ci: actions/checkout v7.0.0 with consistent SHA-pin comments (supersedes #605)

[hyperpolymath]

Supersedes #605 with the cosmetic defect from my /review resolved. (I couldn't push the fix onto #605's branch — GitHub returns 403 on dependabot/* branches — so this carries Dependabot's exact bump commit plus the correction.)

What's here

1. Dependabot's commit (69f7fcc) — actions/checkout v6.0.3 → v7.0.0 (df4cb1c… → 9c091bb…), unchanged.
2. Comment normalization (0df4a5e) — every actions/checkout line now reads # v7.0.0. ci: bump actions/checkout from 6.0.3 to 7.0.0 #605 left 14 lines tagged # v4 (they'd been mislabeled # v4 in ci: fix standalone-CI fallout — SHA-pin actions, de-trip secret scanner #604/fix(codegen-deno): don't re-declare preamble Option/Result constructors #606, where that SHA was actually v6.0.3), so the v7 SHA was carrying a # v4 comment. Also adds the missing comment on publish-jsr.yml's bare line and refreshes the ci.yml pin note.

setup-node / upload-artifact remain genuinely v4 and are untouched. Comments only beyond Dependabot's commit — no SHA or logic change.

Why it's safe

• SHA-pinned (9c091bb…), so compatible with the repo's "allowed actions" policy (tag refs would startup_fail).
• v7's only breaking change (blocking fork-PR checkout for pull_request_target / workflow_run) does not apply — the repo uses neither trigger.
• YAML validated on all 14 workflows; the genuine-v4 actions verified untouched.

Action for you

Merge this and close #605 (this is its corrected equivalent). If you'd rather keep #605, close this instead and I'll land the comment fix as a follow-up once #605 merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 43 issues detected

Severity	Count
🔴 Critical	2
🟠 High	25
🟡 Medium	16

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affinescript-cli/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (2 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affine-vscode/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-vite/src/affine-plugin-improved.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (32 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/wasm_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (29 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/affine_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/panic.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/alloc.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence