chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates

[dependabot]

Bumps the actions-minor-patch group with 2 updates in the / directory: actions/checkout and pypa/gh-action-pypi-publish.

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.1

🛠️ Internal Dependencies

@​adisivaprasad💰 helped get rid of the GitHub Actions runner warning about the old Node 20 runtime being used by updating actions/setup-python from v5.6.0 to v6.2.0 in #408.

💪 New Contributors

• @​adisivaprasad made their first contribution in #408
• @​jylenhof💰 followed up and reminded us to actually cut this release in #413

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.0...v1.14.1

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​jylenhof💰 for reminding me to work on this release!

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

• ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
• a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
• See full diff in compare view

[github-actions]

🔁 AI review rerun (requested by @igerber)

Head SHA: d0f5a6b6dfed9f6d151b0c891c98aeb767be4164

---

Overall Assessment: ✅ Looks good

Executive Summary

• Only immutable GitHub Action commit pins changed.
• No estimator, inference, methodology, or default behavior is affected.
• All 16 actions/checkout references were updated consistently.
• The PyPI publishing action remains commit-SHA pinned.
• No stale pins, secrets, or permission changes were found.

Methodology

• Severity: N/A
  Impact: No causal estimators, assumptions, weighting, variance, or inference code changed; Registry cross-check is not applicable.
  Concrete fix: None.

Code Quality

• Severity: N/A
  Impact: The version updates are consistent across all affected workflows.
  Concrete fix: None.

Performance

• Severity: N/A
  Impact: No project runtime or algorithmic performance changes.
  Concrete fix: None.

Maintainability

• Severity: N/A
  Impact: Full-length immutable pins and version comments are preserved, including .github/workflows/ai_pr_review.yml:L184-L195 and .github/workflows/publish.yml:L32.
  Concrete fix: None.

Tech Debt

• Severity: N/A
  Impact: No new limitation or deferred work introduced.
  Concrete fix: None.

Security

• Severity: N/A
  Impact: Actions remain SHA-pinned, and workflow permissions are unchanged. No secrets were added.
  Concrete fix: None.

Documentation/Tests

• Severity: N/A
  Impact: No documentation or library-test changes are needed for these pin-only dependency updates.
  Concrete fix: None.