build(ci): upgrade Open Knowledge checkout action to v7 (#3812)

.github/workflows/bug-lane-verify.yml

@@ -116,7 +116,7 @@ jobs:
           echo "::notice::bug-lane-verify: ${FIX_REFS} over ${STABLE} (requested by ${DISPATCHED_BY:-a manual dispatch})."
 
       - name: Checkout with full history and tags
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true

.github/workflows/bug-lane.yml

@@ -79,7 +79,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout with full history and tags
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true

.github/workflows/desktop-build-win-linux.yml

@@ -65,7 +65,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -167,7 +167,7 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -331,7 +331,7 @@ jobs:
             targets: deb:arm64 rpm:arm64
             unpacked_dir: linux-arm64-unpacked
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:

.github/workflows/desktop-build.yml

@@ -79,7 +79,7 @@ jobs:
     # headroom for cold cache and notary-service queue spikes.
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Node 24 matches the existing ci.yml / release.yml pattern —
       # turbo's `^build` pulls in the app via workspace deps that resolve

.github/workflows/desktop-release.yml

@@ -183,7 +183,7 @@ jobs:
       #
       # fetch-depth: 0 — the native-config staging step's provenance check
       # (`git merge-base --is-ancestor`) needs full history.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.client_payload.ref || github.ref }}
           fetch-depth: 0
@@ -509,7 +509,7 @@ jobs:
       smoke_verdict: ${{ steps.dmg_smoke.outputs.verdict }}
       smoke_reason: ${{ steps.dmg_smoke.outputs.reason }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.client_payload.ref || github.ref }}
 
@@ -869,7 +869,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.client_payload.ref || github.ref }}
 
@@ -1092,7 +1092,7 @@ jobs:
             targets: deb:arm64 rpm:arm64
             unpacked_dir: linux-arm64-unpacked
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.client_payload.ref || github.ref }}
 
@@ -1549,7 +1549,7 @@ jobs:
       CHANNEL: ${{ needs.prepare.outputs.channel }}
       VERSION: ${{ needs.prepare.outputs.version }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Marker-delimited (`<!-- ok-downloads:start/end -->`) so re-renders are
       # idempotent and the rest of the body — the changelog and the beta
@@ -1828,7 +1828,7 @@ jobs:
       CHANNEL: ${{ needs.prepare.outputs.channel }}
     steps:
       # $GITHUB_SHA — CI tooling, not release content (see finalize's header).
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # FR5c — page the release channel when the gate refuses a stable
       # release. Without this a blocked release is silent: the Release simply

.github/workflows/linear-release.yml

@@ -136,7 +136,7 @@ jobs:
 
       - name: Checkout at the release tag
         if: env.HAS_KEY == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.client_payload.ref || inputs.release_tag }}
           # Full history + tags so the commit scan and previous-tag lookup work.

.github/workflows/monorepo-pr-bridge.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout public repo automation
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
@@ -50,7 +50,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout public repo automation
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
@@ -69,7 +69,7 @@ jobs:
           repositories: agents-private
 
       - name: Checkout agents-private
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: inkeep/agents-private
           ref: main
@@ -121,7 +121,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout public repo automation
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 

.github/workflows/native-config-prebuild.yml

@@ -82,7 +82,7 @@ jobs:
             napiFlags: ""
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
       - name: Get pnpm store directory

.github/workflows/point-release.yml

@@ -127,7 +127,7 @@ jobs:
           private-key: ${{ secrets.INTERNAL_CI_APP_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Full history AND all tags. Three separate things need it: resolving
           # the newest stable tag, diffing .changeset/*.md between that tag and

.github/workflows/promote-stable.yml

@@ -126,7 +126,7 @@ jobs:
           private-key: ${{ secrets.INTERNAL_CI_APP_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           # Persist the App token into .git/config so the later

.github/workflows/publish-linux-repo.yml

@@ -68,7 +68,7 @@ jobs:
       TAG: ${{ inputs.tag }}
       CHANNEL: ${{ inputs.channel }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download release packages
         env:

.github/workflows/release.yml

@@ -140,7 +140,7 @@ jobs:
           fi
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           # publish-stable: client_payload.ref carries the stable tag
@@ -426,7 +426,7 @@ jobs:
           # Query existing v<BASE_VERSION>-beta.N tags on this repo and
           # find the max N. `git tag --list` only sees local tags; we
           # fetched them in the checkout step (fetch-depth: 0 pulls all
-          # refs by default for actions/checkout@v6). Cross-check via
+          # refs by default for actions/checkout@v7). Cross-check via
           # `gh api` for tags created by parallel runs that pushed to
           # origin since our checkout finished — the actual collision
           # window is between this step and the `git push origin TAG`

.github/workflows/select-beta-to-promote.yml

@@ -203,7 +203,7 @@ jobs:
       # would make that impossible. Only the dispatch step below is gated, so
       # an out-of-window tick evaluates and then does nothing.
       - name: Checkout (need full tag history for beta resolution)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           # Read-only job: it resolves tags with git and talks to GitHub via a
@@ -325,7 +325,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -437,7 +437,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/share-contract-deployment-gate.yml

@@ -47,7 +47,7 @@ jobs:
             -f target_url="$RUN_URL"
 
       - name: Checkout candidate deployment SHA
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ github.event.client_payload.git.sha || github.sha }}

.github/workflows/share-contract-monitor.yml

@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/write-back.yml

@@ -82,7 +82,7 @@ jobs:
 
       - name: Checkout with full history and tags
         if: steps.tag.outputs.stable == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Tag containment is how the shipped version is derived, so every
           # stable tag and the full history behind them have to be present.