chore(deps): bump the github-actions group with 2 updates

.github/workflows/backend-image-smoke.yml

@@ -75,7 +75,7 @@ jobs:
       COMPOSE_PROJECT_NAME: trinity-smoke
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Generate boot secrets (.env)
         # docker-compose.prod.yml fails to render unless ADMIN_PASSWORD,

.github/workflows/backend-unit-nightly.yml

@@ -82,7 +82,7 @@ jobs:
       matrix: ${{ fromJSON(needs.discover.outputs.matrix) }}
     steps:
       - name: Checkout origin/dev (no PR creds)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: dev
           fetch-depth: 1

.github/workflows/backend-unit-test.yml

@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -64,7 +64,7 @@ jobs:
         seed: [12345, 67890, 99999]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # `pull_request` checks out the synthetic merge commit by default.
           # We capture the diff script before any branch switch so it
@@ -132,7 +132,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/build-without-submodule.yml

@@ -43,7 +43,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout WITHOUT submodules
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: false  # explicit — the whole point of this job
           fetch-depth: 1

.github/workflows/codeql.yml

@@ -29,7 +29,7 @@ jobs:
         language: [python, javascript-typescript]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/container-security.yml

@@ -58,7 +58,7 @@ jobs:
     timeout-minutes: 20
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0  # need base history to diff the PR's changed paths
 

.github/workflows/enterprise-docs-guard.yml

@@ -31,7 +31,7 @@ jobs:
   guard:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Scan live public docs for enterprise disclosure
         run: |
           set -uo pipefail

.github/workflows/frontend-build.yml

@@ -18,7 +18,7 @@ jobs:
       run:
         working-directory: src/frontend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:

.github/workflows/frontend-e2e.yml

@@ -18,7 +18,7 @@ jobs:
         working-directory: src/frontend
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -30,7 +30,7 @@ jobs:
         run: npm ci
 
       - name: Cache Playwright browsers
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-${{ hashFiles('src/frontend/package-lock.json') }}

.github/workflows/publish-cli.yml

@@ -23,7 +23,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Need full history for tag detection
 
@@ -107,7 +107,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Wait for PyPI availability
         run: |

.github/workflows/schema-parity.yml

@@ -38,7 +38,7 @@ jobs:
   schema-parity:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0  # need base history to diff the PR's changed paths
 

.github/workflows/sync-docs-to-vertex.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Authenticate to Google Cloud
         # SHA-pinned to mitigate supply-chain hijack of the v2 floating tag.