chore(deps): update actions/checkout action to v7.0.1

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v7.0.0 → v7.0.1

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: v7.0.0 → v7.0.1 (patch)
Breaking changes: None
Security concerns: None — changes are security-positive (escape values passed to --unset, trim only ASCII whitespace for branch names)

Changes (v7.0.1):

• Skip running unsafe PR check if input is default (reduces false positives from v7.0.0 security feature)
• Trim only ASCII whitespace for branch names (more precise sanitization)
• Escape values passed to --unset (security hardening against injection)
• Various dependency updates

Impact on codebase: All 5 checkout steps across pre-merge.yaml and release.yaml use default settings (no custom ref, path, or persist-credentials inputs). The behavioral refinements in v7.0.1 only affect non-default or edge-case configurations. No affected patterns found.

CI status: detect-modules, build-e2e, renovate/stability-days passed. golangci-lint and tests are still running but only validate Go code which is unchanged in this PR.

Recommendation: SAFE TO MERGE

— Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: actions/checkout v7.0.0 → v7.0.1 (patch)

Changes:

• Skip running unsafe PR check if ref input is default (fixes v7.0.0 regression for workflows using pull_request_target with default ref)
• Trim only ASCII whitespace for branch names
• Escape values passed to --unset (security fix — prevents potential command injection in git config operations)
• Various dependency updates

Breaking changes: None

Security concerns: None — this release improves security by fixing an escaping issue in git --unset values (PR #2530). The unsafe-PR-check refinement (#2518) adjusts v7.0.0's security gate to avoid false positives when ref is left at its default.

Impact on codebase: Low. The updated workflow files (pre-merge.yaml, release.yaml) use actions/checkout with the default ref (no explicit ref set). The review.yml workflow uses pull_request_target but delegates to a shared workflow from scality/workflows and is not modified in this PR. No affected patterns found.

Recommendation: REVIEW REQUIRED

Notes:

• Cannot auto-approve: PR contains commits from a non-bot author (g-carre) in addition to scality-renovate[bot]. A human should verify the non-bot commit before merging.
• CI checks (golangci-lint, tests) are still in progress at time of evaluation.
• From a technical standpoint, this patch bump is safe — it contains only bug fixes and security improvements with no breaking changes.

— Claude Code