ci(deps): bump actions/checkout from 4 to 7

.github/workflows/api-contract-check.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout PR HEAD
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/benchmarks.yml

@@ -22,7 +22,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:

.github/workflows/ci-failure-pci.yml

@@ -53,7 +53,7 @@ jobs:
 
       - name: Checkout (for pci-send)
         if: ${{ steps.app-check.outputs.skip == 'false' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           token: ${{ steps.app-token.outputs.token }}
 

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v5
@@ -106,7 +106,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v5
@@ -196,7 +196,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Notify build status via Slack
         env:

.github/workflows/clean-root.yml

@@ -12,7 +12,7 @@ jobs:
     name: clean-root
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Forbid markdown at repo root other than README.md
         run: |

.github/workflows/coverage.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:

.github/workflows/credential-rotation-reminder.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout cli repo (script source)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: nself-org/cli
           path: cli

.github/workflows/deep-qa-block.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v5

.github/workflows/deprecation-check.yml

@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 3
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0  # need full history to diff against base
 

.github/workflows/doc-sync.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/docker-publish.yml

@@ -37,7 +37,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Preflight: skip gracefully when Docker Hub secrets are absent.
       # secrets context is only valid inside a step env: block — never in job-level if:.

.github/workflows/e2e-golden-path.yml

@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go (for any CLI build steps)
         uses: actions/setup-go@v5

.github/workflows/embedded-pg-bench.yml

@@ -33,7 +33,7 @@ jobs:
           - macos-14          # Apple Silicon — primary deployment target
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:

.github/workflows/embedded-pg-matrix.yml

@@ -36,7 +36,7 @@ jobs:
           - macos-13          # Intel (darwin/amd64)
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:
@@ -68,7 +68,7 @@ jobs:
           - macos-14
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:

.github/workflows/endpoint-auth-gate.yml

@@ -28,7 +28,7 @@ jobs:
       pull-requests: write   # allows inline PR annotations
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:

.github/workflows/gitleaks.yml

@@ -12,7 +12,7 @@ jobs:
   gitleaks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Install Gitleaks

.github/workflows/go-list-updates-monthly.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v5

.github/workflows/govuln.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v5

.github/workflows/govulncheck-nightly.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v5

.github/workflows/hadolint.yml

@@ -20,7 +20,7 @@ jobs:
   hadolint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Run hadolint
         uses: hadolint/hadolint-action@v3.1.0
         with:

.github/workflows/license-audit.yml

@@ -24,7 +24,7 @@ jobs:
     name: Check Go dependency licenses
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:

.github/workflows/license-gate-unit-test.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:

.github/workflows/license-gate.yml

@@ -24,7 +24,7 @@ jobs:
     name: Go Dependency License Gate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:

.github/workflows/migration-fixture.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v5

.github/workflows/multi-arch-check.yml

@@ -32,7 +32,7 @@ jobs:
             goarch: arm64
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:

.github/workflows/nightly-registry-perf.yml

@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v4
         with:

.github/workflows/nself-first-check.yml

@@ -19,7 +19,7 @@ jobs:
   compose-header-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/ollama-pin-drift.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v5

.github/workflows/p93-soak-monitor.yml

@@ -46,7 +46,7 @@ jobs:
       HETZNER_NSELF_TOKEN: ${{ secrets.HETZNER_NSELF_TOKEN }}
       SOAK_RUN_T09: ${{ inputs.run_t09 == 'true' && '1' || '0' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install deps
         run: |

.github/workflows/perf.yml

@@ -35,7 +35,7 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0  # need full history to compare with base branch
 
@@ -222,7 +222,7 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:

.github/workflows/ping-api-deploy.yml

@@ -44,7 +44,7 @@ jobs:
     # Valid job-level `if:` (github context only — no secrets reference).
     if: github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Verify ping_api service directory exists
         run: |

.github/workflows/pre-release-gate.yml

@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0  # need full history for DENY-003 commits-since-prior-tag
 

.github/workflows/quarterly-doc-audit.yml

@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 

.github/workflows/release-dryrun.yml

@@ -55,7 +55,7 @@ jobs:
       CGO_ENABLED: 0
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -102,10 +102,10 @@ jobs:
     needs: extract-version
     steps:
       - name: Checkout CLI repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Checkout Admin repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: nself-org/admin
           path: admin-repo
@@ -172,7 +172,7 @@ jobs:
     needs: extract-version
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install syft
         uses: anchore/sbom-action/download-syft@v0

.github/workflows/release.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -298,7 +298,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/sbom.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v5

.github/workflows/sdk-coherence-check.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Read master version
         id: master