chore(deps): update actions/checkout action to v7.0.1

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v7.0.0 → v7.0.1

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 06:59 PM, Monday through Friday (* 9-18 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 94966b4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

Name	Type
@tailor-platform/create-sdk	Patch
@tailor-platform/eslint-plugin-sdk	Patch
@tailor-platform/sdk-codemod	Patch
@tailor-platform/sdk-plugin-seed	Patch
@tailor-platform/sdk-plugin-tailordb-erd	Patch
@tailor-platform/sdk	Patch
@tailor-platform/tailor-proto	Patch
executor	Patch
generators	Patch
hello-world	Patch
inventory-management	Patch
multi-application	Patch
resolver	Patch
static-web-site	Patch
tailordb	Patch
workflow	Patch
example	Patch
llm-challenge	Patch

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🤖 Claude Dependency Review

📦 Update Summary

• Library: actions/checkout
• Version: v7.0.0 → v7.0.1
• Change Type: Patch
• Update Scope: Single lagging instance in .github/workflows/test.yml being updated to match the rest of the codebase

📝 Release Notes

actions/checkout v7.0.1 Release

🔐 Security Assessment

• Risk: 🟢 Low
• Known vulnerabilities: None found in either v7.0.0 or v7.0.1. This update includes a proactive security fix.
• Supply-chain notes: No red flags detected. The release was authored by an established maintainer (@​aiqiaoy) and includes security hardening fixes. No unexpected dependencies, ownership changes, or suspicious lifecycle scripts were identified.

✨ Main Changes

This patch release includes three bug fixes and security improvements:

🐛 Bug Fixes and Security Improvements

1. Command Injection Prevention - Escape values passed to --unset flag to prevent malicious input from being interpreted as executable commands during git configuration operations.

2. PR Safety Enhancement - Skip running unsafe PR check when input is at default value, improving security handling for pull request scenarios.

3. Whitespace Handling - Trim only ASCII whitespace for branch names to ensure proper branch name processing and prevent edge cases with non-ASCII characters.

📦 Dependency Updates

The release also includes several internal dependency updates (codeql-action, setup-node, docker actions, eslint 9) which improve the action's build and test infrastructure but do not affect runtime behavior.

🔍 Impact Analysis

📁 Usage Locations

actions/checkout is used extensively throughout the repository in 23 workflow files across two main locations:

CI/CD Workflows (.github/workflows/ - 18 files, 42 total usages):

1. .github/workflows/test.yml

   - uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     with:
       persist-credentials: "false"

   • Feature used: Repository checkout for change detection job
   • Impact: None - security improvement only

2. .github/workflows/test.yml

   - name: Checkout
     uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     with:
       persist-credentials: false

   • Feature used: Repository checkout for test job (Node 22, 24 matrix)
   • Impact: None - security improvement only

3. .github/workflows/test.yml

   - name: Checkout
     uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     with:
       persist-credentials: false

   • Feature used: Repository checkout for Windows plugin tests
   • Impact: None - security improvement only (this is the instance being updated in this PR)

4. .github/workflows/deploy.yml

   - uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

   • Feature used: Repository checkout for deployment workflows
   • Impact: None - security improvement only

5. .github/workflows/deploy.yml

   uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

   • Feature used: Repository checkout in matrix deployment jobs
   • Impact: None - security improvement only

6. .github/workflows/renovate-auto-review.yml

   - uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

   • Feature used: Repository checkout for automated dependency reviews
   • Impact: None - security improvement only

7. .github/workflows/add-renovate-changeset.yml

   uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

   • Feature used: Repository checkout for changeset automation
   • Impact: None - security improvement only

8. .github/workflows/migration.yml

   - uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

   • Feature used: Repository checkout for migration checks
   • Impact: None - security improvement only

9. .github/workflows/migration.yml

   uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

   • Feature used: Repository checkout in matrix migration jobs
   • Impact: None - security improvement only

10. .github/workflows/pkg-pr-new.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for package preview publishing
    • Impact: None - security improvement only

11. .github/workflows/pkg-pr-new.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for package testing jobs
    • Impact: None - security improvement only

12. .github/workflows/sdk-e2e.yml

    - uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for E2E test detection
    • Impact: None - security improvement only

13. .github/workflows/sdk-e2e.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for E2E tests (multiple matrix jobs)
    • Impact: None - security improvement only

14. .github/workflows/check-license.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for license validation
    • Impact: None - security improvement only

15. .github/workflows/template-tests.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for template testing
    • Impact: None - security improvement only

16. .github/workflows/skills-sync-check.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for skills synchronization checks
    • Impact: None - security improvement only

17. .github/workflows/docs-consistency-check.yml

    - uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for documentation consistency validation
    • Impact: None - security improvement only

18. .github/workflows/cleanup-e2e-workspaces.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for E2E workspace cleanup
    • Impact: None - security improvement only

19. .github/workflows/erd-schema.yml

    - uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for ERD schema generation (multiple jobs)
    • Impact: None - security improvement only

20. .github/workflows/sdk-metrics.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for SDK metrics collection (multiple measurement jobs)
    • Impact: None - security improvement only

21. .github/workflows/generate.yml

    - uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for code generation checks
    • Impact: None - security improvement only

22. .github/workflows/lockfile-audit.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for lockfile security audits
    • Impact: None - security improvement only

23. .github/workflows/deploy-drift-check.yml

    - uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for deployment drift detection
    • Impact: None - security improvement only

24. .github/workflows/github-actions-lint.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for workflow linting
    • Impact: None - security improvement only

25. .github/workflows/lockfile-audit-fix.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for automated lockfile fixes
    • Impact: None - security improvement only

26. .github/workflows/changeset-check.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for changeset validation
    • Impact: None - security improvement only

27. .github/workflows/release.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for release workflows
    • Impact: None - security improvement only

28. .github/workflows/ci.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for continuous integration
    • Impact: None - security improvement only

29. .github/workflows/link-check.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for broken link detection
    • Impact: None - security improvement only

30. .github/workflows/renovate-policy-check.yml

    - uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Repository checkout for Renovate configuration validation
    • Impact: None - security improvement only

Workflow Templates (packages/sdk/src/cli/commands/setup/ - 5 template files, 18 total usages):

31. packages/sdk/src/cli/commands/setup/coordinate.workflow.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Workflow template for coordinate deployments (3 usages across different jobs)
    • Impact: None - these are templates generated by tailor setup command

32. packages/sdk/src/cli/commands/setup/preview.workflow.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Workflow template for preview deployments (2 usages)
    • Impact: None - template file

33. packages/sdk/src/cli/commands/setup/tag.workflow.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Workflow template for tag-based deployments (3 usages)
    • Impact: None - template file

34. packages/sdk/src/cli/commands/setup/branch.workflow.yml

    uses: actions/checkout@​3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    • Feature used: Workflow template for branch-based deployments (6 usages across multiple jobs)
    • Impact: None - template file

Test Fixtures (4 files - codemod test data):

Additionally, actions/checkout@​v4 appears in codemod test fixture files (input.yml and expected.yml) under packages/sdk-codemod/. These are test data files and not actual workflow executions.

Common Usage Pattern

All instances use actions/checkout with:

• Pinned commit SHA: 3d3c42e5aac5ba805825da76410c181273ba90b1 for security (preventing tag tampering)
• Version comment: # v7.0.1 for human readability
• Common option: persist-credentials: false to prevent credential exposure

Impact Summary

• Breaking changes: None
• Behavioral changes: None for normal operation
• Security posture: Improved - fixes potential command injection vulnerability
• Required code changes: None - this is a drop-in security patch

✅ Recommended Actions

Merge this PR. This is a low-risk security improvement with no breaking changes or behavioral modifications. The update:

1. ✅ Fixes a command injection vulnerability in git configuration handling
2. ✅ Improves PR safety checks
3. ✅ Enhances branch name processing
4. ✅ Maintains full backward compatibility
5. ✅ Brings the final lagging instance in test.yml up to date with the rest of the codebase

No code changes, testing, or migration steps are required. The action will continue functioning identically with improved security.

---