chore(deps): update actions/checkout action to v7

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v5 → v7
actions/checkout	action	major	v6.0.1 → v7.0.1

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Various dependency updates

v7

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v6.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in #​2500
• backport fixes to releases-v6 by @​aiqiaoy in #​2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

v6.0.0

Compare Source

• Persist creds to a separate file by @​ericsciple in #​2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in #​2248

v6

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:06 PM UTC · Completed 11:14 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/checkton.yaml, .github/workflows/gitleaks.yaml, .github/workflows/hadolint.yaml, .github/workflows/run-task-tests.yaml, .github/workflows/shellcheck.yaml, .github/workflows/validate-agents-md.yaml, .github/workflows/validate-task-and-pipeline-yamls.yaml, .github/workflows/yaml-lint.yaml — All 8 changed files are under the .github/ protected path. This PR has no linked issue justifying modification of governance/infrastructure files. The change itself is a straightforward MintMaker/Renovate dependency update (actions/checkout v5/v6.0.1 → v7/v7.0.1), and no workflows use pull_request_target or workflow_run triggers affected by v7's breaking change. Human approval is required for protected-path changes.
  Remediation: A repository maintainer should review and approve these CI workflow changes. Consider linking a tracking issue for dependency update authorization.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [protected-path] .github/workflows/ — All 8 changed files are under the protected .github/ path. This PR has no linked issue authorizing changes to CI governance/infrastructure files. While the PR description identifies this as a Renovate dependency update (actions/checkout v5/v6 → v7), human approval is required for protected-path changes.
  Remediation: A human reviewer with appropriate permissions should verify and approve this CI dependency update.

Previous run (2)

Review

No blocking findings. This is a mechanical Renovate dependency bump of actions/checkout from v5/v6.0.1 to v7/v7.0.0 across all CI workflow files. The version pins (both tag and SHA-pinned references in run-task-tests.yaml) are internally consistent.

All modified files are under .github/ (protected path). The repository's renovate.json configuration (config:recommended) explicitly authorizes Renovate to manage GitHub Actions dependencies, but human approval is still required for protected-path changes.

Previous run (3)

Review

Findings

Medium

• [protected-path] .github/workflows/ — All 5 changed files are under the .github/ protected path (checkton.yaml, run-task-tests.yaml, validate-agents-md.yaml, validate-task-and-pipeline-yamls.yaml, yaml-lint.yaml). The PR description explains this is an automated dependency version bump for actions/checkout (v5/v6 → v7), which is a clear and appropriate rationale. Human approval is required for protected-path changes regardless of context.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:04 PM UTC · Completed 3:10 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:46 PM UTC · Completed 5:56 PM UTC
Commit: 37b10e4 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:20 AM UTC · Completed 3:30 AM UTC

Commit: 701e62a · View workflow run →

[fullsend-ai-review]

See the review comment for full details.