build(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the actions group across 1 directory

[dependabot]

Bumps the actions group with 1 update in the / directory: actions/checkout.

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Commits

• See full diff in compare view

[clawsweeper]

Codex review: needs changes before merge. Reviewed July 31, 2026, 5:39 PM ET / 21:39 UTC.

ClawSweeper review

What this changes

The branch updates two ordinary CI checkout references from actions/checkout@v7 to @v7.0.1 and advances the Pages deployment’s immutable checkout commit from v7.0.0 to v7.0.1.

Merge readiness

⛔ Blocked until real behavior proof is added - 2 items remain

Keep this PR open for a narrow correction: the Pages deployment pin advances consistently, but the two ordinary CI jobs should remain on the moving actions/checkout@v7 tag. Likely related person: Peter Steinberger, with high confidence from the commit that introduced both current workflow conventions.

Priority: P3
Reviewed head: 51c4c7b5a058bc6a2634f08af093365d91a7e029

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The Pages pin update is focused, but the CI tag regression and absence of after-fix real workflow proof keep the PR below merge-ready.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: The PR body provides release notes and the supplied check results are supplemental, but no after-fix live workflow evidence is posted. Add a redacted successful Actions run or equivalent workflow log after the correction. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The PR body provides release notes and the supplied check results are supplemental, but no after-fix live workflow evidence is posted. Add a redacted successful Actions run or equivalent workflow log after the correction. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	4 items	Current CI convention: Current main uses the moving actions/checkout@v7 tag in both ordinary CI jobs, while the Pages deployment uses a 40-character immutable commit pin with a version comment. Branch diff: The proposed branch changes both ordinary CI checkouts to @v7.0.1 and separately advances the Pages immutable SHA; only the CI tag-policy change conflicts with the current convention. Workflow provenance: Peter Steinberger introduced both current checkout references in the latest-release commit, establishing a shared recent ownership trail for the CI and Pages pinning split.
Findings	1 actionable finding	[P2] Keep ordinary CI on the moving v7 tag
Security	None	None.

How this fits together

Oracle’s GitHub Actions workflows build and test the CLI across three operating systems, run a Chromium CDP smoke, and deploy the documentation site. Ordinary CI consumes moving major action tags, while the privileged Pages deployment uses immutable action commit pins.

flowchart LR
  Source[Oracle source changes] --> CI[CI workflow]
  CI --> Checks[Build, test, and CDP checks]
  Source --> Pages[Pages deployment workflow]
  Pages --> PinnedAction[Immutable action commit]
  PinnedAction --> Docs[Published documentation site]

Loading

Before merge

• Keep ordinary CI on the moving v7 tag (P2) - The current CI workflow intentionally uses actions/checkout@v7 for both ordinary jobs, matching its other moving action major tags. Changing only these to @v7.0.1 freezes future compatible checkout fixes and creates recurring Dependabot maintenance; retain @v7 here while keeping the Pages commit-pin update.
• Resolve merge risk (P1) - Merging the two ci.yml edits would freeze ordinary CI on v7.0.1 while adjacent CI actions remain on moving major tags, creating recurring manual dependency maintenance and delaying compatible v7 checkout fixes.

Findings

• [P2] Keep ordinary CI on the moving v7 tag — .github/workflows/ci.yml:18

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow references	3 references changed across 2 workflow files	Two ordinary CI jobs and one privileged Pages deployment have distinct pinning policies, so these edits should not be treated identically.

Merge-risk options

Maintainer options:

1. Restore the CI major tag (recommended)
   Keep the Pages SHA bump but restore both ordinary CI checkouts to actions/checkout@v7, preserving the repository’s existing action-update policy.
2. Accept fixed CI patch tags
   Merge the branch as written only if maintainers intentionally want CI action patches to require recurring explicit dependency updates.
3. Pause this dependency bump
   Defer the update if the repository does not want to maintain distinct floating and patch-pinned CI action policies.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Restore the two ordinary CI checkouts to actions/checkout@v7; retain the Pages v7.0.1 immutable SHA update and rerun workflow checks.

Technical review

Best possible solution:

Retain the reviewed Pages v7.0.1 immutable commit update, but restore actions/checkout@v7 in both ordinary CI jobs so they keep receiving compatible v7 patch updates.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this dependency-maintenance change has no user-reported runtime failure, and the source diff directly establishes the workflow-policy regression.

Is this the best way to solve the issue?

No: updating the Pages immutable SHA is appropriate, but fixing ordinary CI on one patch tag is not the narrowest maintainable update because current main deliberately uses the moving major tag there.

Full review comments:

• [P2] Keep ordinary CI on the moving v7 tag — .github/workflows/ci.yml:18
  The current CI workflow intentionally uses actions/checkout@v7 for both ordinary jobs, matching its other moving action major tags. Changing only these to @v7.0.1 freezes future compatible checkout fixes and creates recurring Dependabot maintenance; retain @v7 here while keeping the Pages commit-pin update.
  Confidence: 0.97

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 68b8c51b0ee0.

Labels

Label justifications:

• P3: This is low-risk workflow dependency maintenance, but it needs a small policy-consistent correction before merge.
• merge-risk: 🚨 compatibility: The two ordinary CI jobs would stop receiving compatible v7 action patches automatically, changing established workflow behavior.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body provides release notes and the supplied check results are supplemental, but no after-fix live workflow evidence is posted. Add a redacted successful Actions run or equivalent workflow log after the correction. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Acceptance criteria:

• [P1] git diff --check.
• [P1] Review .github/workflows/ci.yml to confirm both ordinary jobs use actions/checkout@v7.
• [P1] Verify the build matrix and cdp-disconnect-proof-linux GitHub Actions checks on the corrected head.

What I checked:

• Current CI convention: Current main uses the moving actions/checkout@v7 tag in both ordinary CI jobs, while the Pages deployment uses a 40-character immutable commit pin with a version comment. (.github/workflows/ci.yml:18, 68b8c51b0ee0)
• Branch diff: The proposed branch changes both ordinary CI checkouts to @v7.0.1 and separately advances the Pages immutable SHA; only the CI tag-policy change conflicts with the current convention. (.github/workflows/ci.yml:18, 51c4c7b5a058)
• Workflow provenance: Peter Steinberger introduced both current checkout references in the latest-release commit, establishing a shared recent ownership trail for the CI and Pages pinning split. (.github/workflows/pages.yml:33, 5daa6ce8c352)
• Review continuity: The current branch head is the same commit reviewed on July 31, 2026, so the prior P2 finding remains unresolved rather than being newly discovered. (.github/workflows/ci.yml:18, 51c4c7b5a058)

Likely related people:

• Peter Steinberger: The latest-release commit introduced the current CI major-tag and Pages immutable-pin references, and it is the direct provenance for both affected workflow lines. (role: recent workflow contributor; confidence: high; commits: 5daa6ce8c352; files: .github/workflows/ci.yml, .github/workflows/pages.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Restore actions/checkout@v7 in the two ordinary CI jobs while retaining the Pages SHA update.
• Post a redacted successful Actions run or equivalent live workflow output after the correction; updating the PR body should trigger re-review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (13 earlier review cycles; latest 8 shown)

• reviewed 2026-07-31T00:01:27.420Z sha 3d63389 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T01:49:02.368Z sha 3d63389 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T05:23:27.984Z sha 3d63389 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T11:28:08.060Z sha 3d63389 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T14:27:06.602Z sha 3d63389 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T20:14:32.557Z sha 3d63389 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T20:19:17.188Z sha 3d63389 :: needs changes before merge. :: [P2] Keep CI checkout on the moving v7 tag
• reviewed 2026-07-31T20:28:09.159Z sha 51c4c7b :: needs changes before merge. :: [P2] Keep ordinary CI on the moving v7 tag