ci: bump actions/checkout to v7 across all workflows

[jnasbyupgrade]

Summary

Audited every uses: line in .github/workflows/*.yml and bumped stale actions/checkout pins. anthropics/claude-code-action@v1 was also checked and left as-is (no v2 exists).

Bumps made:

• .github/workflows/claude.yml (line ~39): actions/checkout@v4 → @v7
• .github/workflows/claude-code-review.yml (line ~81): actions/checkout@v4 → @v7, plus added allow-unsafe-pr-checkout: true to that step (see below — required, not cosmetic)
• .github/workflows/ci.yml (line ~23): actions/checkout@v5 → @v7

The task originally assumed v5 (already used by ci.yml) was current, but actions/checkout's actual latest major is v7, so all three were bumped to v7 rather than stopping at v5.

anthropics/claude-code-action@v1 in claude.yml and claude-code-review.yml: checked gh api repos/anthropics/claude-code-action/releases and .../tags — latest is v1.0.184 under the floating v1 tag, no v2 release or tag exists. Left unchanged.

Changelog review before bumping

Checked actions/checkout release notes for v5, v6, and v7 (not just the version string):

• v5: Node 24 runtime bump; requires Actions Runner ≥ v2.327.1. No input/behavior changes affecting this repo's usage.
• v6: persist-credentials now stores creds in a separate file under $RUNNER_TEMP instead of .git/config. Per upstream notes, "no workflow changes required — git fetch, git push, etc. continue to work automatically." Verified none of the three workflows rely on .git/config-based credential persistence directly.
• v7: adds a new opt-in security gate — allow-unsafe-pr-checkout — that refuses to check out fork PR code when the workflow trigger is pull_request_target or workflow_run, unless explicitly set to true (upstream: prevents "pwn request" vulnerabilities). This is directly relevant here: claude-code-review.yml's "Check out PR head" step runs under pull_request_target and explicitly checks out github.event.pull_request.head.repo.full_name — exactly the pattern v7 blocks by default. Without the opt-in, that step would start failing on every PR after this bump. Added allow-unsafe-pr-checkout: true with a comment explaining why it's safe in this specific workflow (job already gated to the trusted jnasbyupgrade fork only, checkout is persist-credentials: false/read-only, PR code is never built or executed).

No behavior-affecting change was found for ci.yml or claude.yml's checkout steps (neither uses pull_request_target/workflow_run with a fork checkout).

Verification

• All three workflow YAML files parse successfully (yaml.safe_load).
• Pushed to jnasbyupgrade/extension_tools and watching a live CI run on ci.yml (push trigger) to confirm the actions/checkout@v4 Node.js 20 deprecation warning is gone from the "Check out the repo" step logs.
• claude.yml and claude-code-review.yml don't produce meaningful log output for this specific check outside their real trigger contexts (@claude mention / pull_request_target review), so the checkout-step behavior there is confirmed via the changelog review above rather than a live log capture in this PR's own CI run. Will update this PR with results once the ci.yml run completes.

Expected future conflict

Branch track-progress-claude-review (PR #15) is concurrently editing claude-code-review.yml for an unrelated checkout-failure fix. This branch is independent, based on current upstream/master, and will very likely conflict with #15 on merge/rebase — expected, not addressed here.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ae343fed-f80d-4e20-a24d-260f0fd82a31

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jnasbyupgrade]

Verification results

ci.yml (actions/checkout@v5 -> v7): run 30952577158 - all 12 PostgreSQL matrix jobs + all-checks-passed succeeded. Confirmed from job logs that the action actually resolved to v7 (Download action repository 'actions/checkout@v7' (SHA:3d3c42e5aac5ba805825da76410c181273ba90b1)), and no Node.js deprecation warning appears anywhere in that job's log - the original motivating warning is gone.

claude-code-review.yml (checkout@v4 -> v7 + allow-unsafe-pr-checkout: true): run 30952577018 - the claude-review job failed at the "Check out PR head" step with:

##[error]Refusing to check out fork pull request code from a 'pull_request_target' workflow...

This is expected and not caused by this PR. pull_request_target always executes the workflow file from the base branch (master), never the PR's own copy - so this run exercised master's current, unmodified claude-code-review.yml (still on actions/checkout@v4, no allow-unsafe-pr-checkout), not the fix in this branch. It reproduces the same known-failing state described in #15.

Correcting something from this PR's own description: I called #15 an "unrelated checkout-failure fix" for this same step, but reading #15's diff, it's not unrelated - it adds the identical allow-unsafe-pr-checkout: true line to the same checkout step (root-caused there to actions/checkout v4.4.0+ backporting this refusal to all major tags, per https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/). #15 stays on @v4; this PR additionally bumps to @v7. Whichever of the two merges first will make the other's allow-unsafe-pr-checkout addition redundant on rebase (straightforward conflict, not a semantic disagreement).

Per #15's own findings, full verification of the checkout fix requires merging to master and observing a subsequent PR's claude-review run succeed - it cannot be self-verified from either PR's own run.

anthropics/claude-code-action@v1: left unchanged (confirmed no v2 exists via gh api repos/anthropics/claude-code-action/releases/tags).