chore(deps): bump actions/checkout from 7.0.0 to 7.0.1

[dependabot]

Bumps actions/checkout from 7.0.0 to 7.0.1.

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a6805bc3-51ff-4302-bb51-c9115d3f44f1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The workflows update all referenced actions/checkout steps from v7.0.0 to v7.0.1 across CI, coverage, npm publishing, release, and security jobs.

Changes

Checkout action update

Layer / File(s)	Summary
Update workflow checkout pins .github/workflows/ci.yml, .github/workflows/coverage.yml, .github/workflows/npm-publish.yml, .github/workflows/release.yml, .github/workflows/security.yml	All affected checkout steps now use actions/checkout@v7.0.1, with three release jobs updated alongside the other workflows.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: microck

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the dependency update but omits the required Summary, Verification, Docs, and Auth / Secrets sections.	Use the repository template and include the change rationale, verification status, documentation impact, and secret-safety confirmations.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Release Metadata Consistency	✅ Passed	Cargo.toml, Cargo.lock kagi entry, and npm/package.json all use 0.16.0, and CHANGELOG.md contains ## [0.16.0].
Title check	✅ Passed	The title clearly and concisely describes the dependency update made across the workflows.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/actions/checkout-7.0.1

Warning

Your free Security trial is over. An organization admin can activate billing to continue.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Line 23: Disable checkout credential persistence for the Checkout steps using
actions/checkout in .github/workflows/ci.yml at lines 23-23,
.github/workflows/coverage.yml at lines 21-21, and
.github/workflows/security.yml at lines 25-25 by adding with:
persist-credentials: false; no authenticated git access is required.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d1a87767-cda2-44a7-8644-b357eb02d689

📥 Commits

Reviewing files that changed from the base of the PR and between 343a3a1 and 9478d87.

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• .github/workflows/coverage.yml
• .github/workflows/npm-publish.yml
• .github/workflows/release.yml
• .github/workflows/security.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for f in .github/workflows/ci.yml .github/workflows/coverage.yml .github/workflows/security.yml; do
  echo "### $f"
  wc -l "$f"
  echo
  nl -ba "$f" | sed -n '1,220p'
  echo
done

Repository: Microck/kagi-cli

Length of output: 252

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show checkout step context and any git/auth-related steps in the workflows.
rg -n -C 3 'actions/checkout|persist-credentials|git |github.token|GITHUB_TOKEN|permissions:' .github/workflows/ci.yml .github/workflows/coverage.yml .github/workflows/security.yml

Repository: Microck/kagi-cli

Length of output: 2203

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the repository for any workflow docs or conventions around checkout credentials.
rg -n 'persist-credentials|checkout' .github README* docs* . 2>/dev/null | head -n 200

Repository: Microck/kagi-cli

Length of output: 2047

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

nl -ba .github/workflows/ci.yml | sed -n '1,140p'
echo '---'
nl -ba .github/workflows/coverage.yml | sed -n '1,120p'
echo '---'
nl -ba .github/workflows/security.yml | sed -n '1,140p'

Repository: Microck/kagi-cli

Length of output: 194

---

Sensitive Data Exposure (CWE-522): Insufficiently Protected Credentials

Disable checkout credential persistence in these non-publishing workflows. actions/checkout writes the workflow token into git config by default; add with: persist-credentials: false to the Checkout steps in .github/workflows/ci.yml#L23, .github/workflows/coverage.yml#L21, and .github/workflows/security.yml#L25 unless authenticated git access is required.

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 22-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 3 files

• .github/workflows/ci.yml#L23-L23 (this comment)
• .github/workflows/coverage.yml#L21-L21
• .github/workflows/security.yml#L25-L25

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 23, Disable checkout credential persistence
for the Checkout steps using actions/checkout in .github/workflows/ci.yml at
lines 23-23, .github/workflows/coverage.yml at lines 21-21, and
.github/workflows/security.yml at lines 25-25 by adding with:
persist-credentials: false; no authenticated git access is required.

Source: Linters/SAST tools

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.