chore(deps): update github-actions (major)

.github/actions/ai-pr-review/action.yml

@@ -72,7 +72,7 @@ runs:
     # (script 2>/dev/null || rm -f CLAUDE.md) on every run.
     - name: Checkout PR head
       if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'anthropic'
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         fetch-depth: 0
@@ -131,7 +131,7 @@ runs:
     # root, and clobbering it breaks GitHub's late-stage action resolution.
     - name: Checkout PR head (openai)
       if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'openai'
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         fetch-depth: 0

.github/actions/ci-notify-nightly-tests/action.yml

@@ -30,35 +30,51 @@ inputs:
 runs:
   using: "composite"
   steps:
+    # Built with jq rather than an inline YAML payload: test_results and
+    # failed_tests are usually multi-line, and slack-github-action v4 rejects
+    # unindented continuation lines.
+    - name: Build Slack payload
+      shell: bash
+      env:
+        STATUS: ${{ inputs.status }}
+        SOURCE_REPO: ${{ inputs.source_repo }}
+        RUN_ID: ${{ inputs.run_id }}
+        RUN_NUMBER: ${{ inputs.run_number }}
+        TEST_RESULTS: ${{ inputs.test_results }}
+        FAILED_TESTS: ${{ inputs.failed_tests }}
+        PAYLOAD_FILE: ${{ runner.temp }}/ci-notify-nightly-tests-payload.json
+      run: |
+        title="Nightly E2E Tests: ❌ Failure"
+        if [[ "$STATUS" == "success" ]]; then
+          title="Nightly E2E Tests: ✅ Success"
+        fi
+        jq -n \
+          --arg title "$title" \
+          --arg repo "$SOURCE_REPO" \
+          --arg run_id "$RUN_ID" \
+          --arg run_number "$RUN_NUMBER" \
+          --arg results "$TEST_RESULTS" \
+          --arg failed "$FAILED_TESTS" \
+          '{
+            text: $title,
+            blocks: [
+              { type: "header", text: { type: "plain_text", text: $title, emoji: false } },
+              { type: "section", fields: [
+                { type: "mrkdwn", text: "*Repository:*\n\($repo)" },
+                { type: "mrkdwn", text: "*Run:*\n#\($run_number)" }
+              ] },
+              { type: "section", text: { type: "mrkdwn", text: "*Test Results:*\n\($results)" } },
+              { type: "section", text: { type: "mrkdwn", text: "*Failed tests:*\n\($failed)" } },
+              { type: "context", elements: [
+                { type: "mrkdwn", text: "<https://github.com/\($repo)/actions/runs/\($run_id)|View Run Details>" }
+              ] }
+            ]
+          }' > "$PAYLOAD_FILE"
+
     - name: Post E2E test results notification
-      uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c  # v3.0.3
+      uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d  # v4.0.0
       with:
         errors: true
         webhook-type: incoming-webhook
         webhook: ${{ inputs.webhook_url }}
-        payload: |
-          text: "Nightly E2E Tests: ${{ inputs.status == 'success' && '✅ Success' || '❌ Failure' }}"
-          blocks:
-            - type: header
-              text:
-                type: plain_text
-                text: "Nightly E2E Tests: ${{ inputs.status == 'success' && '✅ Success' || '❌ Failure' }}"
-                emoji: false
-            - type: section
-              fields:
-                - type: mrkdwn
-                  text: "*Repository:*\n${{ inputs.source_repo }}"
-                - type: mrkdwn
-                  text: "*Run:*\n#${{ inputs.run_number }}"
-            - type: section
-              text:
-                type: mrkdwn
-                text: "*Test Results:*\n${{ inputs.test_results }}"
-            - type: section
-              text:
-                type: mrkdwn
-                text: "*Failed tests:*\n${{ inputs.failed_tests }}"
-            - type: context
-              elements:
-                - type: mrkdwn
-                  text: "<https://github.com/${{ inputs.source_repo }}/actions/runs/${{ inputs.run_id }}|View Run Details>"
+        payload-file-path: ${{ runner.temp }}/ci-notify-nightly-tests-payload.json

.github/actions/ci-test-notify/action.yml

@@ -49,7 +49,7 @@ runs:
 
     - name: Send Slack notification
       if: steps.gate.outputs.notify == 'true'
-      uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+      uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
       with:
         errors: true
         webhook-type: incoming-webhook

.github/actions/go-licenses/action.yml

@@ -90,7 +90,7 @@ runs:
       run: git config --global "url.https://${GH_ACCESS_TOKEN}@github.com/.insteadOf" https://github.com/
 
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version-file: ${{ inputs.go-version-file }}
 

.github/actions/govulncheck/action.yml

@@ -63,7 +63,7 @@ runs:
         git config --global url."https://${GH_ACCESS_TOKEN}@github.com/".insteadOf "https://github.com/"
 
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version-file: ${{ inputs.go-version-file }}
 

.github/actions/linear-pr-commenter/action.yml

@@ -22,12 +22,12 @@ runs:
   using: 'composite'
   steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
       with:
         go-version-file: ${{ github.action_path }}/src/go.mod
 

.github/actions/link-backport-prs/action.yml

@@ -40,7 +40,7 @@ runs:
   using: 'composite'
   steps:
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version-file: ${{ github.action_path }}/src/go.mod
 

.github/actions/prerelease-setup/action.yml

@@ -43,20 +43,20 @@ runs:
   using: 'composite'
   steps:
     - name: Free disk space
-      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6 # v2.0.0
       with:
         tool-cache: false
 
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         # The test code only reads from the working tree (go build, ginkgo
         # discovery). No subsequent push/fetch needs the embedded token, so
         # we drop it from the .git/config to satisfy zizmor[artipacked].
         persist-credentials: false
 
     - name: Setup Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version-file: go.mod
         cache: true

.github/actions/release-notification/action.yml

@@ -108,7 +108,7 @@ runs:
       run: bash "${{ github.action_path }}/resolve-release-text.sh"
     - name: Post release notification
       if: inputs.status == 'success' && inputs.dry-run != 'true'
-      uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c  # v3.0.3
+      uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d  # v4.0.0
       with:
         errors: true
         webhook-type: incoming-webhook
@@ -166,7 +166,7 @@ runs:
         esac
     - name: Post release failure notification
       if: inputs.status != 'success' && inputs.dry-run != 'true'
-      uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c  # v3.0.3
+      uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d  # v4.0.0
       with:
         errors: true
         webhook-type: incoming-webhook

.github/workflows/actionlint.yaml

@@ -20,7 +20,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout # zizmor: ignore[artipacked] -- reviewdog needs git credentials for local diff fallback on large PRs
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/ai-pr-review.yaml

@@ -51,7 +51,7 @@ jobs:
       issues: write
       id-token: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: loft-sh/github-actions
           ref: main

.github/workflows/auto-approve-bot-prs.yaml

@@ -60,7 +60,7 @@ jobs:
     # reporting a hard red check on caller CI.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: loft-sh/github-actions
           ref: main

.github/workflows/backport.yaml

@@ -72,7 +72,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -83,7 +83,7 @@ jobs:
       # or a job container would need it installed explicitly.
 
       - name: Backport Action
-        uses: sorenlouv/backport-github-action@9460b7102fea25466026ce806c9ebf873ac48721 # v11.0.0
+        uses: sorenlouv/backport-github-action@8a6c0381851f43f9f1fddc7303f0e9015eb57b62 # v12.0.4
         with:
           github_token: ${{ secrets.gh-access-token }} # zizmor: ignore[secrets-outside-env] -- PAT passed via workflow_call, not a repo secret
           # With legacy-split on, scope sorenlouv to the monorepo era (>= v0.37)
@@ -160,7 +160,7 @@ jobs:
         target: ${{ fromJSON(needs.legacy-classify.outputs.targets) }}
     steps:
       - name: Checkout monorepo at the merged commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Pin to the merge commit so it AND its parent (the diff base) are
           # present locally; on a pull_request_target closed event the default

.github/workflows/check-docs.yaml

@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - run: make check-docs

.github/workflows/ci.yaml

@@ -18,15 +18,15 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca  # v1.7.12
 
   zizmor:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - run: pip install zizmor==1.29.0 && zizmor .github/
@@ -35,7 +35,7 @@ jobs:
     name: Check bats jobs run their suites
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - run: make check-bats-jobs

.github/workflows/claude-code-review.yaml

@@ -25,11 +25,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
           persist-credentials: false
+          # checkout v7 refuses fork PR heads under pull_request_target. Reviewing
+          # fork PRs is the point of this job, and nothing here executes their code.
+          allow-unsafe-pr-checkout: true
 
       - name: Restore CLAUDE.md from base branch
         env:

.github/workflows/claude.yaml

@@ -20,7 +20,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/claude.yml

@@ -26,7 +26,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/cleanup-head-charts.yaml

@@ -46,7 +46,7 @@ jobs:
           # checkout against loft-sh/github-actions fails with `upload-pack:
           # not our ref`. Parse workflow_ref (owner/repo/path@ref) instead.
           echo "ref=${WORKFLOW_REF##*@}" >> "${GITHUB_OUTPUT}"
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: loft-sh/github-actions
           ref: ${{ steps.wref.outputs.ref }}

.github/workflows/conflict-check.yaml

@@ -21,7 +21,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/detect-changes.yaml

@@ -22,7 +22,7 @@ jobs:
       has_changed: ${{ steps.set-output.outputs.has_changed }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: true # paths-filter needs credentials to fetch the base commit on push events
 

.github/workflows/notify-release.yaml

@@ -94,7 +94,7 @@ jobs:
           echo "All required inputs are valid"
       - name: Checkout repository
         if: ${{ !inputs.dry-run && inputs.status == 'success' }}
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ inputs.target_repo }}
           ref: ${{ inputs.ref || github.ref }}

.github/workflows/release-linear-release-sync.yaml

@@ -17,11 +17,11 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version-file: .github/actions/linear-release-sync/src/go.mod
           cache: false

.github/workflows/test-ai-pr-review.yaml

@@ -15,7 +15,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0