Bump actions/checkout from 7.0.0 to 7.0.1 in the actions group

[dependabot]

Bumps the actions group with 1 update: actions/checkout.

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[netlify]

✅ Deploy Preview for dh-markpost ready!

Name	Link
🔨 Latest commit	c6af3d4
🔍 Latest deploy log	https://app.netlify.com/projects/dh-markpost/deploys/6a663fbf5948a8000882d44a
😎 Deploy Preview	https://deploy-preview-111--dh-markpost.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[grimicorn-agent]

Agent triage: no code changes needed — ready for review.

The only red check is Dependency audit (npm). This PR changes GitHub Actions workflow files only (no package.json / package-lock.json changes), so it cannot alter the npm dependency tree or npm audit results.

The audit is currently failing on main itself for the same advisories (verified today: main reports the same 23 vulnerabilities / 5 moderate, 18 high). Clearing those is out of scope for an Actions version bump and would need a separate dependency decision.

Every other check is green. Leaving unassigned and re-requesting review for merge.

[grimicorn-agent]

Agent triage: blocked pending a merge-order decision.

The failing Dependency audit (npm) check is not caused by this bump. This PR only changes files under .github/workflows/, which cannot affect an npm audit.

Diagnosis (verified by running npm ci && npm audit --audit-level=high on a clean clone):

• main currently fails the audit with 18 high / 0 critical / 5 moderate.
• 11 of the 18 high advisories cascade from a single root package, brace-expansion at <= 5.0.7 (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg), reached via both @vue/test-utils -> js-beautify -> editorconfig/glob and nuxt -> nitropack -> archiver -> archiver-utils/readdir-glob.
• A second, unrelated cluster (next, postcss, sharp) comes from geist, which declares next as an unbounded peer dependency, so npm installs a full nested copy of next that never appears in package.json.

This is already fixed elsewhere. PR #113 carries targeted overrides (brace-expansion: ^5.0.8, plus next > postcss/sharp) and its audit passes: 0 high, 0 critical.

What is needed from you: merge #113. Once it lands on main, this PR just needs main merged in and the audit goes green with no changes of its own.

Deliberately not duplicating #113's package.json overrides into this PR — three PRs each carrying the same override would conflict in package.json and package-lock.json as they merge. Applying blocked so the agent stops re-attempting this every run; remove the label once #113 is merged.