaml b/.github/workflows/prod-images.yaml
index a37d2b30..bcb81dca 100644
--- a/.github/workflows/prod-images.yaml
+++ b/.github/workflows/prod-images.yaml
@@ -26,7 +26,7 @@ jobs:
         dockerfile: [ "web", "worker", "beat" ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: true
       - name: Debug
diff --git a/.github/workflows/ruff-check.yaml b/.github/workflows/ruff-check.yaml
index 9789c09a..cb8eb6ed 100644
--- a/.github/workflows/ruff-check.yaml
+++ b/.github/workflows/ruff-check.yaml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml
index 5c381e13..c986696b 100644
--- a/.github/workflows/sonar.yaml
+++ b/.github/workflows/sonar.yaml
@@ -18,10 +18,11 @@ jobs:
 
     steps:
       - name: Checkout PR code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
+          allow-fork-pr-checkout: true
 
       - name: Generate app token
         id: app-token
diff --git a/.github/workflows/sync-dev-to-master.yaml b/.github/workflows/sync-dev-to-master.yaml
index d76b5e56..d7252c30 100644
--- a/.github/workflows/sync-dev-to-master.yaml
+++ b/.github/workflows/sync-dev-to-master.yaml
@@ -21,7 +21,7 @@ jobs:
           private-key: ${{ secrets.FRAGFORCE_AUTOMATION_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/validate-release.yaml b/.github/workflows/validate-release.yaml
index 482bb8f0..432a5b40 100644
--- a/.github/workflows/validate-release.yaml
+++ b/.github/workflows/validate-release.yaml
@@ -13,7 +13,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 

From 133a3e390bccc1abe22c3dbc89a2a06648a54878 Mon Sep 17 00:00:00 2001
From: Aevum <aevum@decess.us>
Date: Mon, 14 Sep 2026 16:08:28 -0400
Subject: [PATCH 3/4] Upgraded most workflows to use latest stable versions

---
 .github/workflows/coverage.yaml           | 2 +-
 .github/workflows/create-release.yaml     | 2 +-
 .github/workflows/django-tests.yaml       | 2 +-
 .github/workflows/ruff-check.yaml         | 2 +-
 .github/workflows/sync-dev-to-master.yaml | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index e301b4f9..2286bed2 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -49,7 +49,7 @@ jobs:
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.13'
 
diff --git a/.github/workflows/create-release.yaml b/.github/workflows/create-release.yaml
index 10667136..a4d7ea09 100644
--- a/.github/workflows/create-release.yaml
+++ b/.github/workflows/create-release.yaml
@@ -14,7 +14,7 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ secrets.FRAGFORCE_AUTOMATION_APP_ID }}
           private-key: ${{ secrets.FRAGFORCE_AUTOMATION_PRIVATE_KEY }}
diff --git a/.github/workflows/django-tests.yaml b/.github/workflows/django-tests.yaml
index eacb74fe..98e3fb08 100644
--- a/.github/workflows/django-tests.yaml
+++ b/.github/workflows/django-tests.yaml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ secrets.FRAGFORCE_CI_APP_ID }}
           private-key: ${{ secrets.FRAGFORCE_CI_PRIVATE_KEY }}
diff --git a/.github/workflows/ruff-check.yaml b/.github/workflows/ruff-check.yaml
index cb8eb6ed..a3371286 100644
--- a/.github/workflows/ruff-check.yaml
+++ b/.github/workflows/ruff-check.yaml
@@ -23,7 +23,7 @@ jobs:
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.13'
 
diff --git a/.github/workflows/sync-dev-to-master.yaml b/.github/workflows/sync-dev-to-master.yaml
index d7252c30..4353f709 100644
--- a/.github/workflows/sync-dev-to-master.yaml
+++ b/.github/workflows/sync-dev-to-master.yaml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ secrets.FRAGFORCE_AUTOMATION_APP_ID }}
           private-key: ${{ secrets.FRAGFORCE_AUTOMATION_PRIVATE_KEY }}

From d782596b93aa084fcebde8c36237a08e1aaa6466 Mon Sep 17 00:00:00 2001
From: Aevum <aevum@decess.us>
Date: Mon, 14 Sep 2026 21:01:14 -0400
Subject: [PATCH 4/4] Upgrade sonar.yaml to actions v7 which require
 `allow-fork-pr-checkout`

---
 .github/workflows/sonar.yaml | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml
index c986696b..3cc3515b 100644
--- a/.github/workflows/sonar.yaml
+++ b/.github/workflows/sonar.yaml
@@ -17,16 +17,35 @@ jobs:
       pull-requests: write
 
     steps:
+      # SECURITY NOTE: allow-unsafe-pr-checkout is required because this workflow
+      # uses `workflow_run` to trigger after the Coverage workflow completes.
+      # In actions/checkout@v7+, fork PR checkouts are blocked by default for
+      # `workflow_run` triggers (see: https://github.com/actions/checkout/releases/tag/v7.0.0).
+      #
+      # Why we need it:
+      # - We must checkout the actual PR code to run SonarCloud analysis on pull requests
+      # - Without this flag, the workflow would fail when analyzing forks' PRs
+      #
+      # Mitigating factors for our use case:
+      # 1. This workflow only runs on `github.repository == 'fragforce/fragforce.org'`
+      #    - It will NOT run on fork repositories, so the "pwn request" attack vector doesn't apply
+      # 2. The checkout happens in a trusted context (official GitHub Actions runner)
+      # 3. We're not using `pull_request_target` (more dangerous) but `workflow_run`
+      # 4. Coverage data is downloaded from GitHub's artifact system, not user input
+      # 5. SonarCloud analysis is read-only - it scans code, doesn't execute or modify it
+      #
+      # See: https://github.com/actions/checkout/security/advisories/GHSA-wr3m-4mph-g9w6
+
       - name: Checkout PR code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
-          allow-fork-pr-checkout: true
+          allow-unsafe-pr-checkout: true
 
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ secrets.FRAGFORCE_CI_APP_ID }}
           private-key: ${{ secrets.FRAGFORCE_CI_PRIVATE_KEY }}
@@ -50,7 +69,7 @@ jobs:
           echo "SONAR_BRANCH_NAME=$BRANCH" >> "$GITHUB_ENV"
 
       - name: Set up Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: 21