actions/checkout (github-action) v6.0.3 -> v7.0.0

Risk: 🟢 Safe

The Deep Dive

Update Scope

Updates the five checkout pins in the PR diff from actions/checkout v6.0.3 at df4cb1c069e1874edd31b4311f1884172cec0e10 to actions/checkout v7.0.0 at 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0. No workflow logic or checkout inputs change in the changed workflow files, and both the v6.0.3 action metadata and v7.0.0 action metadata use node24, so this PR does not add a new runner runtime floor beyond the existing v6 requirement.

Security

Security impact is risk-reducing:

• actions/checkout v7.0.0 updates bundled runtime dependencies and removes uuid through actions/checkout PR 2459 and actions/checkout PR 2463. That resolves the v6 bundled-runtime exposure to CVE-2026-41907 / CVSS 7.5 in uuid and undici advisories through @actions/github: CVE-2026-22036 / CVSS 5.9, CVE-2026-1525 / CVSS 6.5, CVE-2026-1526 / CVSS 7.5, CVE-2026-2229 / CVSS 7.5, CVE-2026-1527 / CVSS 4.6, CVE-2026-9679 / CVSS 5.9, CVE-2026-12151 / CVSS 7.5, CVE-2026-6733 / CVSS 3.7, and CVE-2026-11525 / CVSS 3.7.
• The actions/checkout project advisories page and OSV GitHub Actions query endpoint did not identify a v7-introduced advisory for this action.

Newer Versions

• v7.0.0 is the latest entry in the actions/checkout release list, and the tag API maps both v7.0.0 and v7 to 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0; there is no newer checkout release to prefer for a v7 regression or v7-introduced CVE.

Hazards & Risks

None identified. The only workflow-facing v7 behavior change is the fork pull request checkout guard, which requires allow-unsafe-pr-checkout: true only for fork pull request code in pull_request_target or pull-request-derived workflow_run; the changed workflows use push, pull_request, workflow_dispatch, or schedule checkout paths instead.

Sources

• PR 104 changed files
• actions/checkout v7.0.0 release
• actions/checkout v6.0.3 release
• actions/checkout v6.0.3 to v7.0.0 compare
• actions/checkout v7 action metadata
• Fork PR checkout guard
• Runtime dependency update and uuid removal
• ESM and dependency migration
• actions/checkout security advisories
• GitHub Advisory GHSA-w5hq-g745-h8pq
• GitHub Advisory GHSA-vxpw-j846-p89q

🟢 Verdict: Safe

renovate:safe: this PR only retargets the checkout action pins in the workflow diff, and the local workflows do not use the privileged event contexts affected by the new fork pull request guard. The update reduces bundled runtime dependency exposure, and v7.0.0 is currently the latest checkout release.