build(deps): bump actions/checkout from 7.0.0 to 7.0.1

[dependabot]

Bumps actions/checkout from 7.0.0 to 7.0.1.

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 25, 2026, 8:56 AM ET / 12:56 UTC.

ClawSweeper review

What this changes

This PR updates actions/checkout from v7.0.0 to v7.0.1 in nine GitHub Actions workflow files, including the SHA-pinned Pages workflow.

Merge readiness

⛔ Blocked until real behavior proof from a real setup is added - 3 items remain

Keep this PR open: its narrow, coordinated update is not yet on the supplied main base, and the remaining merge gate is real after-fix workflow evidence rather than a code correction.

Priority: P3
Reviewed head: 5312c8f668e4289ee28de107b9944d8858e01bc8

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch is coherent and narrowly scoped, but real behavior proof is still missing for this external automation PR.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: The PR provides automated check results but no contributor-supplied after-fix run, log, recording, or artifact that directly shows checkout v7.0.1 executing; add redacted live workflow evidence before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The PR provides automated check results but no contributor-supplied after-fix run, log, recording, or artifact that directly shows checkout v7.0.1 executing; add redacted live workflow evidence before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	3 items	Coordinated workflow update: The supplied PR diff updates all nine listed actions/checkout references from v7.0.0 to v7.0.1, including the pinned Pages commit reference. Current-base status: The supplied PR metadata identifies e78551f2a1c29fba8e7dfba6221998a39a3dd021 as the current main base and the Dependabot commit as an unmerged head, so the requested update is not already implemented on main. Automation validation state: The supplied check data shows analyze, deps, docker, lint, CodeQL, and secret-scan checks succeeding, while release-check and test remain in progress.
Findings	None	None.
Security	None	None.

How this fits together

GitHub Actions workflows check out the discrawl source before running CI, security scans, image builds, publishing, releases, Pages deployment, and self-hosted Crabbox work. The checkout action is the common automation entry point that supplies the repository contents to each downstream job.

flowchart LR
  A[GitHub event] --> B[Repository workflow]
  B --> C[Checkout action]
  C --> D[Repository source]
  D --> E[CI, scans, builds, and releases]

Loading

Before merge

• Resolve merge risk (P1) - Real after-fix behavior proof is not present in the PR body or discussion; passing checks are useful but do not alone satisfy the external-PR proof gate.
• Resolve merge risk (P1) - The supplied release-check and test jobs were still in progress and should finish successfully on this exact head before merge.
• Complete next step (P2) - This is a correct narrow update, but real workflow proof and completion of the two in-progress checks are contributor/maintainer validation tasks rather than a mechanical repair.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow scope	9 files changed; 13 additions, 13 deletions	The same checkout dependency is updated consistently across CI, deployment, release, scanning, reporting, and self-hosted automation.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Keep the synchronized v7.0.1 references, then attach redacted workflow output showing checkout v7.0.1 executed successfully in a representative affected job and merge after the remaining checks complete.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Keep the synchronized v7.0.1 references, then attach redacted workflow output showing checkout v7.0.1 executed successfully in a representative affected job and merge after the remaining checks complete.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a GitHub Actions dependency update, not a report of broken product behavior.

Is this the best way to solve the issue?

Yes: updating the existing checkout references in place is the narrowest maintainable path, provided the action runs are verified on the proposed head.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model internal, reasoning high; reviewed against e78551f2a1c2.

Labels

Label changes:

• add P3: This is a routine patch-level GitHub Actions dependency update with no reported user-facing regression.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR provides automated check results but no contributor-supplied after-fix run, log, recording, or artifact that directly shows checkout v7.0.1 executing; add redacted live workflow evidence before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P3: This is a routine patch-level GitHub Actions dependency update with no reported user-facing regression.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR provides automated check results but no contributor-supplied after-fix run, log, recording, or artifact that directly shows checkout v7.0.1 executing; add redacted live workflow evidence before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Acceptance criteria:

• [P1] Attach redacted output from an affected workflow showing actions/checkout@v7.0.1 executed on the PR head.
• [P1] Confirm the current-head release-check and test jobs complete successfully.

What I checked:

• Coordinated workflow update: The supplied PR diff updates all nine listed actions/checkout references from v7.0.0 to v7.0.1, including the pinned Pages commit reference. (.github/workflows/ci.yml:19, 5312c8f668e4)
• Current-base status: The supplied PR metadata identifies e78551f2a1c29fba8e7dfba6221998a39a3dd021 as the current main base and the Dependabot commit as an unmerged head, so the requested update is not already implemented on main. (.github/workflows/pages.yml:30, e78551f2a1c2)
• Automation validation state: The supplied check data shows analyze, deps, docker, lint, CodeQL, and secret-scan checks succeeding, while release-check and test remain in progress. (.github/workflows/ci.yml:1, 5312c8f668e4)

Likely related people:

• dependabot[bot]: The supplied context identifies Dependabot as the sole author of the coordinated workflow-reference update; current-main workflow history could not be inspected because read-only shell commands failed before execution. (role: dependency update author; confidence: low; commits: 5312c8f668e4; files: .github/workflows/ci.yml, .github/workflows/pages.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add redacted workflow output showing checkout v7.0.1 ran successfully in an affected job.
• Wait for the in-progress release-check and test jobs to complete successfully on the current head.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.