CI: bump actions/checkout to v7 (v4 targets Node.js 20, now deprecated)

[jnasbyupgrade]

GitHub Actions runners have started warning that Node.js 20 is deprecated and actions pinned to it are being forced onto Node.js 24 at runtime. actions/checkout@v4 is one of those; v7 is the current latest major and already targets Node 24 natively. anthropics/claude-code-action is already on its latest major (v1, no v2 exists yet) so it's untouched.

v7 also added a default-deny guard: it refuses to check out a fork's PR head when the trigger is pull_request_target or workflow_run (the classic "pwn request" pattern), unless allow-unsafe-pr-checkout: true is set. claude-code-review.yml's "Check out PR head" step does exactly that under pull_request_target, so it needed the explicit opt-in to keep working - already safe here per the guards documented at the top of that workflow (gated to jnasbyupgrade's own PRs, persist-credentials: false, checked-out code only ever read for review context, never built or executed). The other two checkout call sites (ci.yml x3, claude.yml) just check out this repo's own ref and needed no such change.

No local way to confirm the deprecation warning itself is gone - that only shows up in real Actions run logs, not anything checkable from a clone. Needs a real CI run on this PR to confirm.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 25cb8734-be04-490d-aa01-46f4040495a9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Claude finished @jnasbyupgrade's task in 1m 45s —— View job

---

Code Review: CI: bump actions/checkout to v7

• Gather context (PR body, diff, workflow files)
• Review ci.yml changes
• Review claude-code-review.yml changes
• Review claude.yml changes
• Post review feedback

Summary

Clean, well-scoped maintenance change. All 5 actions/checkout call sites across the 3 workflows are bumped from v4 → v7, and exactly one of them (claude-code-review.yml's "Check out PR head" step) gets the extra allow-unsafe-pr-checkout: true opt-in — correctly, since it's the only site that both runs under pull_request_target and checks out a fork's PR head (repository: ${{ github.event.pull_request.head.repo.full_name }}, ref: ${{ github.event.pull_request.head.sha }}).

I verified the other 4 sites don't need the opt-in:

• ci.yml's three checkouts run on plain pull_request/push and check out the same repo's own ref — v7's fork-checkout guard doesn't apply.
• claude.yml's checkout is triggered by issue_comment/issues/pull_request_review*, none of which are pull_request_target or workflow_run, and it also checks out the default ref (no fork override).

The added allow-unsafe-pr-checkout: true opt-in in claude-code-review.yml (lines 94-101) is justified by, and documented right next to, the pre-existing security guards on that job (.github/workflows/claude-code-review.yml:33-35): gated to jnasbyupgrade's own PRs via github.event.pull_request.user.login, persist-credentials: false, and the checked-out code is only ever read for review context, never built or executed. That reasoning matches the PR description and holds up against the actual job condition.

Notes (non-blocking)

• I don't have network access in this environment, so I couldn't independently confirm against the actual actions/checkout v7 release notes that allow-unsafe-pr-checkout is the exact real input name/behavior introduced for the fork-PR-under-pull_request_target guard. The PR description already flags that a real CI run is needed to confirm the Node 24 deprecation warning is gone — that same CI run will also prove out whether this input name/behavior is correct (if it's wrong, the "Check out PR head" step would simply fail outright, so it's a fail-fast risk, not a silent one).
• No other actions/checkout, workflow_run, or pull_request_target usages exist elsewhere in .github/workflows/ that were missed.

No bugs or security issues found; nothing to change.