ci: pin actions/checkout to v7 SHA (no persisted credentials)

[Skiipy11]

Summary

Supersedes Renovate #6.

• pin actions/checkout to v7 full SHA in ci.yml and publish.yml
• persist-credentials: false on both (CodeRabbit blocking thread on chore(deps): update actions/checkout action to v7 #6)

Path gate

Only .github/workflows/**.

Test plan

• test (20)/(22) green
• path gate

Summary by CodeRabbit

• Chores
  • Improved automation workflow security by pinning repository checkout actions to a specific revision.
  • Disabled credential persistence during automated checkout operations for CI and publish workflows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ab84667c-47ed-4d34-9c9d-09df1632b701

📥 Commits

Reviewing files that changed from the base of the PR and between 63d9411 and 92b6186.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .github/workflows/publish.yml

🚧 Files skipped from review as they are similar to previous changes (2)

• .github/workflows/ci.yml
• .github/workflows/publish.yml

---

📝 Walkthrough

Walkthrough

The CI and publish workflows replace the checkout action tag with a pinned revision and disable persisted Git credentials.

Changes

Checkout workflow updates

Layer / File(s)	Summary
Pinned checkout configuration .github/workflows/ci.yml, .github/workflows/publish.yml	Both checkout steps use a pinned actions/checkout revision and set persist-credentials: false.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• ZenSystemAI/Zengram#6: Updates the same GitHub Actions workflows and checkout action revision.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes pinning actions/checkout and disabling persisted credentials in the workflow files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch steward/actions-checkout-v7-sha

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 17-19: Fix the checkout step syntax by adding the required
sequence marker before uses in both .github/workflows/ci.yml lines 17-19 and
.github/workflows/publish.yml lines 17-19, while preserving the existing
checkout reference and persist-credentials setting.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b8d157f0-bedd-4fcc-97e2-393a48d4292f

📥 Commits

Reviewing files that changed from the base of the PR and between 991ae3d and 63d9411.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .github/workflows/publish.yml