Update actions/checkout action to v7

[protocols-renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v6 → v7

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

actions/checkout (actions/checkout)

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v7

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

---

Note

Low Risk
Scope is dependency pin bumps only; checkout inputs are unchanged, though the v7 major may affect edge cases involving fork PRs on privileged triggers.

Overview
Renovate bumps pinned actions/checkout from v6 (de0fac2…) to v7 (9c091bb…) everywhere this repo checks out code.

That covers two workflows (renovatebot, docker image sanitize tests) and every composite action that first checks out Consensys/github-actions into .github-actions (docs, docker scan/push, trivy, renovatebot, slack, security scanner, etc.). Step with: blocks are unchanged; only the action ref moves.

v7 adds stricter behavior around checking out fork PRs on pull_request_target / workflow_run (per upstream release notes), which is relevant for security-sensitive workflows but should not alter normal same-repo checkouts.

^{Reviewed by Cursor Bugbot for commit 9bfaedf. Bugbot is set up for automated code reviews on this repo. Configure here.}