chore(deps): update actions/checkout action to v7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v6.0.3 → v7.0.1

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v7

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.1.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	4		0	0	0.16s
❌ ACTION	zizmor	4		3	0	4.03s
✅ COPYPASTE	jscpd	yes		no	no	0.76s
✅ DOCKERFILE	hadolint	1		0	0	0.15s
✅ JSON	jsonlint	3		0	0	0.09s
✅ JSON	prettier	3		0	0	1.21s
✅ JSON	v8r	3		0	0	2.29s
✅ MARKDOWN	markdownlint	1		0	0	0.44s
✅ MARKDOWN	markdown-table-formatter	1		0	0	0.2s
✅ PYTHON	bandit	1		0	0	1.55s
✅ PYTHON	black	1		0	0	0.68s
✅ PYTHON	flake8	1		0	0	0.53s
✅ PYTHON	isort	1		0	0	0.23s
✅ PYTHON	mypy	1		0	0	3.48s
✅ PYTHON	pylint	1		0	0	2.96s
✅ PYTHON	pyright	1		0	0	1.38s
✅ PYTHON	ruff	1		0	0	0.12s
✅ REPOSITORY	betterleaks	yes		no	no	1.8s
✅ REPOSITORY	checkov	yes		no	no	20.68s
✅ REPOSITORY	dustilock	yes		no	no	0.05s
✅ REPOSITORY	gitleaks	yes		no	no	0.46s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
✅ REPOSITORY	grype	yes		no	no	83.14s
✅ REPOSITORY	kingfisher	yes		no	no	10.08s
✅ REPOSITORY	osv-scanner	yes		no	no	0.15s
✅ REPOSITORY	secretlint	yes		no	no	1.16s
✅ REPOSITORY	syft	yes		no	no	2.58s
✅ REPOSITORY	trivy	yes		no	no	9.35s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.13s
✅ REPOSITORY	trufflehog	yes		no	no	3.18s
✅ YAML	prettier	7		0	0	0.57s
✅ YAML	v8r	7		0	0	5.69s
✅ YAML	yamllint	7		0	0	0.66s

Detailed Issues

❌ ACTION / zizmor - 3 errors

INFO zizmor: 🌈 zizmor v1.25.0
 INFO audit: zizmor: 🌈 completed .github/workflows/ci.yaml
 INFO audit: zizmor: 🌈 completed .github/workflows/standard-build.yaml
 INFO audit: zizmor: 🌈 completed .github/workflows/standard-lint.yaml
 INFO audit: zizmor: 🌈 completed .github/workflows/standard-release.yaml
warning[ref-version-mismatch]: action's hash pin has mismatched or missing version comment
   --> .github/workflows/standard-build.yaml:453:86
    |
453 |         uses: softprops/action-gh-release@HIDDEN_BY_MEGALINTER# v3
    |         --------------------------------------------------------------------------   ^^ points to commit 3d0d9888cb7f
    |         |
    |         is pointed to by tag v3.0.1
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#ref-version-mismatch

warning[ref-version-mismatch]: action's hash pin has mismatched or missing version comment
   --> .github/workflows/standard-build.yaml:482:86
    |
482 |         uses: softprops/action-gh-release@HIDDEN_BY_MEGALINTER# v3
    |         --------------------------------------------------------------------------   ^^ points to commit 3d0d9888cb7f
    |         |
    |         is pointed to by tag v3.0.1
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#ref-version-mismatch

3 findings (1 ignored, 2 unsafe fixes): 0 informational, 0 low, 2 medium, 0 high

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_BANDIT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,ACTION_ZIZMOR,COPYPASTE_JSCPD,DOCKERFILE_HADOLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_DUSTILOCK,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

[github-actions]

Trivy image scan report

ghcr.io/chgl/github-reusable-workflow-without-test-image:pr-255 (debian 13.5)

1 known vulnerabilities found (CRITICAL: 0 HIGH: 0 MEDIUM: 1 LOW: 0)

Show detailed table of vulnerabilities

Package	ID	Severity	Installed Version	Fixed Version
liblzma5	CVE-2026-34743	MEDIUM	5.8.1-1	5.8.1-1+deb13u1

No Misconfigurations found

Python

No Vulnerabilities found

No Misconfigurations found

[github-actions]

Trivy image scan report

ghcr.io/chgl/github-reusable-workflow-with-fixed-image-tags:v1.2.3-beta.123 (debian 13.5)

1 known vulnerabilities found (MEDIUM: 1 LOW: 0 CRITICAL: 0 HIGH: 0)

Show detailed table of vulnerabilities

Package	ID	Severity	Installed Version	Fixed Version
liblzma5	CVE-2026-34743	MEDIUM	5.8.1-1	5.8.1-1+deb13u1

No Misconfigurations found

Python

No Vulnerabilities found

No Misconfigurations found

[github-actions]

Trivy image scan report

ghcr.io/chgl/github-reusable-workflow:pr-255 (debian 13.5)

1 known vulnerabilities found (CRITICAL: 0 HIGH: 0 MEDIUM: 1 LOW: 0)

Show detailed table of vulnerabilities

Package	ID	Severity	Installed Version	Fixed Version
liblzma5	CVE-2026-34743	MEDIUM	5.8.1-1	5.8.1-1+deb13u1

No Misconfigurations found

Python

No Vulnerabilities found

No Misconfigurations found