build(deps): bump actions/checkout to v7.0.0 and github-script to v9.0.0

.github/workflows/auto-promote.yaml

@@ -152,7 +152,7 @@ jobs:
       contents: write
       actions: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/build-cli.yaml

@@ -23,7 +23,7 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
@@ -52,7 +52,7 @@ jobs:
     # install, and container teardown.
     timeout-minutes: 70
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:

.github/workflows/codeql.yml

@@ -21,7 +21,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/docs-deploy.yaml

@@ -35,7 +35,7 @@ jobs:
       run:
         working-directory: docs
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"

.github/workflows/drift-comment.yaml

@@ -42,7 +42,7 @@ jobs:
 
       - name: Post or update sticky comment
         if: steps.download.outcome == 'success'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');

.github/workflows/e2e.yaml

@@ -55,7 +55,7 @@ jobs:
     outputs:
       code: ${{ steps.compute.outputs.code }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - id: filter
         if: github.event_name == 'pull_request'
@@ -83,7 +83,7 @@ jobs:
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # workflow_dispatch: honour the explicit ref input.
           # All other triggers (push:tags, merge_group): use the exact SHA

.github/workflows/fleet-e2e.yaml

@@ -532,7 +532,7 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Dispatch and watch primary
         uses: ./.github/actions/dispatch-suite
         with:
@@ -557,7 +557,7 @@ jobs:
       matrix:
         repo: ${{ fromJSON(needs.plan.outputs.dependents_repos) }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Dispatch and watch
         uses: ./.github/actions/dispatch-suite
         with:
@@ -578,7 +578,7 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Dispatch and watch 4env
         uses: ./.github/actions/dispatch-suite
         with:
@@ -603,7 +603,7 @@ jobs:
       matrix:
         repo: ${{ fromJSON(needs.plan.outputs.remainder_repos) }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Dispatch and watch
         uses: ./.github/actions/dispatch-suite
         with:

.github/workflows/fleet-reconcile.yaml

@@ -110,7 +110,7 @@ jobs:
       # is referenced at a ref by the caller; we re-check-out cascade at that
       # same ref (or an override) so the Go core matches the gate version.
       - name: Check out cascade (reconcile core)
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: stablekernel/cascade
           ref: ${{ inputs.cascade-ref || github.workflow_sha }}

.github/workflows/hotfix.yaml

@@ -73,7 +73,7 @@ jobs:
       deploy_names: ${{ steps.names.outputs.deploy_names }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.hotfix_branch }}
           fetch-depth: 0
@@ -186,7 +186,7 @@ jobs:
       fail-fast: true
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.hotfix_branch }}
 
@@ -235,7 +235,7 @@ jobs:
       max-parallel: 3
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.hotfix_branch }}
 
@@ -275,7 +275,7 @@ jobs:
       release_url: ${{ steps.release.outputs.html_url }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.hotfix_branch }}
           fetch-depth: 0

.github/workflows/nightly-release.yaml

@@ -51,7 +51,7 @@ jobs:
     outputs:
       run: ${{ steps.decide.outputs.run }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Full history + tags so the last-release ref and the diff resolve.
           fetch-depth: 0
@@ -195,7 +195,7 @@ jobs:
       # The tag is the only carrier that survives the workflow_run boundaries:
       # Release builds it, the (broadened) fleet validates it, and auto-promote's
       # unchanged -rc.-only gate rejects it, so nothing publishes by construction.
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: github.event.inputs.dry_run == 'true'
         with:
           fetch-depth: 0

.github/workflows/orchestrate.yaml

@@ -32,7 +32,7 @@ jobs:
       changelog_base_sha: ${{ steps.setup.outputs.changelog_base_sha }}
       base_build_cli: ${{ steps.setup.outputs.base_build_cli }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Setup CLI
@@ -74,7 +74,7 @@ jobs:
       cli_result: ${{ needs.build-cli.outputs.result }}
       validate_result: ${{ needs.validate.outputs.result }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Generate Summary

.github/workflows/pr.yaml

@@ -27,7 +27,7 @@ jobs:
     outputs:
       code: ${{ steps.filter.outputs.code }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - id: filter
         uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
@@ -49,7 +49,7 @@ jobs:
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
@@ -73,7 +73,7 @@ jobs:
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
@@ -95,7 +95,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:

.github/workflows/promote.yaml

@@ -89,7 +89,7 @@ jobs:
       can_proceed: ${{ steps.preflight.outputs.can_proceed }}
       promotion_result: ${{ steps.preflight.outputs.promotion_result }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Setup CLI
@@ -126,7 +126,7 @@ jobs:
     if: ${{ github.event.inputs.dry_run != 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup CLI
         uses: stablekernel/cascade/.github/actions/setup-cli@9dc69a1f66753a3865c38c34eca5a931f677c803 # v0.1.0
         with:
@@ -151,7 +151,7 @@ jobs:
       contents: write
       actions: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Setup CLI

.github/workflows/release.yaml

@@ -39,7 +39,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -61,7 +61,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/scorecard.yml

@@ -19,7 +19,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/validate.yaml

@@ -37,7 +37,7 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
@@ -57,7 +57,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:

e2e/scenarios/35-action-pins-sha-mode.yaml

@@ -5,8 +5,8 @@ description: |
   major tag (#327).
 
   Covers:
-  - pin_mode: sha emits actions/checkout@<40hex> # v6.0.3
-  - the default mutable major tag (v6) no longer appears once sha-pinned
+  - pin_mode: sha emits actions/checkout@<40hex> # v7.0.0
+  - the default mutable major tag (v7) no longer appears once sha-pinned
 
   Generator-output verification only.
 
@@ -34,7 +34,7 @@ steps:
         - path: ".github/workflows/orchestrate.yaml"
           contains:
             # sha mode pins checkout to its 40-hex SHA with a version comment.
-            - "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3"
+            - "uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0"
           not_contains:
             # the mutable major tag must not appear once sha-pinned.
-            - "uses: actions/checkout@v6\n"
+            - "uses: actions/checkout@v7\n"

e2e/scenarios/36-action-pins-default-tag.yaml

@@ -6,7 +6,7 @@ description: |
   against.
 
   Covers:
-  - the default emits actions/checkout@v6 with no sha comment
+  - the default emits actions/checkout@v7 with no sha comment
   - no 40-hex sha pin is emitted for checkout when pin_mode is unset
 
   Generator-output verification only.
@@ -34,7 +34,7 @@ steps:
         - path: ".github/workflows/orchestrate.yaml"
           contains:
             # default behavior emits the built-in mutable major tag, no sha comment.
-            - "uses: actions/checkout@v6\n"
+            - "uses: actions/checkout@v7\n"
           not_contains:
             # without pin_mode: sha, no 40-hex sha pin for checkout is emitted.
-            - "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10"
+            - "uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"

e2e/scenarios/39-action-pins-override.yaml

@@ -21,7 +21,7 @@ config:
   deploys: []
   pin_mode: sha
   action_pins:
-    actions/checkout: "v6"
+    actions/checkout: "v7"
 
 steps:
   - name: "Initial commit; assert the override ref wins over the sha pin"
@@ -37,7 +37,7 @@ steps:
         - path: ".github/workflows/orchestrate.yaml"
           contains:
             # the override ref is emitted verbatim, as a mutable-ref opt-in.
-            - "uses: actions/checkout@v6\n"
+            - "uses: actions/checkout@v7\n"
           not_contains:
             # the built-in sha pin must not appear when overridden.
-            - "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10"
+            - "uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"

internal/generate/action_pins.yaml

@@ -10,8 +10,8 @@
 # sha is the 40-hex commit the tag/version resolves to. version is the precise
 # release the sha corresponds to, carried as the trailing uses: comment.
 actions:
-  actions/checkout:                { tag: v6, sha: df4cb1c069e1874edd31b4311f1884172cec0e10, version: v6.0.3, emit: true }
-  actions/github-script:           { tag: v7, sha: f28e40c7f34bde8b3046d885e986cb6290c5673b, version: v7.1.0, emit: true }
+  actions/checkout:                { tag: v7, sha: 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0, version: v7.0.0, emit: true }
+  actions/github-script:           { tag: v9, sha: 3a2844b7e9c422d3c10d287c895573f7108da1b3, version: v9.0.0, emit: true }
   actions/download-artifact:       { tag: v8, sha: 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c, version: v8.0.1, emit: true }
   actions/upload-artifact:         { tag: v7, sha: 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a, version: v7.0.1, emit: true }
   actions/create-github-app-token: { tag: v3, sha: bcd2ba49218906704ab6c1aa796996da409d3eb1, version: v3.2.0, emit: true }

internal/generate/action_pins_manifest_test.go

@@ -16,8 +16,8 @@ import (
 // intentional bump (a later PR) changes them.
 func TestDefaultActionPins_MatchesPriorHardcodedTable(t *testing.T) {
 	priorHardcodedTable := map[string]actionPin{
-		actionCheckout:         {tag: "v6", sha: "df4cb1c069e1874edd31b4311f1884172cec0e10", shaVersion: "v6.0.3"},
-		actionGithubScript:     {tag: "v7", sha: "f28e40c7f34bde8b3046d885e986cb6290c5673b", shaVersion: "v7.1.0"},
+		actionCheckout:         {tag: "v7", sha: "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0", shaVersion: "v7.0.0"},
+		actionGithubScript:     {tag: "v9", sha: "3a2844b7e9c422d3c10d287c895573f7108da1b3", shaVersion: "v9.0.0"},
 		actionDownloadArtifact: {tag: "v8", sha: "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c", shaVersion: "v8.0.1"},
 		actionUploadArtifact:   {tag: "v7", sha: "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a", shaVersion: "v7.0.1"},
 		actionCreateAppToken:   {tag: "v3", sha: "bcd2ba49218906704ab6c1aa796996da409d3eb1", shaVersion: "v3.2.0"},

internal/generate/drift_check_test.go

@@ -158,7 +158,7 @@ func TestDriftCheckGenerator_PinModeSHA(t *testing.T) {
 	comment, err := g.GenerateComment()
 	require.NoError(t, err)
 	assert.Contains(t, comment, "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c")
-	assert.Contains(t, comment, "actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b")
+	assert.Contains(t, comment, "actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3")
 }
 
 // TestDriftCheckGenerator_Actionlint runs actionlint over both generated files.

internal/generate/hotfix_test.go

@@ -474,7 +474,7 @@ func TestHotfixGenerator_PinModeSHA(t *testing.T) {
 	content, err := gen.Generate()
 	require.NoError(t, err)
 
-	assert.Contains(t, content, "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10")
+	assert.Contains(t, content, "uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0")
 	assert.NotContains(t, content, "uses: actions/checkout@v4")
 }