🚨 Update actions/checkout action to v7 (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v4.4.0 → v7.0.1

---

Release Notes

actions/checkout

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Various dependency updates

v6.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in #​2500
• backport fixes to releases-v6 by @​aiqiaoy in #​2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

v6.0.0

Compare Source

• Persist creds to a separate file by @​ericsciple in #​2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in #​2248

v5.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v5 by @​aiqiaoy in #​2501
• backport fixes to releases-v5 by @​aiqiaoy in #​2523

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v5.0.1...v5.1.0

v5.0.1

Compare Source

• Port v6 cleanup to v5 by @​ericsciple in #​2301

v5.0.0

Compare Source

• Update actions checkout to use node 24 by @​salmanmkc in #​2226

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 766bba18-6aa5-4bd6-a3e8-a64cd2cfe463

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: cb7891df-9cce-49e2-bf55-ad4b6a8e82fc

📥 Commits

Reviewing files that changed from the base of the PR and between 4ada070 and 8c793ca.

📒 Files selected for processing (1)

• .github/workflows/validate-docs.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

📝 Walkthrough

The documentation validation workflow now pins actions/checkout to v7.0.1 instead of v4.4.0.

Changes: Documentation validation

Layer / File(s)	Summary
Update checkout action pin .github/workflows/validate-docs.yaml	The workflow now pins actions/checkout to v7.0.1 instead of v4.4.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: cuipinghuo, acepresso

Merge Risk: ⚪ Minimal · up to 8c793

This updates the checkout action used by the documentation validation workflow. The workflow runs on pull_request and does not check out a custom ref, so the v7 restriction should not affect it. The change is low risk to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: updating the actions/checkout action to v7.
Description check	✅ Passed	The description directly explains the actions/checkout update from v4.4.0 to v7.0.1 and includes relevant release notes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:37 AM UTC · Completed 1:43 AM UTC

Commit: e8f0a9f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.43

[fullsend-ai-review]

Looks good to me

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/validate-docs.yaml

Previous run

Review

Findings

Medium

• [protected-path] .github/workflows/validate-docs.yaml — This PR modifies a file under the .github/ protected path. Human approval is always required for governance and infrastructure changes, regardless of context. The change is a mechanical actions/checkout version bump from v4.4.0 → v7.0.1 authored by renovate[bot]; the new commit SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 was verified against the upstream GitHub API to match refs/tags/v7.0.1 for actions/checkout (the pin is authentic). The repository's renovate.json extends the shared conforma/.github renovate configuration, which authorizes this update pattern; a human maintainer must still approve the merge.

Previous run (2)

Review

Findings

Medium

• [protected-path] .github/workflows/validate-docs.yaml — This PR modifies a file under the .github/ governance path, which requires human approval. Authorization for this change is inferable from renovate.json at the repo root (extending conforma/.github's Renovate config), and the PR description clearly explains the update (bump actions/checkout from v4.2.2 to v7.0.1). The pinned commit SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 was verified to match refs/tags/v7.0.1 of actions/checkout. Human approval is still required for protected-path changes regardless of context.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:37 AM UTC · Completed 5:41 AM UTC

Commit: e8f0a9f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $1.58

[jsmid1]

lgtm

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Single-line digest+version bump of actions/checkout in .github/workflows/validate-docs.yaml by Renovate bot; CI_WORKFLOW_CHANGED and PROTECTED_PATH_COUNT=1 elevate above low, but trivial diff size and routine bot pattern keep it below elevated.