Bump actions/checkout from 6.0.3 to 7.0.0

[dependabot]

Bumps actions/checkout from 6.0.3 to 7.0.0.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

Changelog

Sourced from actions/checkout's changelog.

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462

Commits

• 9c091bb update error wording (#2467)
• 1044a6d getting ready for checkout v7 release (#2464)
• f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
• d914b26 upgrade module to esm and update dependencies (#2463)
• 537c7ef Bump @​actions/core and @​actions/tool-cache and Remove uuid (#2459)
• 130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
• 7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
• 0f9f3aa Bump actions/publish-immutable-action (#2458)
• f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🤖 Claude Code Review

PR Code Review

Scope: This PR is a pure dependency bump — actions/checkout from v6.0.3 → v7.0.0 across 8 GitHub Actions workflow files. No application code, docs, or tests are touched.

Code Quality

• [✅] Style conventions — Consistent, minimal one-line diffs in each file; matches existing YAML formatting.
• [✅] No commented-out code — N/A, none present.
• [✅] Meaningful variable names — N/A (no code).
• [✅] DRY — N/A.
• [⚠️] Defects / risk — This is a major version bump (v6 → v7), not a patch/minor. Flagging for manual verification since network access is unavailable to confirm release notes in this run:
  • actions/checkout v7 dropped Node 20 runtime support in favor of Node 24 in recent major releases of GitHub Actions toolkit-based actions. If any of these workflows run on self-hosted runners or GitHub Enterprise Server with an older Actions Runner version, the job could fail to execute the action.
  • Confirm the bump was applied consistently — checked all 8 occurrences (bearer.yaml:29, create-javadoc-documentation.yaml:29, docker-build-container.yaml:39, docker-push-containers-to-dockerhub.yaml:36, maven-darwin.yaml:49, maven-linux.yaml:50, maven-windows.yaml:49, trivy-dependency-scan.yaml:23) — all consistent, no stragglers left on v6.0.3 or an intermediate version. ✅
  • No other input parameters (persist-credentials, submodules) changed, so behavior beyond the runtime/action version should be unaffected — but recommend a green CI run before merge given the major-version jump, since checkout output/input behavior has changed across majors before (e.g., default branch detection, persist-credentials defaults in earlier majors).
• [✅] CLAUDE.md — Not modified in this diff; no concerns.

Testing

• [✅ N/A] No unit/integration tests apply to workflow-file version bumps. Recommend relying on the CI run itself (this PR's own required checks) as the functional test — watch for the checkout step succeeding on all 3 OS matrices (Linux, Windows, Darwin) since runner/Node compatibility is the main risk with a major bump.

Documentation

• [✅ N/A] No README/API doc/CHANGELOG.md updates needed for a CI dependency bump of this kind.
• [✅] No markdown files were touched in this diff.

Security

• [✅] No hardcoded credentials introduced or modified.
• [✅] No input validation concerns (not applicable to this diff).
• [✅] No error handling concerns.
• [✅] No sensitive data in logs.
• [✅] No .lic files or AQAAAD-prefixed license strings present in this diff.

Summary

Low-risk, mechanical dependency bump. The only item worth confirming before merge is that CI actually passes green on this PR across all matrix jobs (Linux/Windows/Darwin runners), given actions/checkout v6→v7 is a major version jump that could have runner/Node-runtime compatibility implications. No blocking issues found.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter