Update actions/checkout action to v7 (#241)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://redirect.github.com/actions/checkout) |
action | major | `v4` → `v7` |
| [actions/checkout](https://redirect.github.com/actions/checkout) |
action | major | `v2` → `v7` |

---

### Release Notes

<details>
<summary>actions/checkout (actions/checkout)</summary>

###
[`v7.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v7...v7.0.1)

- Skip running unsafe pr check if input is default by
[@&#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in
[#&#8203;2518](https://redirect.github.com/actions/checkout/pull/2518)
- Trim only ascii whitespace for branch by
[@&#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in
[#&#8203;2521](https://redirect.github.com/actions/checkout/pull/2521)
- Escape values passed to --unset by
[@&#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in
[#&#8203;2530](https://redirect.github.com/actions/checkout/pull/2530)
- Various dependency updates

###
[`v7.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v7...v7)

- Block checking out fork PR for pull\_request\_target and workflow\_run
by [@&#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in
[#&#8203;2454](https://redirect.github.com/actions/checkout/pull/2454)
- Various dependency updates

###
[`v7`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v6.1.0...v7)

- Skip running unsafe pr check if input is default by
[@&#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in
[#&#8203;2518](https://redirect.github.com/actions/checkout/pull/2518)
- Trim only ascii whitespace for branch by
[@&#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in
[#&#8203;2521](https://redirect.github.com/actions/checkout/pull/2521)
- Escape values passed to --unset by
[@&#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in
[#&#8203;2530](https://redirect.github.com/actions/checkout/pull/2530)
- Various dependency updates

###
[`v6.1.0`](https://redirect.github.com/actions/checkout/releases/tag/v6.1.0)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v6.0.3...v6.1.0)

##### What's Changed

- **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by
[@&#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in
[#&#8203;2500](https://redirect.github.com/actions/checkout/pull/2500)
- backport fixes to releases-v6 by
[@&#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in
[#&#8203;2527](https://redirect.github.com/actions/checkout/pull/2527)


<https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/>
for more details about this breaking change

**Full Changelog**:
<actions/checkout@v6.0.3...v6.1.0>

###
[`v6.0.3`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v6.0.2...v6.0.3)

- Fix checkout init for SHA-256 repositories by
[@&#8203;yaananth](https://redirect.github.com/yaananth) in
[#&#8203;2439](https://redirect.github.com/actions/checkout/pull/2439)
- fix: expand merge commit SHA regex and add SHA-256 test cases by
[@&#8203;yaananth](https://redirect.github.com/yaananth) in
[#&#8203;2414](https://redirect.github.com/actions/checkout/pull/2414)

###
[`v6.0.2`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v6.0.1...v6.0.2)

- Fix tag handling: preserve annotations and explicit fetch-tags by
[@&#8203;ericsciple](https://redirect.github.com/ericsciple) in
[#&#8203;2356](https://redirect.github.com/actions/checkout/pull/2356)

###
[`v6.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v6...v6.0.1)

- Add worktree support for persist-credentials includeIf by
[@&#8203;ericsciple](https://redirect.github.com/ericsciple) in
[#&#8203;2327](https://redirect.github.com/actions/checkout/pull/2327)

###
[`v6.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v6...v6)

- Persist creds to a separate file by
[@&#8203;ericsciple](https://redirect.github.com/ericsciple) in
[#&#8203;2286](https://redirect.github.com/actions/checkout/pull/2286)
- Update README to include Node.js 24 support details and requirements
by [@&#8203;salmanmkc](https://redirect.github.com/salmanmkc) in
[#&#8203;2248](https://redirect.github.com/actions/checkout/pull/2248)

###
[`v6`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v5.1.0...v6)

- Fix checkout init for SHA-256 repositories by
[@&#8203;yaananth](https://redirect.github.com/yaananth) in
[#&#8203;2439](https://redirect.github.com/actions/checkout/pull/2439)
- fix: expand merge commit SHA regex and add SHA-256 test cases by
[@&#8203;yaananth](https://redirect.github.com/yaananth) in
[#&#8203;2414](https://redirect.github.com/actions/checkout/pull/2414)

###
[`v5.1.0`](https://redirect.github.com/actions/checkout/releases/tag/v5.1.0)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v5.0.1...v5.1.0)

##### What's Changed

- **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by
[@&#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in
[#&#8203;2501](https://redirect.github.com/actions/checkout/pull/2501)
- backport fixes to releases-v5 by
[@&#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in
[#&#8203;2523](https://redirect.github.com/actions/checkout/pull/2523)


<https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/>
for more details about this breaking change

**Full Changelog**:
<actions/checkout@v5.0.1...v5.1.0>

###
[`v5.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v5...v5.0.1)

- Port v6 cleanup to v5 by
[@&#8203;ericsciple](https://redirect.github.com/ericsciple) in
[#&#8203;2301](https://redirect.github.com/actions/checkout/pull/2301)

###
[`v5.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v5...v5)

- Update actions checkout to use node 24 by
[@&#8203;salmanmkc](https://redirect.github.com/salmanmkc) in
[#&#8203;2226](https://redirect.github.com/actions/checkout/pull/2226)

###
[`v5`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v4.4.0...v5)

- Port v6 cleanup to v5 by
[@&#8203;ericsciple](https://redirect.github.com/ericsciple) in
[#&#8203;2301](https://redirect.github.com/actions/checkout/pull/2301)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - Monday through Friday (`* * * * 1-5`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>

Author: pulumi-renovate[bot]

.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Unshallow clone for tags
         run: git fetch --prune --unshallow --tags || true
       - name: Install Go

.github/workflows/test.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Generate Pulumi Access Token
         id: generate_pulumi_token

.github/workflows/update-providermap.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false