build(deps): Bump actions/checkout from 7.0.0 to 7.0.1

[dependabot]

Bumps actions/checkout from 7.0.0 to 7.0.1.

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[hermes-exosphere]

Automated code review started - full review. Results will be posted here.

[hermes-exosphere]

⏳ Phase 0-1 complete: Fetched all comments (0 review threads, 0 inline comments, 1 start message). PR metadata collected. Dependabot bump: actions/checkout v7.0.0 → v7.0.1 across 7 workflow files.

[hermes-exosphere]

⏳ Phase 2-3 complete: Deep analysis done. The bump is a patch version with internal fixes only (branch whitespace trimming, value escaping, dependency updates). SHA 3d3c42e verified against the v7.0.1 tag. CI: 8/8 code checks passing, OSV-Scanner pre-existing failure is unrelated. No breaking changes. All 12 occurrences across 7 files consistently updated.

[hermes-exosphere]

Automated Code Review

Executive Summary

Dependabot patch bump: actions/checkout v7.0.0 to v7.0.1 across all 7 GitHub Actions workflow files in the repo (12 occurrences). This is a routine dependency update with no breaking changes — the v7.0.1 release contains only internal fixes (branch whitespace trimming, --unset value escaping, unsafe PR check optimization, and dependency updates). CI is green across all app-level checks. Ready to merge.

---

Change Architecture

actions/checkout@v7.0.0 (SHA: 9c091bb)
  |
  | bump to
  v
actions/checkout@v7.0.1 (SHA: 3d3c42e) [NEW]
  |
  +-- ci.yml (5 uses)
  +-- translate-docs.yml (2 uses)
  +-- build-image.yml (1 use)
  +-- bump-platform-submodule.yml (1 use)
  +-- integration-suite.yml (1 use)
  +-- osv-scanner.yml (1 use)
  +-- publish.yml (1 use)

---

Breaking Changes

[PASS] No breaking changes detected. The v7.0.0 to v7.0.1 diff is patch-level only:

• Skip running unsafe PR check if input is default (optimization)
• Trim only ASCII whitespace for branch names (edge case fix)
• Escape values passed to --unset (correctness fix)
• Various dependency updates

No input contract changes. All with: parameters used in this repo (persist-credentials, fetch-depth, token, repository, ref, submodules) are unchanged.

---

Issues Found

No issues found. The bump is clean, consistent, and complete:

• SHA verification: 3d3c42e confirmed as the tag object for v7.0.1 on actions/checkout [OK]
• Completeness: All 12 occurrences across 7 files updated; no missed references [OK]
• Consistency: Both SHA-pinned and version-tagged references updated correctly [OK]
• Side benefit: bump-platform-submodule.yml was using the floating @v7 major tag; Dependabot pinned it to @v7.0.1, which is a security hardening (no more silently picking up future v7.x changes) [OK]

---

Logical / Bug Analysis

• No race conditions — workflow file changes are declarative; no runtime logic affected
• No null/undefined issues — no code-level changes
• No error handling gaps — no new error paths introduced
• No async issues — declarative YAML only
• No resource leaks — no stateful operations affected

---

Evidence — Build & Test Results

CI Results (all app-level checks):

build:                    [PASS] success
quality:                  [PASS] success
test (default):           [PASS] success
test (log-debug, debug):  [PASS] success
test (hook-log-file, 1):  [PASS] success
test-e2e:                 [PASS] success
docs:                     [PASS] success
Socket Security (alerts): [PASS] success
Socket Security (report): [PASS] success
OSV-Scanner:              [FAIL] pre-existing failure — affects all dependabot PRs
Mintlify Deployment:      [SKIP] skipped (not relevant for this branch)

The OSV-Scanner failure is a known pre-existing issue on the Supply Chain workflow that fails across multiple Dependabot PRs — not caused by this bump. All 8 code/build/test checks pass.

---

Issue Linkage

[WARN] No issue linked. This is a routine Dependabot automated bump — no corresponding issue is expected.

---

Human Review Feedback

No human review comments on this PR. The only comment is the automated review-start marker.

---

Suggestions

No substantial suggestions. One minor observation:

• Inconsistency in pinning style across bump-platform-submodule.yml: This PR changes @v7 to @v7.0.1. The same file also uses actions/create-github-app-token@v3 (floating major tag). Consider whether the app-token action should also be pinned to an exact patch version for supply-chain consistency. This is cosmetic and does not block merging.

---

Verdict

VERDICT: APPROVED

---

Automated code review - 2026-07-21 02:58:00 UTC

[hermes-exosphere]

Automated review: Approved. Patch bump actions/checkout v7.0.0 to v7.0.1 — no breaking changes, all 12 occurrences across 7 files updated correctly, CI green (8/8 app-level checks pass). SHA verified against the v7.0.1 tag. Ready to merge.

[hermes-exosphere]

Automated review: Approved. ✅