build(deps): bump GitHub Actions across workflows

[Liohtml]

Summary

Consolidates the four open Dependabot PRs (#129, #130, #131, #132) into a single change so all GitHub Actions bumps land together. Once merged, Dependabot will close the four original PRs automatically.

Closes #129, closes #130, closes #131, closes #132

Changes

• Bump actions/checkout v6 → v7 in ci.yml and codeql.yml, and v4 → v7 in release.yml (build(deps): Bump actions/checkout from 4 to 7 #131)
• Bump codecov/codecov-action v6 → v7 in ci.yml (build(deps): Bump codecov/codecov-action from 6 to 7 #130)
• Bump github/codeql-action/init and github/codeql-action/analyze 4.36.3 → 4.37.0 (pinned SHA 99df26d) in codeql.yml (build(deps): Bump github/codeql-action/init from 4.36.3 to 4.37.0 #132, build(deps): Bump github/codeql-action/analyze from 4.36.3 to 4.37.0 #129) — merging both bumps together keeps init and analyze on the same version

Testing

• Existing tests pass (uv run pytest) — all 13 CI checks were green on the Dependabot PRs for checkout v7 (build(deps): Bump actions/checkout from 4 to 7 #131) and codecov v7 (build(deps): Bump codecov/codecov-action from 6 to 7 #130), including the full test matrix and the Codecov upload
• New tests added for new functionality — n/a, workflow-only change
• Coverage does not decrease — no source changes
• Linting passes — no source changes
• Type checking passes — no source changes
• Pre-commit hooks pass — not run; workflow-only change

Additional Notes

The CodeQL bumps are pinned-SHA updates within the v4 major line, so no config changes are needed. The codecov-action v7 upload was verified working with the existing file:/token: inputs on PR #130. No breaking changes expected; CI on this PR will confirm.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W4svt5QTs4WUMSy4HwiVt9

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Updated automated build, test, security scanning, and release workflows to use newer action versions.
  • Maintained existing testing, coverage, packaging, and publishing behavior.
  • Improved workflow maintenance and compatibility without changing user-facing functionality.

[coderabbitai]

📝 Walkthrough

Walkthrough

GitHub Actions workflows update checkout, CodeQL, and Codecov action versions across CI, security analysis, build, and Docker release jobs. Existing commands, language configuration, job structure, and release logic remain unchanged.

Changes

GitHub Actions dependency updates

Layer / File(s)	Summary
CI validation and coverage updates .github/workflows/ci.yml	Lint, type-check, security, and matrix test jobs use actions/checkout@v7; coverage upload uses codecov/codecov-action@v7 while test commands remain unchanged.
CodeQL action updates .github/workflows/codeql.yml	The analysis workflow updates checkout and repins CodeQL initialization and analysis actions while retaining Python configuration.
Release workflow checkout updates .github/workflows/release.yml	Build and Docker jobs replace actions/checkout@v4 with actions/checkout@v7.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• Liohtml/RUSTScrapling#67 — Covers the same actions/checkout v7 upgrade pattern in GitHub Actions workflows.

Possibly related PRs

• Liohtml/MedCheck#2 — Updates actions/checkout references in overlapping CI and CodeQL workflows.
• Liohtml/MedCheck#8 — Updates action versions in the same CI and CodeQL workflow areas.

Suggested labels: dependencies, github_actions

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the workflow dependency bumps across the PR.
Description check	✅ Passed	The PR description follows the template with Summary, Changes, Testing, and Additional Notes sections filled in.
Linked Issues check	✅ Passed	The workflow updates match the linked issues: checkout v7, codecov-action v7, and CodeQL init/analyze 4.37.0.
Out of Scope Changes check	✅ Passed	All changes are limited to workflow dependency bumps and stay within the linked issue scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/dependabot-prs-q6u94z

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

🧹 Nitpick comments (3)

.github/workflows/codeql.yml (1)

15-15: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Set persist-credentials: false on the checkout step.

zizmor flags this checkout for the "artipacked" credential-persistence risk. The CodeQL analysis job does not perform git operations after checkout, so persisting the GITHUB_TOKEN in .git/config is unnecessary and increases attack surface.

🔒️ Proposed fix

       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codeql.yml at line 15, Update the checkout step using
actions/checkout@v7 to set persist-credentials: false, preventing unnecessary
GITHUB_TOKEN persistence for the CodeQL job.

Source: Linters/SAST tools

.github/workflows/release.yml (1)

30-30: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Set persist-credentials: false on both checkout steps.

zizmor flags both actions/checkout steps for the "artipacked" credential-persistence risk. Neither the build job (tag verification, package building) nor the docker job (Docker build & push) performs git operations after checkout, so persisting credentials is unnecessary.

🔒️ Proposed fix

Apply to both checkout steps (lines 30 and 82):

       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false

Also applies to: 82-82

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml at line 30, Disable credential persistence on
both actions/checkout steps by adding persist-credentials: false to the checkout
configuration in the build and docker jobs; locate the steps by their
actions/checkout@v7 usages.

Source: Linters/SAST tools

.github/workflows/ci.yml (1)

17-17: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Set persist-credentials: false on all checkout steps.

zizmor flags all four actions/checkout steps for the "artipacked" credential-persistence risk. By default, checkout persists the GITHUB_TOKEN in .git/config, which can be exfiltrated via artifacts or logs. None of these jobs (lint, type-check, security, test) perform git operations after checkout, so persisting credentials is unnecessary.

🔒️ Proposed fix

Apply to all four checkout steps:

       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false

Also applies to: 26-26, 34-34, 47-47

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 17, Add persist-credentials: false to every
actions/checkout step in the workflow, including the checkout steps for the
lint, type-check, security, and test jobs. Ensure all four checkout actions
explicitly disable credential persistence.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/ci.yml:
- Line 17: Add persist-credentials: false to every actions/checkout step in the
workflow, including the checkout steps for the lint, type-check, security, and
test jobs. Ensure all four checkout actions explicitly disable credential
persistence.

In @.github/workflows/codeql.yml:
- Line 15: Update the checkout step using actions/checkout@v7 to set
persist-credentials: false, preventing unnecessary GITHUB_TOKEN persistence for
the CodeQL job.

In @.github/workflows/release.yml:
- Line 30: Disable credential persistence on both actions/checkout steps by
adding persist-credentials: false to the checkout configuration in the build and
docker jobs; locate the steps by their actions/checkout@v7 usages.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7c23bc73-bdd6-4c91-b667-125a6078f581

📥 Commits

Reviewing files that changed from the base of the PR and between 419ebcd and 287d90d.

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• .github/workflows/codeql.yml
• .github/workflows/release.yml