fix(ci): pin actions/checkout v7 for Super-linter

[duyet]

Why

Renovate opened #79 to bump actions/checkout from v6 to the v7 tag. Super-linter failed that PR. zizmor unpinned-uses rejects tag refs under the blanket pin policy, and YAML_PRETTIER failed on three of the four files. Master Lint stays green because Super-linter only checks changed files, so the same unpinned uses on master are not in the lint set until a workflow file changes.

This PR starts from current master and pins the verified v7.0.1 commit instead of the moving tag. Close #79 as superseded after this lands.

Scope

Touched files:

• .github/workflows/bash-tests.yml
• .github/workflows/pr-automation.yml
• .github/workflows/release.yml
• clickhouse/.github/workflows/sync-rules.yml

Checkout uses the SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 (v7 and v7.0.1 both resolve to it) plus persist-credentials: false. Comments name the human version, same pattern as .github/workflows/validate-plugins.yml.

Super-linter also audits every uses: in a changed file. These pins are required for green Lint on the same files:

• ludeeus/action-shellcheck@2.0.0 → 00cae500b08a931fb5698e11e79bfbd38e612a38
• bats-core/bats-action@4.0.0 → 77d6fb60505b4d0d1d73e48bd035b55074bbfb43
• softprops/action-gh-release@v3 (v3.0.3) → efb35369e0ad2afab669f228072c1b0d510eae64 with # zizmor: ignore[superfluous-actions] on the step name (verified against zizmor 1.23.1)
• peter-evans/create-pull-request@v8 (v8.1.1) → 5f6978faf089d4d20b00c7766989d076bb2fc7f1

Lint-only fixes in those files:

• Quote $GITHUB_OUTPUT (actionlint / ShellCheck SC2086)
• Move interpolations into env (template-injection)
• printf for the release-notes heading (SC2028)
• Prettier 3.8.1 on the four YAML files

Out of scope: other workflows still on checkout v4.2.2 SHAs (lint.yml, validate-plugins.yml, sync-skills.yml).

Blast Radius

CI workflows only. Jobs that check out the repo now run checkout v7.0.1 and do not persist credentials after checkout. peter-evans/create-pull-request still receives token in its own inputs. Plugin catalogs and manifests are unchanged.

Verification

• GitHub tags actions/checkout@v7 and @v7.0.1 both point at 3d3c42e5aac5ba805825da76410c181273ba90b1
• npx prettier@3.8.1 --check on the four files: pass
• Local zizmor 1.23.1 on the four files: no findings (1 ignored)
• node .cursor/skills/verify-marketplace/control-marketplace.mjs doctor --json: ok
• node .cursor/skills/verify-marketplace/control-marketplace.mjs info --json: ok, catalogs unchanged so the skill was not refreshed
• Repo CI Lint and Bash Tests on this PR are the merge gate

  

Summary by Sourcery

Harden the affected CI workflows by pinning action dependencies and resolving shell and YAML lint issues.

Bug Fixes:

• Pin GitHub Actions dependencies in the affected CI workflows to verified commit SHAs, including actions/checkout v7.0.1, to satisfy Super-linter’s security checks.

Enhancements:

• Harden workflow scripts by passing interpolated values through environment variables, quoting shell output paths, and correcting release-note formatting.

Chores:

• Apply consistent formatting and lint fixes across the updated workflow files.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: ec33173d-a729-473a-9e81-b2154d8a3ffe

📥 Commits

Reviewing files that changed from the base of the PR and between a2c28a3 and 484457c.

📒 Files selected for processing (4)

• .github/workflows/bash-tests.yml
• .github/workflows/pr-automation.yml
• .github/workflows/release.yml
• clickhouse/.github/workflows/sync-rules.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Welcome! 👋

Thank you for your first contribution to this project! We appreciate you taking the time to improve our codebase.

Next Steps

• A maintainer will review your PR shortly
• Please check for any review comments and address them
• Feel free to ask questions if anything is unclear

Contribution Guidelines

• Ensure all tests pass
• Update documentation if needed
• Keep changes focused and atomic

Thanks again for contributing! 🎉

[sourcery-ai]

Sorry @duyet, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 2 days and 5 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

Updates four CI workflows to use immutable, verified action commits—including actions/checkout v7.0.1—with checkout credentials disabled, while addressing Super-linter, ShellCheck, template-injection, and Prettier findings without changing plugin catalogs or unrelated workflows.

File-Level Changes

Change	Details	Files
Pin GitHub Actions dependencies to immutable commits and disable checkout credential persistence.	Replace checkout v6 references with the verified actions/checkout v7.0.1 SHA across all affected workflows. Add persist-credentials: false to checkout steps, while retaining explicit tokens where required by downstream actions. Pin ShellCheck, Bats, release, and pull-request actions to their verified commit SHAs to satisfy Super-linter.	.github/workflows/bash-tests.yml .github/workflows/pr-automation.yml .github/workflows/release.yml clickhouse/.github/workflows/sync-rules.yml
Resolve lint and workflow-safety findings in the changed workflows.	Quote GITHUB_OUTPUT paths to avoid shell expansion warnings. Move pull-request author data into environment variables to avoid template injection. Use printf for release-note formatting and apply Prettier YAML formatting.	.github/workflows/pr-automation.yml .github/workflows/release.yml clickhouse/.github/workflows/sync-rules.yml .github/workflows/bash-tests.yml
Preserve workflow behavior while updating formatting and release/sync configuration.	Keep multi-repository checkout and explicit GitHub token handling for rule synchronization. Normalize YAML quoting and comment formatting without changing triggers or job intent. Leave unrelated workflows and plugin catalogs unchanged.	.github/workflows/release.yml clickhouse/.github/workflows/sync-rules.yml .github/workflows/bash-tests.yml .github/workflows/pr-automation.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.