From 02bdef7e448f3997a24c79a77569e2ba6c6ec3c6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 1 Aug 2026 13:37:06 +0000
Subject: [PATCH] chore: bump the github-actions group with 2 updates

Bumps the github-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [actions/labeler](https://github.com/actions/labeler).


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

Updates `actions/labeler` from 6.2.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/b8dd2d9be0f68b860e7dae5dae7d772984eacd6d...bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/labeler
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/dupdetect-test.yml     | 2 +-
 .github/workflows/duplicate-detect.yml   | 2 +-
 .github/workflows/labeler.yml            | 2 +-
 .github/workflows/lint.yml               | 2 +-
 .github/workflows/pr-review-dispatch.yml | 4 ++--
 .github/workflows/root-test.yml          | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/dupdetect-test.yml b/.github/workflows/dupdetect-test.yml
index 9a3dce6..164bd5b 100644
--- a/.github/workflows/dupdetect-test.yml
+++ b/.github/workflows/dupdetect-test.yml
@@ -30,7 +30,7 @@ jobs:
     steps:
       # SHA-pinned per the ACTION PINNING POLICY in pr-review-dispatch.yml's
       # header (the canonical statement; lint.yml cites it the same way).
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: tools/dupdetect/go.mod
diff --git a/.github/workflows/duplicate-detect.yml b/.github/workflows/duplicate-detect.yml
index 25fd570..b0c46a3 100644
--- a/.github/workflows/duplicate-detect.yml
+++ b/.github/workflows/duplicate-detect.yml
@@ -53,7 +53,7 @@ jobs:
       # header. Worth restating the stake HERE and nowhere else: this job runs
       # under pull_request_target holding issues:write and pull-requests:write
       # on the base repo, so a moved tag would execute with those scopes.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 11d02f2..0265c92 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -25,4 +25,4 @@ jobs:
   label:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 46d21ee..eb92e8a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -33,7 +33,7 @@ jobs:
     steps:
       # SHA-pinned per the repo-wide policy documented in
       # pr-review-dispatch.yml's header.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/pr-review-dispatch.yml b/.github/workflows/pr-review-dispatch.yml
index ed28bb7..9900bb6 100644
--- a/.github/workflows/pr-review-dispatch.yml
+++ b/.github/workflows/pr-review-dispatch.yml
@@ -94,7 +94,7 @@ jobs:
       - name: Check out workflow scripts
         # Checks out the default branch (the privileged ref this workflow
         # already runs as), NOT the PR head. Only `.github/scripts` is used.
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -188,7 +188,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Check out workflow scripts
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/root-test.yml b/.github/workflows/root-test.yml
index 8bbee66..ae04566 100644
--- a/.github/workflows/root-test.yml
+++ b/.github/workflows/root-test.yml
@@ -72,7 +72,7 @@ jobs:
     steps:
       # SHA-pinned per the ACTION PINNING POLICY in pr-review-dispatch.yml's
       # header (the canonical statement; lint.yml cites it the same way).
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod