ci: pin actions/checkout to v7 SHA (no persisted credentials)

[Skiipy11]

Summary

Supersedes Renovate #3.

• actions/checkout → v7 full commit SHA
• persist-credentials: false (resolves blocking CodeRabbit thread on chore(deps): update actions/checkout action to v7 #3)
• pins existing actions/setup-python@v5 to its release SHA so the workflow stays SHA-pinned (no version bump)

Path gate

Only .github/workflows/ci.yml.

Test plan

• verify green
• path gate

Summary by CodeRabbit

• Chores
  • Updated continuous integration tooling to use fixed action versions for more predictable builds.
  • Disabled automatic credential persistence during source checkout to improve security.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 20c44af5-90e9-4a9c-96e9-af3e467912d2

📥 Commits

Reviewing files that changed from the base of the PR and between 9e045e0 and 5ab60e3.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

The CI verify job now pins its checkout and Python setup actions to commit SHAs and disables credential persistence for the checkout step.

Changes

CI workflow hardening

Layer / File(s)	Summary
Pin verify job actions .github/workflows/ci.yml	The verify job pins actions/checkout and actions/setup-python to commit SHAs and sets persist-credentials: false for checkout.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• ZenSystemAI/ZenVox#1: Added the CI workflow that this change refines.
• ZenSystemAI/ZenVox#3: Also updates the actions/checkout reference in the verify job.
• ZenSystemAI/ZenVox#4: Also changes the actions/setup-python version in the CI workflow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: pinning actions/checkout and disabling persisted credentials.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch steward/actions-checkout-v7

---

_{Comment @coderabbitai help to get the list of available commands.}