chore(deps): bump the github-actions group across 1 directory with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates in the / directory: actions/checkout and actions/setup-python.

Updates actions/checkout from 6 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @​ericsciple in actions/checkout#2314
• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327
• Clarify v6 README by @​ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

Commits

• 9c091bb update error wording (#2467)
• 1044a6d getting ready for checkout v7 release (#2464)
• f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
• d914b26 upgrade module to esm and update dependencies (#2463)
• 537c7ef Bump @​actions/core and @​actions/tool-cache and Remove uuid (#2459)
• 130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
• 7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
• 0f9f3aa Bump actions/publish-immutable-action (#2458)
• f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
• See full diff in compare view

Updates actions/setup-python from 6.2.0 to 6.3.0

Release notes

Sourced from actions/setup-python's releases.

v6.3.0

What's Changed

Enhancement

• Add RHEL support and include Linux distro in cache keys by @​priyagupta108 in actions/setup-python#1323
• Fix pip cache error handling on Windows by @​priyagupta108 in actions/setup-python#1040

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in actions/setup-python#1281
• Upgrade actions dependencies by @​gowridurgad with @​Copilot in actions/setup-python#1303
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-python#1324
• Upgrade dependency versions and test workflow configuration by @​HarithaVattikuti in actions/setup-python#1322

Documentation

• Update advanced-usage.md by @​Dunky-Z in actions/setup-python#811

New Contributors

• @​gowridurgad with @​Copilot made their first contribution in actions/setup-python#1303
• @​jasongin made their first contribution in actions/setup-python#1324
• @​Dunky-Z made their first contribution in actions/setup-python#811

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

Commits

• ece7cb0 Fix pip cache error handling on Windows. (#1040)
• 1d18d7a Update advanced-usage.md (#811)
• d2b357a Update dependency versions and test workflow configuration (#1322)
• 8f639b1 Merge pull request #1324 from jasongin/update-actions-cache-5.1.0
• 6731c2b Resolve high-severity audit issues
• 0cb1a84 Add RHEL support and include Linux distro in cache keys (#1323)
• dc6eab6 Update dist
• 6f4b74b Strict equality
• fa8bde1 Bump @​actions/cache to 5.1.0, log cache write denied
• c8813ba Upgrade @​actions dependencies and update licenses (#1303)
• Additional commits viewable in compare view

[MickaelV0]

Code Review — PR #306 (bump github-actions group)

Verdict: Approve with comments — no blockers. The actions/checkout v6→v7 bump is safe as applied.

Verified safe

• praise: The only behaviour-changing item in checkout v6.0.3→v7.0.0 is the new default-deny for fork-PR checkout under pull_request_target/workflow_run (block checking out fork pr for pull_request_target and workflow_run actions/checkout#2454). None of this repo's checkout-using workflows use those triggers (ci.yml=push/pr, deploy-preview.yml=workflow_dispatch, upstream-watch.yml=schedule, context-lint.yml=pr/push). Zero blast radius.
• praise: Every new SHA verifies against its claimed tag (checked live against the GitHub API): 9c091bb… == refs/tags/v7.0.0, ece7cb06… == refs/tags/v6. No substitution.
• praise: All 7 workflows declare explicit least-privilege permissions:; no pull_request_target anywhere.

Non-blocking hygiene

• issue: .github/workflows/deploy-preview.yml:21 — SHA bumped to a v7.0.0 commit but the trailing comment still reads # v6. A pin comment that lies defeats the audit value of SHA-pinning. Sibling ci.yml:15 / upstream-watch.yml:16 got # v7.0.0 in this same PR → file is internally inconsistent. Fix: # v7.0.0.
• suggestion(non-blocking): [parallel-path-drift] Two uses: remain tag-pinned (mutable) while the other 11 SHA-pin: context-lint.yml:29 (actions/checkout@v7) and release-please.yml:23 (googleapis/release-please-action@v5). The latter is the sharper edge — it runs at contents: write + pull-requests: write with a minted App token, so a retagged v5 executes with commit-write authority. SHA-pin both.

⚠ Cross-cutting (not this PR, but gates this PR)

The auto-merge.yml:54 semver-major guard does not fire for this PR — it parses from X to Y from the PR title, but a grouped dependabot title ("…group across 1 directory with 2 updates") carries no versions. This PR contains a real major (checkout 6→7) and would auto-merge the moment a reviewed label lands. Being fixed in a separate branch (fetch-metadata gate + dependabot update-types split). Do not label reviewed until that lands.

[roxabi-ci]

Auto-merge refusé : bump semver-major. Validation manuelle requise (e2e / boot de l'artefact), puis merge à la main.

[MickaelV0]

ℹ️ The Auto-merge refusé comment above is the guard firing correctly, not a problem with this PR — I used #306 to live-test the new semver-major gate shipped in #342 (its payload is verified safe, so it was the right test subject; #338 was not).

Result: fetch-metadata reported update-type: version-update:semver-major on this grouped PR — exactly the case the old title-regex silently missed — and Enable auto-merge was skipped. The control is now verified end-to-end.

reviewed label removed. This PR stays open pending Dependabot re-emitting it split (safe minor/patch grouped, actions/checkout 6→7 as its own PR) under the new update-types config. Review verdict is unchanged: Approve with comments.

[MickaelV0]

@dependabot recreate

[MickaelV0]

ℹ️ The @dependabot recreate above was me testing the update-types: [minor, patch] split shipped in #342. It did not take effect — this PR still groups its semver-major. The config is correct per the docs; recreate appears not to re-derive group membership (undocumented). Full analysis: #342.

No action needed here and nothing is at risk: the semver-major auto-merge guard is verified working, so this PR cannot auto-merge while it contains a major. Leaving it open rather than closing it — closing a Dependabot PR suppresses re-proposal of that version, which would also drop the safe bumps.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.