ci: bump actions/checkout from 6.0.2 to 7.0.1

[dependabot]

Summary

Update actions/checkout from 6.0.2 to 7.0.1 across CI and release workflows.

Changes

• Update 27 pinned checkout invocations in 12 workflows.
• Retain existing refs, fetch depths, and persist-credentials: false settings.
• Give the Windows baseline and isolated test-quality modes 45 minutes instead of 30. These unsharded jobs run 3,034 tests; three initial runs timed out near completion without failing assertions, while a successful isolated run spent 28 minutes on tests alone. Other modes retain their existing deadlines.

Testing

• git diff --check passed.
• Parsed all changed workflow YAML and verified the 27 action pin updates and the timeout expression, which applies only to the two full-suite Windows modes.
• Compared the exact upstream action metadata and source: existing inputs, defaults, and Node 24 runtime are unchanged; all configured inputs remain supported.
• Reviewed the PR's initial CI run. Package, platform, source-contract, and native checks passed. The Windows baseline test-quality job reached its 30-minute deadline with no failing assertions, causing the inventory comparison to lack its report. The job deadline was adjusted based on these logs; merge requires passing current CI.

Risk and rollout

Checkout v7 blocks unsafe fork PR checkouts under privileged PR events. The release workflow_run job is restricted to successful pushes to main; no privileged fork checkout is required. Hosted runner versions satisfy the unchanged action runtime requirement. No application or CLI changes are required. No obsolete compatibility workaround was found in the affected invocations.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-11T20:03:15.823430Z	522c629	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed the exact checkout 6.0.2 to 7.0.1 source and input/runtime changes against all 27 workflow uses. Existing refs and credential settings remain compatible. The Windows deadline fix is confirmed by successful full-suite runs taking approximately 33 and 36 minutes, followed by a passing inventory comparison. Current-head CI passed all 57 executed jobs, with two expected conditional skips: https://github.com/openai/codex-security/actions/runs/34641857881 . All required checks pass, no unresolved review threads remain, and the merge tree preserves the already-merged dependency upgrades. Public PR content and final CI logs reviewed.