ci: bump actions/checkout from 6.0.3 to 7.0.0

.github/workflows/ai-review.yml

@@ -62,7 +62,7 @@ jobs:
       # review App token and Anthropic secret. Never check out the PR head or
       # execute PR-controlled code in this job. Keep the workspace pinned to the
       # trusted base SHA and inspect the PR through GitHub APIs / gh pr diff.
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           fetch-depth: 0

.github/workflows/apps-web-check.yml

@@ -25,7 +25,7 @@ jobs:
       run:
         working-directory: apps/web
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v6

.github/workflows/broken-links.yml

@@ -40,7 +40,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6.0.3
+      uses: actions/checkout@v7.0.0
       with:
         # Ensure we get latest changes including synced docs
         ref: ${{ github.event.workflow_run.head_branch || github.ref }}

.github/workflows/build-check.yml

@@ -19,7 +19,7 @@ jobs:
     # headroom without masking real regressions.
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 
@@ -147,7 +147,7 @@ jobs:
     env:
       DATABASE_URL: postgresql://ci_runner:ci_runner_throwaway_no_secret_value@127.0.0.1:5432/adcp_test
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v6

.github/workflows/changeset-check.yml

@@ -11,7 +11,7 @@ jobs:
     # Keep the release-machinery exceptions aligned with the changeset check below.
     if: ${{ !startsWith(github.head_ref, 'changeset-release/') && !startsWith(github.head_ref, 'forward-merge/') && !startsWith(github.head_ref, 'auto/docs-v') }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -40,7 +40,7 @@ jobs:
     #   already-published version and do not represent a new package release.
     if: ${{ !startsWith(github.head_ref, 'changeset-release/') && !startsWith(github.head_ref, 'forward-merge/') && !startsWith(github.head_ref, 'auto/docs-v') }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/check-dist-links.yml

@@ -11,7 +11,7 @@ jobs:
   check-dist-links:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
 
       - name: Check for unversioned links in dist docs
         run: |

.github/workflows/check-image-alt-text.yml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0

.github/workflows/check-migration-numbers.yml

@@ -31,7 +31,7 @@ jobs:
     name: No duplicate migration numbers
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/check-schema-links.yml

@@ -13,7 +13,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 

.github/workflows/check-seo-metadata.yml

@@ -15,7 +15,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 

.github/workflows/check-testable-snippets.yml

@@ -15,7 +15,7 @@ jobs:
   check-snippets:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0  # Need full history for diff
 

.github/workflows/codeql.yml

@@ -17,7 +17,7 @@ jobs:
       actions: read
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
       - uses: github/codeql-action/init@v4
         with:
           languages: javascript-typescript

.github/workflows/deploy.yml

@@ -18,7 +18,7 @@ jobs:
     name: Preflight
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
       - name: No duplicate migration numbers
         run: |
           dupes=$(ls server/src/db/migrations/*.sql \
@@ -44,7 +44,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
 
       - name: Setup Fly CLI
         uses: superfly/flyctl-actions/setup-flyctl@1.6

.github/workflows/forward-merge-3.0.yml

@@ -46,7 +46,7 @@ jobs:
           repositories: adcp
 
       - name: Checkout main with full history
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
           ref: main

.github/workflows/ipr-agreement.yml

@@ -48,7 +48,7 @@ jobs:
           repositories: adcp
 
       - name: Checkout default branch
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
         with:
           ref: main
           fetch-depth: 1

.github/workflows/ipr-check-callable.yml

@@ -73,7 +73,7 @@ jobs:
           repositories: adcp
 
       - name: Checkout central IPR ledger
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
         with:
           repository: adcontextprotocol/adcp
           ref: main

.github/workflows/migration-smoke-test.yml

@@ -42,7 +42,7 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v6

.github/workflows/release-docs.yml

@@ -58,7 +58,7 @@ jobs:
           repositories: adcp
 
       - name: Checkout main branch
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
         with:
           ref: main
           fetch-depth: 0

.github/workflows/release.yml

@@ -40,7 +40,7 @@ jobs:
           repositories: adcp
 
       - name: Checkout Repo
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/semgrep.yml

@@ -14,7 +14,7 @@ jobs:
     name: Scan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
 
       - uses: actions/setup-python@v6
         with:

.github/workflows/training-agent-storyboards.yml

@@ -125,7 +125,7 @@ jobs:
             min_clean_storyboards: 65
             min_passing_steps: 80
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/validate-agent-context.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
       - uses: actions/setup-node@v6
         with:
           node-version: '22'

.github/workflows/validate-agent-roles-sync.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
       - uses: actions/setup-node@v6
         with:
           node-version: '22'