From e0a417e05c6ecb2f0c4fae203f70ee2bc6f78025 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:26:08 +0000
Subject: [PATCH] ci: bump actions/checkout from 7.0.0 to 7.0.1

Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/attest-release.yml            | 2 +-
 .github/workflows/catalog-check.yml             | 2 +-
 .github/workflows/engine-tests.yml              | 2 +-
 .github/workflows/pin-check.yml                 | 2 +-
 .github/workflows/plugin-catalog-update-hub.yml | 6 +++---
 .github/workflows/reusable-actionlint.yml       | 2 +-
 .github/workflows/reusable-checkov.yml          | 2 +-
 .github/workflows/reusable-cosign-sign.yml      | 2 +-
 .github/workflows/reusable-k6.yml               | 2 +-
 .github/workflows/reusable-manifest-review.yml  | 2 +-
 .github/workflows/reusable-sast-codeql.yml      | 2 +-
 .github/workflows/reusable-sca-osv.yml          | 4 ++--
 .github/workflows/reusable-scorecard.yml        | 2 +-
 .github/workflows/reusable-secrets.yml          | 2 +-
 .github/workflows/reusable-semgrep.yml          | 2 +-
 .github/workflows/reusable-shellcheck.yml       | 2 +-
 .github/workflows/reusable-trivy.yml            | 2 +-
 .github/workflows/reusable-vex.yml              | 2 +-
 18 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/attest-release.yml b/.github/workflows/attest-release.yml
index 31afeca..7e72d3e 100644
--- a/.github/workflows/attest-release.yml
+++ b/.github/workflows/attest-release.yml
@@ -49,7 +49,7 @@ jobs:
           echo "version=${TAG#v}" >>"${GITHUB_OUTPUT}"
 
       - name: Checkout at the tag
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
diff --git a/.github/workflows/catalog-check.yml b/.github/workflows/catalog-check.yml
index 9c4c4b3..80b4949 100644
--- a/.github/workflows/catalog-check.yml
+++ b/.github/workflows/catalog-check.yml
@@ -27,7 +27,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Catalog and workflows are in sync
         run: |
diff --git a/.github/workflows/engine-tests.yml b/.github/workflows/engine-tests.yml
index 9f4645c..632217c 100644
--- a/.github/workflows/engine-tests.yml
+++ b/.github/workflows/engine-tests.yml
@@ -25,7 +25,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Lint + unit-test the engine
         working-directory: .github/actions/plugin-catalog-update
diff --git a/.github/workflows/pin-check.yml b/.github/workflows/pin-check.yml
index 160eac0..b935e38 100644
--- a/.github/workflows/pin-check.yml
+++ b/.github/workflows/pin-check.yml
@@ -32,7 +32,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Assert every `uses:` is pinned to a 40-char commit SHA
         env:
           SCAN_DIR: ${{ inputs.scan-dir }}
diff --git a/.github/workflows/plugin-catalog-update-hub.yml b/.github/workflows/plugin-catalog-update-hub.yml
index 1cfe0f8..8b14ea7 100644
--- a/.github/workflows/plugin-catalog-update-hub.yml
+++ b/.github/workflows/plugin-catalog-update-hub.yml
@@ -39,7 +39,7 @@ jobs:
       has-targets: ${{ steps.build.outputs.has-targets }}
     steps:
       - name: Checkout (.github — for the deny-list)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Mint installation token (enumerate accessible repos)
         id: token
@@ -116,14 +116,14 @@ jobs:
           repositories: ${{ matrix.name }}
 
       - name: Checkout target marketplace
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ matrix.repo }}
           token: ${{ steps.token.outputs.token }}
           fetch-depth: 0
 
       - name: Checkout updater action (.github)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: .updater
           sparse-checkout: .github/actions/plugin-catalog-update
diff --git a/.github/workflows/reusable-actionlint.yml b/.github/workflows/reusable-actionlint.yml
index 6612def..6627187 100644
--- a/.github/workflows/reusable-actionlint.yml
+++ b/.github/workflows/reusable-actionlint.yml
@@ -53,7 +53,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Install actionlint (pinned + checksum-verified, fail-closed)
         env:
           VERSION: ${{ inputs.version }}
diff --git a/.github/workflows/reusable-checkov.yml b/.github/workflows/reusable-checkov.yml
index 2c25138..ea17f23 100644
--- a/.github/workflows/reusable-checkov.yml
+++ b/.github/workflows/reusable-checkov.yml
@@ -67,7 +67,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Install Checkov from PyPI at an exact pinned version into an isolated
       # virtualenv — no setup-python or third-party action needed. The venv keeps
diff --git a/.github/workflows/reusable-cosign-sign.yml b/.github/workflows/reusable-cosign-sign.yml
index 2c64f15..d979063 100644
--- a/.github/workflows/reusable-cosign-sign.yml
+++ b/.github/workflows/reusable-cosign-sign.yml
@@ -60,7 +60,7 @@ jobs:
       identity: ${{ steps.sign.outputs.identity }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
diff --git a/.github/workflows/reusable-k6.yml b/.github/workflows/reusable-k6.yml
index 9924fff..ddc71d7 100644
--- a/.github/workflows/reusable-k6.yml
+++ b/.github/workflows/reusable-k6.yml
@@ -60,7 +60,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Fail fast before the load run: attest=true with no subject would
       # otherwise silently skip the attestation and still report success.
diff --git a/.github/workflows/reusable-manifest-review.yml b/.github/workflows/reusable-manifest-review.yml
index 0891834..a22c618 100644
--- a/.github/workflows/reusable-manifest-review.yml
+++ b/.github/workflows/reusable-manifest-review.yml
@@ -53,7 +53,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Review manifests → SARIF (soft-fail)
         env:
diff --git a/.github/workflows/reusable-sast-codeql.yml b/.github/workflows/reusable-sast-codeql.yml
index e88bee3..c7b130a 100644
--- a/.github/workflows/reusable-sast-codeql.yml
+++ b/.github/workflows/reusable-sast-codeql.yml
@@ -68,7 +68,7 @@ jobs:
       packages: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
diff --git a/.github/workflows/reusable-sca-osv.yml b/.github/workflows/reusable-sca-osv.yml
index 1684739..7180dbc 100644
--- a/.github/workflows/reusable-sca-osv.yml
+++ b/.github/workflows/reusable-sca-osv.yml
@@ -67,7 +67,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Run OSV-Scanner
@@ -108,7 +108,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Dependency review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
diff --git a/.github/workflows/reusable-scorecard.yml b/.github/workflows/reusable-scorecard.yml
index b59af3e..6c828b8 100644
--- a/.github/workflows/reusable-scorecard.yml
+++ b/.github/workflows/reusable-scorecard.yml
@@ -51,7 +51,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-secrets.yml b/.github/workflows/reusable-secrets.yml
index 6400309..ab534f1 100644
--- a/.github/workflows/reusable-secrets.yml
+++ b/.github/workflows/reusable-secrets.yml
@@ -65,7 +65,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Gitleaks + TruffleHog (checksum-verified)
         env:
diff --git a/.github/workflows/reusable-semgrep.yml b/.github/workflows/reusable-semgrep.yml
index 9b0a988..7baf8d4 100644
--- a/.github/workflows/reusable-semgrep.yml
+++ b/.github/workflows/reusable-semgrep.yml
@@ -66,7 +66,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Semgrep (pinned)
         env:
diff --git a/.github/workflows/reusable-shellcheck.yml b/.github/workflows/reusable-shellcheck.yml
index 8a3b201..dbd4c11 100644
--- a/.github/workflows/reusable-shellcheck.yml
+++ b/.github/workflows/reusable-shellcheck.yml
@@ -48,7 +48,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/reusable-trivy.yml b/.github/workflows/reusable-trivy.yml
index 8e5ee8d..1e746e2 100644
--- a/.github/workflows/reusable-trivy.yml
+++ b/.github/workflows/reusable-trivy.yml
@@ -72,7 +72,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Trivy IaC + license scan (filesystem)
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
diff --git a/.github/workflows/reusable-vex.yml b/.github/workflows/reusable-vex.yml
index cd0839e..fdc8c02 100644
--- a/.github/workflows/reusable-vex.yml
+++ b/.github/workflows/reusable-vex.yml
@@ -61,7 +61,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0