🚨 Update github actions to v7 (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v6.0.2 → v7.0.0
actions/upload-artifact	action	major	v6.0.0 → v7.0.1

---

Release Notes

actions/checkout (actions/checkout)

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v7

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

• Update the readme with direct upload details by @​danwkennedy in #​795
• Readme: bump all the example versions to v7 by @​danwkennedy in #​796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in #​797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in #​754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in #​762
• Support direct file uploads by @​danwkennedy in #​764

New Contributors

• @​Link- made their first contribution in #​754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v7

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:15 AM UTC · Completed 10:20 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review — approve

PR: #233 — 🚨 Update github actions to v7 (main)
Author: renovate[bot]
Scope: 1 file changed (.github/workflows/scorecards.yml), 2 additions, 2 deletions

Summary

This PR updates two SHA-pinned GitHub Actions in the OpenSSF Scorecard workflow from v6 to v7:

Action	Old	New
actions/checkout	v6.0.2 (de0fac2e...)	v7.0.0 (9c091bb2...)
actions/upload-artifact	v6.0.0 (b7c566a7...)	v7.0.1 (043fb46d...)

Dimension results

Dimension	Result
Correctness	✅ No issues — SHA pins verified against GitHub API; both resolve to claimed tags. No breaking changes affect this workflow's triggers (push/schedule/branch_protection_rule) or inputs (persist-credentials: false, name/path/retention-days).
Security	✅ No issues — Permissions block unchanged (read-all top-level, scoped job permissions). No injection surfaces (no expression interpolation of user-controlled inputs). persist-credentials: false retained. actions/checkout v7's fork-blocking change is not relevant (workflow does not use pull_request_target or workflow_run).
Intent & coherence	✅ Mechanical dependency bump by Renovate bot — authorization implicit.
Style & conventions	✅ New lines follow the existing owner/action@full-sha # version-comment pinning pattern.
Docs currency	✅ CI workflow change — no documentation impact.
Cross-repo contracts	⏭ Skipped — no exported interfaces modified.

Verdict

Approve. Clean, mechanical dependency version bump. Both SHA pins are verified authentic, no breaking changes affect this workflow, and permissions are unchanged.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/scorecards.yml