chore(deps): bump actions/checkout from 6 to 7

.github/workflows/blog-release.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
     name: Lint (ruff)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -35,7 +35,7 @@ jobs:
     name: Type check (mypy)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -56,7 +56,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -94,7 +94,7 @@ jobs:
     name: Smoke test (CLI --scan-only)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -125,7 +125,7 @@ jobs:
     name: Extensions — iac-scanner-cdk-nag
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -164,7 +164,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [lint, test, smoke, test-extensions]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # setuptools-scm needs the full git history to derive the version.
           fetch-depth: 0

.github/workflows/codeql.yml

@@ -31,7 +31,7 @@ jobs:
         language: ["python"]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/labels.yml

@@ -25,7 +25,7 @@ jobs:
     name: Sync from labels.yml
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Apply label config
         uses: EndBug/label-sync@v2

.github/workflows/nightly-e2e.yml

@@ -32,7 +32,7 @@ jobs:
       # Disable response cache so E2E genuinely hits the LLM
       IAC_NO_CACHE: "1"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"

.github/workflows/publish-nag-pypi.yml

@@ -43,7 +43,7 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
@@ -65,7 +65,7 @@ jobs:
     needs: [test]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"

.github/workflows/publish-pypi.yml

@@ -19,7 +19,7 @@ jobs:
     name: Build distributions
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # setuptools-scm derives the version from git tags. Without full
           # history (and unshallowed fetch), it falls back to fallback_version

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
     permissions:
       contents: write   # required to create the Release
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # need full history so the tag annotation is reachable
 

.github/workflows/scorecard.yml

@@ -31,7 +31,7 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 

.github/workflows/security.yml

@@ -22,7 +22,7 @@ jobs:
     name: SAST (bandit, ruff-S)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -40,7 +40,7 @@ jobs:
     name: Dependency audit (pip-audit)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -60,7 +60,7 @@ jobs:
     name: Secret scan (gitleaks)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Full history so gitleaks can scan all commits, not just the HEAD
           fetch-depth: 0
@@ -78,7 +78,7 @@ jobs:
     name: Self-scan (iac-scan on samples)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6