build(deps): bump actions/checkout from 4 to 7

.github/workflows/fuzz.yml

@@ -57,7 +57,7 @@ jobs:
       matrix:
         target: [mel_compute, normalize_text, onnx_parse, lexicon_parse]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@nightly
       - uses: Swatinem/rust-cache@v2
       - run: cargo install cargo-fuzz --locked
@@ -114,7 +114,7 @@ jobs:
     name: Sanitizers (TSan + ASan)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@nightly
         with: { components: rust-src }
       - uses: Swatinem/rust-cache@v2

.github/workflows/harden.yml

@@ -29,7 +29,7 @@ jobs:
     name: Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with: { components: rustfmt }
       # BLOCKING for ffai-mercury: that crate is now rustfmt-clean, so a
@@ -50,7 +50,7 @@ jobs:
     name: Clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with: { components: clippy }
       - uses: Swatinem/rust-cache@v2
@@ -98,7 +98,7 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       # Compile EVERY target, not just the libs. Two examples had rotted against
@@ -153,7 +153,7 @@ jobs:
     name: Supply chain (deny + audit)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       # Run cargo-deny DIRECTLY, not via cargo-deny-action@v2. The action executes
       # in a musl container that cannot resolve the toolchain this repo pins
@@ -189,7 +189,7 @@ jobs:
     name: Miri (UB interpreter)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@nightly
         with: { components: miri }
       - uses: Swatinem/rust-cache@v2
@@ -215,7 +215,7 @@ jobs:
     name: Kani (bounded proofs)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo install --locked kani-verifier && cargo kani setup
@@ -259,7 +259,7 @@ jobs:
     name: Project invariants
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v5
         with: { python-version: "3.x" }
       # Clippy checks Rust; this checks FFai. Every rule exists because an audit
@@ -270,7 +270,7 @@ jobs:
     name: Hardening tables current
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v5
         with: { python-version: "3.x" }
       # The README blocks are GENERATED from each crate's plan file. This fails the build

.github/workflows/release.yml

@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with: { fetch-depth: 0 }
       - name: Verify the tag carries a signature
         run: |
@@ -63,7 +63,7 @@ jobs:
     name: SBOM (CycloneDX)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo install cargo-cyclonedx --locked
@@ -94,7 +94,7 @@ jobs:
           - { os: windows-latest, target: x86_64-pc-windows-msvc }
           - { os: macos-latest,   target: aarch64-apple-darwin }
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with: { targets: "${{ matrix.target }}" }
       - uses: Swatinem/rust-cache@v2
@@ -163,7 +163,7 @@ jobs:
       id-token: write        # OIDC, for provenance signing
       attestations: write    # record the attestation
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/download-artifact@v4
         with: { path: dist }
       - run: find dist -type f | sort