chore(deps): bump actions/checkout from 7.0.0 to 7.0.1

[dependabot]

Bumps actions/checkout from 7.0.0 to 7.0.1.

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

• Chores
  • Updated repository checkout actions used by automated workflows to version 7.0.1.
  • Applied the update across CI, coverage, publishing, release, and security workflows.

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

📝 Walkthrough

Walkthrough

The workflows update all referenced actions/checkout steps from v7.0.0 to v7.0.1 across CI, coverage, npm publishing, release, and security jobs.

Changes

Checkout action update

Layer / File(s)	Summary
Update workflow checkout pins .github/workflows/ci.yml, .github/workflows/coverage.yml, .github/workflows/npm-publish.yml, .github/workflows/release.yml, .github/workflows/security.yml	All affected checkout steps now use actions/checkout@v7.0.1, with three release jobs updated alongside the other workflows.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: microck

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description states what changed, but it omits the required template sections and checklist items.	Add the Summary, Verification, Docs, and Auth / Secrets sections from the template, including the checkbox items.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the dependency bump and matches the main change in the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Release Metadata Consistency	✅ Passed	Cargo.toml, Cargo.lock kagi entry, and npm/package.json all use 0.16.0, and CHANGELOG.md contains ## [0.16.0].

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/actions/checkout-7.0.1

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Line 23: Disable checkout credential persistence for the Checkout steps using
actions/checkout in .github/workflows/ci.yml at lines 23-23,
.github/workflows/coverage.yml at lines 21-21, and
.github/workflows/security.yml at lines 25-25 by adding with:
persist-credentials: false; no authenticated git access is required.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d1a87767-cda2-44a7-8644-b357eb02d689

📥 Commits

Reviewing files that changed from the base of the PR and between 343a3a1 and 9478d87.

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• .github/workflows/coverage.yml
• .github/workflows/npm-publish.yml
• .github/workflows/release.yml
• .github/workflows/security.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for f in .github/workflows/ci.yml .github/workflows/coverage.yml .github/workflows/security.yml; do
  echo "### $f"
  wc -l "$f"
  echo
  nl -ba "$f" | sed -n '1,220p'
  echo
done

Repository: Microck/kagi-cli

Length of output: 252

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show checkout step context and any git/auth-related steps in the workflows.
rg -n -C 3 'actions/checkout|persist-credentials|git |github.token|GITHUB_TOKEN|permissions:' .github/workflows/ci.yml .github/workflows/coverage.yml .github/workflows/security.yml

Repository: Microck/kagi-cli

Length of output: 2203

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the repository for any workflow docs or conventions around checkout credentials.
rg -n 'persist-credentials|checkout' .github README* docs* . 2>/dev/null | head -n 200

Repository: Microck/kagi-cli

Length of output: 2047

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

nl -ba .github/workflows/ci.yml | sed -n '1,140p'
echo '---'
nl -ba .github/workflows/coverage.yml | sed -n '1,120p'
echo '---'
nl -ba .github/workflows/security.yml | sed -n '1,140p'

Repository: Microck/kagi-cli

Length of output: 194

---

Sensitive Data Exposure (CWE-522): Insufficiently Protected Credentials

Disable checkout credential persistence in these non-publishing workflows. actions/checkout writes the workflow token into git config by default; add with: persist-credentials: false to the Checkout steps in .github/workflows/ci.yml#L23, .github/workflows/coverage.yml#L21, and .github/workflows/security.yml#L25 unless authenticated git access is required.

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 22-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 3 files

• .github/workflows/ci.yml#L23-L23 (this comment)
• .github/workflows/coverage.yml#L21-L21
• .github/workflows/security.yml#L25-L25

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 23, Disable checkout credential persistence
for the Checkout steps using actions/checkout in .github/workflows/ci.yml at
lines 23-23, .github/workflows/coverage.yml at lines 21-21, and
.github/workflows/security.yml at lines 25-25 by adding with:
persist-credentials: false; no authenticated git access is required.

Source: Linters/SAST tools