chore(deps): update actions/checkout action to v7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v4 → v7

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

v6.0.0

Compare Source

• Persist creds to a separate file by @​ericsciple in #​2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in #​2248

v5.1.0

Compare Source

v5.0.1

Compare Source

• Port v6 cleanup to v5 by @​ericsciple in #​2301

v5.0.0

Compare Source

• Update actions checkout to use node 24 by @​salmanmkc in #​2226

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[rowkav09]

Evaluation (dependabot-majors sweep, 29 Sept). Held per Rowan's rule: merge what's green, leave anything failing explained for his call. This one has a red check, so it stays open for him - but the red is now provably unrelated to this PR.

The bump itself checks out: the actions/checkout v7 tag dereferences to exactly 3d3c42e5aac5ba805825da76410c181273ba90b1 (pin verified live). Breaking-change review v4 to v7: v5/v6 moved the runtime to node24 (GitHub-hosted runners satisfy it); v7 blocks fork-PR checkout under pull_request_target/workflow_run - nowplaying does not check out fork PRs under those triggers. 24 of 25 checks green, including the full CI matrix that exercises the bumped checkout in ci.yml directly.

The one red - card-exploration - is provably not caused by this PR:

• It failed on this branch three times (two merge states), always the same way: Playwright locator.waitFor 30s timeout while exploring the downloaded moving dev ZIP. The checkout step itself runs clean, including post-job cleanup.
• Decisive control: I dispatched the same workflow on MAIN (run 36535838388), which still uses checkout v4 and downloads the same current dev ZIP. It failed identically - same locator.waitFor 30s timeout. Same failure with and without this PR's change.
• The workflow's only success was 26 Sept against an older dev build.

So the dev build (or the exploration harness's expectations of it) is what regressed, independent of the checkout version. That signal is being routed to the nowplaying lanes separately - it may indicate a real card-rendering regression in the moving dev build, or a stale harness.

Rowan's call: merge with this explained red, or hold until the card-exploration failure is understood.

[rowkav09]

Merging with the explained red - decision relayed from Rowan (29 Sept). Rationale: the control experiment proves the card-exploration failure is pre-existing on main and unrelated to this bump (identical locator.waitFor timeout on main with checkout v4 as on this branch with v7, same moving dev ZIP), so merging adds zero risk over current main. All other checks green; pin verified against the live v7 tag. The dev-build card failure is being chased separately.