chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: actions/checkout.

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

LGTM — mechanical dependabot bump of actions/checkout 7.0.0 → 7.0.1 across 15 workflow files. Every occurrence pins the same new SHA (3d3c42e5aac5ba805825da76410c181273ba90b1) consistently with the repo's existing SHA-pinning convention.

Extended reasoning...

Overview

This is a dependabot-generated PR that bumps actions/checkout from v7.0.0 to v7.0.1 across 15 workflow files in .github/workflows/. Every hunk is the same mechanical change: swapping the pinned SHA from 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 (v7.0.0) to 3d3c42e5aac5ba805825da76410c181273ba90b1 (v7.0.1), or updating the tag in the one non-SHA-pinned occurrence (claude.yml). No job logic, permissions, secrets usage, or control flow was touched.

Security risks

None introduced by this diff. actions/checkout is a first-party GitHub action and the version bump is a patch release (bug fixes: unsafe-PR-check skip, branch whitespace trimming, --unset value escaping — all defensive fixes, not new capabilities). The two nits surfaced by the bug hunt (a mutable-tag pin in claude.yml and a stale version comment in collectivex-sweep.yml) both predate this PR and are not made worse in any meaningful way — the tag-pin issue is a pre-existing gap in this one file's convention, and the comment mislabel is purely cosmetic (the SHA, not the comment, is what GitHub Actions resolves).

Level of scrutiny

Low. This is the textbook case for a mechanical, low-ambiguity dependency bump: single well-known first-party action, patch version, uniform diff pattern repeated across files, generated by an automated tool (dependabot) rather than hand-authored logic changes. No CODEOWNER-sensitive logic, no new permissions, no behavioral changes to review.

Other factors

No prior reviews exist on this PR. The bug hunting system's two findings are both nits about pre-existing inconsistencies (unrelated to what this PR actually changes) rather than issues introduced by the version bump itself, and neither affects correctness of the bump.

[claude]

🟡 The checkout in claude.yml (line 24) is pinned to the mutable tag actions/checkout@v7.0.1, while every other checkout step touched by this PR (including the sibling claude-pr-review.yml) is pinned to the immutable SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 with a version comment. This job runs with contents:write/pull-requests:write/issues:write and is triggered by attacker-influenceable comment events, so aligning it with the repo's SHA-pinning convention would be a worthwhile hardening follow-up (pre-existing, not introduced by this PR).

Extended reasoning...

What's happening: .github/workflows/claude.yml line 24 checks out the repo with uses: actions/checkout@v7.0.1 — a bare, mutable version tag. Every other workflow file this dependabot PR touches (benchmark-tmpl.yml, benchmark-multinode-tmpl.yml, claude-pr-review.yml, codeowner-signoff-verify.yml, collect-evals.yml, collect-results.yml, e2e-tests.yml, profile.yml, run-sweep.yml, speedbench-al.yml, test-changelog-gate.yml, test-matrix-logic.yml, test-process-result.yml) is pinned to the immutable commit SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1. claude.yml is the sole holdout — it went from @v7.0.0 to @v7.0.1 as a tag, never a SHA.

Why it matters here specifically: this is not a cosmetic inconsistency. The claude job runs with contents: write, pull-requests: write, and issues: write permissions, uses secrets.CLAUDE_PAT, and is triggered by issue_comment, issues, and pull_request_review_comment events — all attacker-influenceable (anyone who can comment @claude on an issue/PR can trigger the run). A mutable tag like v7.0.1 can be retargeted at the upstream repo (whether by compromise or, less severely, by a maintainer force-pushing the tag) to point at different, potentially malicious code, and that new code would then run in this privileged context with zero corresponding diff in the InferenceX repo to review or git blame. SHA-pinning is exactly the mitigation GitHub recommends for this threat model, and the repo has already standardized on it everywhere else.

Concrete walk-through: (1) today actions/checkout@v7.0.1 resolves to commit 3d3c42e5aac5ba805825da76410c181273ba90b1; (2) if that tag were ever moved to point at a different commit (supply-chain compromise of the upstream org, or accidental/malicious re-tag), the next @claude comment from any user would silently pull and execute the new checkout action code with CLAUDE_PAT and write permissions in scope; (3) reviewers of this InferenceX repo would have no diff to inspect, since the workflow file itself is unchanged — the sibling claude-pr-review.yml and the 13 other files don't have this exposure because their SHA is hard-pinned and any real change to it would produce a visible diff.

Fix: pin line 24 the same way as everywhere else: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1.

Scope/severity note: this predates the PR (the line was already tag-pinned at @v7.0.0) and dependabot correctly bumped the tag it found rather than converting the pin style — that's not dependabot's job. Since actions/checkout is a first-party GitHub action, the practical retarget risk is low, and this same file already floats a much larger mutable surface via anthropics/claude-code-action@v1 (a major-version tag), so pinning this one line wouldn't materially change the file's overall exposure. It's a legitimate, real inconsistency worth fixing while this exact line is being touched, but not something that should block the merge.

[Klaud-Cold]

Claude finished @claude[bot]'s task in 1m 38s —— View job

---

SHA-pinning actions/checkout in claude.yml — done

• Gather context and confirm the finding
• Verify 3d3c42e5aac5ba805825da76410c181273ba90b1 is what v7.0.1 resolves to upstream
• Pin .github/workflows/claude.yml:24 to the SHA
• Commit and push to the PR branch

Applied the fix from the review finding in commit 15842383:

• .github/workflows/claude.yml:24 — changed actions/checkout@v7.0.1 to actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1, matching the SHA-pinning convention used by every other workflow in the repo. I verified via the GitHub API that the v7.0.1 tag (and the v7 tag) currently resolves to exactly that commit, so behavior is unchanged — only the pin is now immutable.
• .github/workflows/collectivex-sweep.yml:43 — while checking the diff I noticed dependabot updated that line's SHA to the v7.0.1 commit but left the old # v5.0.0 comment in place, which was misleading. Corrected the comment to # v7.0.1.

One note for the maintainers: since I pushed to this branch, dependabot will no longer rebase/recreate this PR automatically (per its own notice). If you'd rather keep the PR pristine for dependabot, @dependabot recreate will discard my commit — but then the two fixes above would need to land separately.
· Branch

[claude]

🟡 In .github/workflows/collectivex-sweep.yml line 43, actions/checkout is pinned to SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 (v7.0.1, per every other workflow in this PR that pins the same SHA), but the trailing comment still reads # v5.0.0. This is a pre-existing mislabel (the prior SHA was v7.0.0 but was already commented v5.0.0 here) that this dependabot bump widens rather than fixes — purely cosmetic since the SHA pin is what actually resolves, but worth a one-line comment fix to # v7.0.1.

Extended reasoning...

What the bug is: The actions/checkout step in collectivex-sweep.yml (line 43) is pinned by SHA, with a trailing # comment meant to document which human-readable version that SHA corresponds to. After this PR's dependabot bump, the SHA is 3d3c42e5aac5ba805825da76410c181273ba90b1, but the comment still says # v5.0.0. Every one of the other 13 workflow files touched in this PR pins that exact same SHA and labels it # v7.0.1 (e.g. benchmark-tmpl.yml, claude-pr-review.yml, e2e-tests.yml, codeowner-signoff-verify.yml). A single SHA cannot correspond to two different tags, so the comment in collectivex-sweep.yml is objectively wrong.\n\nHow it manifests / code path: This is a documentation-only artifact of dependabot's SHA-pinning bump. Dependabot matches and rewrites checkout actions by SHA (old SHA 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 -> new SHA 3d3c42e5aac5ba805825da76410c181273ba90b1), but it does not (and cannot reliably) rewrite the human-authored trailing comment, so whatever was there before is carried forward verbatim. The mislabel actually predates this PR: prior to the bump, the same line pinned 9c091bb2... (which is v7.0.0 in every sibling file) but was already commented # v5.0.0" in this file specifically. This PR's diff just swaps the SHA and leaves the stale comment, which widens the drift from one major version off (claimed v5.0.0 vs actual v7.0.0) to two major versions off (claimed v5.0.0 vs actual v7.0.1).\n\n**Why nothing catches it:** GitHub Actions resolves the step purely by the SHA before the #; the comment is inert and has zero effect on what code actually runs. There's no CI lint step in this repo that cross-checks version comments against pinned SHAs (nor would that be a common thing to lint for), so nothing currently would flag this as broken.\n\n**Impact:** Purely cosmetic — the workflow behaves correctly since GitHub Actions uses the SHA, not the comment. The only impact is on a human reader: anyone auditing this specific workflow file to see which version of actions/checkoutis in use (e.g. checking for a security advisory affecting a specific version, or verifying the dependabot bump landed correctly) would be misled into thinking this file still runs v5.0.0 when it actually runs the same v7.0.1 as everything else in the repo.\n\n**Step-by-step proof:**\n1. Open.github/workflows/collectivex-sweep.ymlat line 43 (post-PR):- uses: actions/checkout@3d3c42e # v5.0.0.\n2. Open any sibling workflow modified in the same PR, e.g. .github/workflows/benchmark-tmpl.yml: - uses: actions/checkout@3d3c42e # v7.0.1.\n3. Both lines pin the identical SHA 3d3c42e5aac5ba805825da76410c181273ba90b1.\n4. A single commit SHA in the upstream actions/checkoutrepo can only correspond to one tag/release, so it cannot simultaneously be v5.0.0 and v7.0.1 — the comment incollectivex-sweep.ymlmust be wrong, and per the consistent labeling across the other 13 files in this PR, v7.0.1 is the correct label.\n5. Confirming the pre-existing nature: checking the pre-PR version ofcollectivex-sweep.ymlshows SHA9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0with the same# v5.0.0comment, while every sibling file's pre-PR version pins that same old SHA labeled# v7.0.0— so the mislabel already existed before this PR and has simply carried over through the bump.\n\n**How to fix:** Change the trailing comment on line 43 from# v5.0.0to# v7.0.1` to match the actual pinned SHA and the labeling convention used everywhere else in the PR.