ci(github-action): update action actions/checkout (v7.0.0 → v7.0.1)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v7.0.0 → v7.0.1

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

PR Review: Update actions/checkout v7.0.0 → v7.0.1

Summary

This is a routine patch-level update to the actions/checkout GitHub Action, generated by Renovate. The change updates a pinned SHA from v7.0.0 (9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) to v7.0.1 (3d3c42e5aac5ba805825da76410c181273ba90b1) in .github/workflows/ai-pr-review.yaml.

Change Analysis

Aspect	Finding
File changed	.github/workflows/ai-pr-review.yaml
Change type	SHA pin update for actions/checkout
Lines affected	1 addition, 1 deletion
Permissions context	contents: read, pull-requests: write (limited scope)

Verification

• v7.0.1 release confirmed: Published on 2026-07-20, authored by @​aiqiaoy (actions/checkout maintainer/site admin).
• Release notes reviewed: The v7.0.1 release includes dependency bumps (github/codeql-action, actions/setup-node, docker actions) and three targeted bug fixes: skip unsafe PR check when input is default, trim only ASCII whitespace for branch names, and escape values passed to --unset. All changes are additive improvements with no breaking behavior.
• SHA alignment verified: The diff SHA (3d3c42e5aac5ba805825da76410c181273ba90b1) matches the commit tagged as v7.0.1 per GitHub API release data.
• Compare metadata: GitHub compare between v7 and v7.0.1 shows "identical" status, confirming v7.0.1 is the canonical v7 stable tag.
• CI checks: All checks passed (test, docker, 4× review, renovate/stability-days).

Standards Compliance

No repository standards file was available for this repository. The change follows standard GitHub Actions best practices:

• Uses full commit SHA pinning (not floating tags)
• Comment annotates the version (# v7.0.1)
• Single focused change with no side effects

Risk Assessment

• Risk level: Low — patch update from official GitHub-maintained action
• No risk flags triggered
• Security: No secrets, no public routes, no file serving, no database changes
• Action permissions: contents: read — minimal read-only scope for the updated action

Recommendation

Approve. This is a low-risk, automated dependency update from a trusted source (github/actions). The v7.0.1 release contains only dependency updates and small bug fixes with no behavioral changes. CI has passed successfully.