chore(deps)(deps): bump actions/checkout from 4 to 7

.github/workflows/ci.yml

@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Run actionlint on changed workflow files
@@ -125,7 +125,7 @@ jobs:
       tauri:   ${{ steps.f.outputs.tauri }}
       scripts: ${{ steps.f.outputs.scripts }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: dorny/paths-filter@v3
       id: f
       with:
@@ -178,7 +178,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@1.88.0
       with:
         components: clippy, rustfmt
@@ -238,7 +238,7 @@ jobs:
     if: needs.should-run.outputs.run == 'true' && needs.changed.outputs.web == 'true'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: pnpm/action-setup@v4
       with:
         version: 9.15.0
@@ -262,7 +262,7 @@ jobs:
     # generate the spec from the freshly-built Cargo bin and diff
     # against the committed `schema.ts` — non-zero diff fails the job.
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@1.88.0
     - uses: rui314/setup-mold@v1
       if: runner.os == 'Linux'
@@ -303,7 +303,7 @@ jobs:
     needs: [should-run, changed, web]
     if: needs.should-run.outputs.run == 'true' && needs.changed.outputs.web == 'true'
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: pnpm/action-setup@v4
       with:
         version: 9.15.0
@@ -337,7 +337,7 @@ jobs:
     if: needs.should-run.outputs.run == 'true' && needs.changed.outputs.tray == 'true'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: pnpm/action-setup@v4
       with:
         version: 9.15.0
@@ -374,7 +374,7 @@ jobs:
     if: needs.should-run.outputs.run == 'true' && needs.changed.outputs.scripts == 'true'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: actions/setup-node@v4
       with:
         node-version: 20
@@ -390,7 +390,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@1.88.0
     - uses: rui314/setup-mold@v1
       if: runner.os == 'Linux'

.github/workflows/invariant-sentry.yml

@@ -34,7 +34,7 @@ jobs:
     name: Check invariants
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
         # Default ref (HEAD of triggering branch) is fine — we use

.github/workflows/promote.yml

@@ -100,7 +100,7 @@ jobs:
       tray:     ${{ steps.decide.outputs.tray }}
       platform: ${{ steps.decide.outputs.platform }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     # Path detection — only runs on push events. dorny/paths-filter
     # on push compares against the parent commit, which is what we
     # want (incremental detection per commit).
@@ -218,7 +218,7 @@ jobs:
         fi
 
     - name: Checkout next
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         ref: next
         fetch-depth: 0
@@ -294,7 +294,7 @@ jobs:
         fi
 
     - name: Checkout next
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         ref: next
         fetch-depth: 0
@@ -354,7 +354,7 @@ jobs:
     environment: production-release
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         fetch-depth: 0
         token: ${{ secrets.RELEASE_PROMOTE_PAT }}
@@ -421,7 +421,7 @@ jobs:
     environment: production-release
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         fetch-depth: 0
         token: ${{ secrets.RELEASE_PROMOTE_PAT }}

.github/workflows/release-images.yml

@@ -47,7 +47,7 @@ jobs:
     outputs:
       channel: ${{ steps.validate.outputs.channel }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Validate tag against branch invariants
@@ -150,7 +150,7 @@ jobs:
       )
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - uses: docker/setup-buildx-action@v3
 
@@ -244,7 +244,7 @@ jobs:
         - { image: prometheus,     context: infra/prometheus }
         - { image: db-init,        context: infra/init }
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: docker/setup-buildx-action@v3
     - name: Login to private registry
       uses: docker/login-action@v3
@@ -319,7 +319,7 @@ jobs:
     # available locally. promote.yml + release-promote.mjs annotate the
     # tag with a `Roadmap-Item: <slug>` line when the operator passes
     # `roadmap_item_slug` on workflow_dispatch.
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Resolve roadmap item slug

.github/workflows/release.yml

@@ -48,7 +48,7 @@ jobs:
       channel: ${{ steps.validate.outputs.channel }}
       bare_version: ${{ steps.validate.outputs.bare_version }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Validate tag against branch invariants
@@ -120,7 +120,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@1.88.0
     # mold cuts link time dramatically; Linux-only (no Windows build).
     - uses: rui314/setup-mold@v1
@@ -247,7 +247,7 @@ jobs:
     needs: [validate-tag, client-binaries]
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Download Tauri client artifacts
       uses: actions/download-artifact@v4
@@ -514,7 +514,7 @@ jobs:
         # auto-alpha). That's the desired behaviour: a manifest
         # commit on `next` shouldn't kick off a fresh pre-release
         # cycle, it's just bookkeeping.
-        # Deshallowing: actions/checkout@v4 defaults to depth=1, so
+        # Deshallowing: actions/checkout@v7 defaults to depth=1, so
         # the local repo has only the tag's commit. `git merge` then
         # refuses with "refusing to merge unrelated histories" because
         # it can't find the common ancestor between main and next
@@ -584,7 +584,7 @@ jobs:
     # available locally. promote.yml + release-promote.mjs annotate
     # the tag with a `Roadmap-Item: <slug>` line when the operator
     # passes `roadmap_item_slug` on workflow_dispatch.
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Resolve roadmap item slug
@@ -647,7 +647,7 @@ jobs:
     needs: [validate-tag, roadmap-emit-event]
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Resolve roadmap item slug