[github-actions] Bump actions/checkout Version from v6 to v7

[hayat01sh1da]

1. Overview

The primary difference between actions/checkout@v6 and actions/checkout@v7 is a critical security enforcement that blocks untrusted code execution from fork pull requests by default.

2. Key Differences Overview

• Fork Pull Request Protection (Breaking Change): v7 refuses to check out fork pull request code when a workflow is triggered by pull_request_target or workflow_run. This stops "pwn request" supply-chain attacks, where malicious actors use a fork PR to run unauthorized code with your base repository's elevated GITHUB_TOKEN and secrets.
• New Configuration Input: v7 introduces the allow-unsafe-pr-checkout flag. You must explicitly set this to true if your workflow deliberately requires checking out untrusted code from a fork under privileged triggers.
• Under-the-Hood Migration: v7 shifts the entire action to ECMAScript Modules (ESM) to accommodate newer @actions/* internal package requirements.
• Dependency & Security Patches: v7 includes major direct and transitive dependency updates to remediate known vulnerabilities.

3. Comparison of Key Features

Feature / Behavior	actions/checkout@v6	actions/checkout@v7
**	Fork checkouts on pull_request_target**	Allowed automatically (Vulnerable to exploit)
New Input: allow-unsafe-pr-checkout	Not available	Available (Defaults to false)
Internal Module System	CommonJS (CJS)	ECMAScript Modules (ESM)
Credential Persistence Strategy	Saved in $RUNNER_TEMP via includeIf	Saved in $RUNNER_TEMP via includeIf

4. References

• actions/checkout: Action for checking out a repo - GitHub
• pull_request_targetでcheckoutできなくなった - Zenn
• Safer pull_request_target defaults for GitHub Actions checkout - The GitHub Blog
• GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns - The Hacker News
• GitHub Actions checkout v7 improves security defaults - Linkedin

[hayat01sh1da]