From b07a21ca35891197451b776292237a952aac5a31 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 18 Jun 2026 17:51:41 +0000
Subject: [PATCH] Update multiple dependencies to v7

---
 .github/workflows/build-browser-extension.yaml    | 2 +-
 .github/workflows/build-go-container-image.yaml   | 2 +-
 .github/workflows/build-java-container-image.yaml | 2 +-
 .github/workflows/main.yaml                       | 2 +-
 .github/workflows/pull-request.yaml               | 2 +-
 .github/workflows/release-browser-extension.yaml  | 2 +-
 .github/workflows/release-mkdocs.yaml             | 2 +-
 .github/workflows/release-skaffold.yaml           | 2 +-
 .github/workflows/release-terraform.yaml          | 2 +-
 .github/workflows/verify-asyncapi.yaml            | 6 +++---
 .github/workflows/verify-github-workflows.yaml    | 4 ++--
 .github/workflows/verify-go-project.yaml          | 2 +-
 .github/workflows/verify-java-project.yaml        | 4 ++--
 .github/workflows/verify-javascript-project.yaml  | 2 +-
 .github/workflows/verify-kustomization.yaml       | 6 +++---
 .github/workflows/verify-mkdocs.yaml              | 6 +++---
 .github/workflows/verify-openapi.yaml             | 6 +++---
 .github/workflows/verify-project-yaml.yaml        | 4 ++--
 .github/workflows/verify-python-project.yaml      | 2 +-
 .github/workflows/verify-rego-policy.yaml         | 6 +++---
 .github/workflows/verify-renovate-config.yaml     | 2 +-
 .github/workflows/verify-terraform.yaml           | 8 ++++----
 22 files changed, 38 insertions(+), 38 deletions(-)

diff --git a/.github/workflows/build-browser-extension.yaml b/.github/workflows/build-browser-extension.yaml
index 20c7f26..9b31ba9 100644
--- a/.github/workflows/build-browser-extension.yaml
+++ b/.github/workflows/build-browser-extension.yaml
@@ -22,5 +22,5 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - run: zip -r "${{ inputs.extension-name }}.${{ inputs.release-version }}.zip" ${{ inputs.directory }}
diff --git a/.github/workflows/build-go-container-image.yaml b/.github/workflows/build-go-container-image.yaml
index c744c14..e529ff8 100644
--- a/.github/workflows/build-go-container-image.yaml
+++ b/.github/workflows/build-go-container-image.yaml
@@ -16,7 +16,7 @@ jobs:
       id-token: write # Fetch OIDC Token for GCP Auth
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/build-java-container-image.yaml b/.github/workflows/build-java-container-image.yaml
index 00be4a8..b595ffe 100644
--- a/.github/workflows/build-java-container-image.yaml
+++ b/.github/workflows/build-java-container-image.yaml
@@ -16,7 +16,7 @@ jobs:
       id-token: write # Fetch OIDC Token for GCP Auth
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
         with:
           distribution: temurin
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 0739820..de8f921 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -19,5 +19,5 @@ jobs:
       contents: read
     runs-on: ubuntu-latest # yamllint already installed in `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: yamllint --strict .yamllint.yaml
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index c54ad13..1bbfbf8 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -19,5 +19,5 @@ jobs:
       contents: read
     runs-on: ubuntu-latest # yamllint already installed in `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: yamllint --strict .yamllint.yaml
diff --git a/.github/workflows/release-browser-extension.yaml b/.github/workflows/release-browser-extension.yaml
index 79ed8b6..b0cce0d 100644
--- a/.github/workflows/release-browser-extension.yaml
+++ b/.github/workflows/release-browser-extension.yaml
@@ -24,7 +24,7 @@ jobs:
       contents: write # Need write permission in order to create release with
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - run: zip -r "${{ inputs.extension-name }}.${{ inputs.release-version }}.zip" ${{ inputs.directory }}
       - run: gh release create ${{ inputs.release-version }} ${{ inputs.extension-name }}.${{ inputs.release-version }}.zip
         env:
diff --git a/.github/workflows/release-mkdocs.yaml b/.github/workflows/release-mkdocs.yaml
index 7afaba3..c9ad3e9 100644
--- a/.github/workflows/release-mkdocs.yaml
+++ b/.github/workflows/release-mkdocs.yaml
@@ -8,7 +8,7 @@ jobs:
   mkdocs-gh-deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version-file: .python-version
diff --git a/.github/workflows/release-skaffold.yaml b/.github/workflows/release-skaffold.yaml
index bc3c2d1..1116f35 100644
--- a/.github/workflows/release-skaffold.yaml
+++ b/.github/workflows/release-skaffold.yaml
@@ -37,7 +37,7 @@ jobs:
       id-token: write # Fetch OIDC Token for GCP Auth
     runs-on: ubuntu-latest # Google Cloud CLI is already installed on `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       # Install skaffold, as per: https://skaffold.dev/docs/install/
       - run: |
           curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/latest/skaffold-linux-amd64
diff --git a/.github/workflows/release-terraform.yaml b/.github/workflows/release-terraform.yaml
index 5d9e8c1..e0edd97 100644
--- a/.github/workflows/release-terraform.yaml
+++ b/.github/workflows/release-terraform.yaml
@@ -23,7 +23,7 @@ jobs:
       id-token: write # Fetch OIDC Token for GCP Auth
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
diff --git a/.github/workflows/verify-asyncapi.yaml b/.github/workflows/verify-asyncapi.yaml
index 4d920c5..adc4240 100644
--- a/.github/workflows/verify-asyncapi.yaml
+++ b/.github/workflows/verify-asyncapi.yaml
@@ -20,7 +20,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest # yamllint already installed in `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: ${{ inputs.use-local-yamllint-config }} || wget https://raw.githubusercontent.com/Harmelodic/workflows/refs/heads/main/.yamllint.yaml --output-document=.yamllint.yaml
       - run: yamllint --strict ${{ inputs.specification }}
   yamllint-spectral-config:
@@ -28,7 +28,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest # yamllint already installed in `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: ${{ inputs.use-local-yamllint-config }} || wget https://raw.githubusercontent.com/Harmelodic/workflows/refs/heads/main/.yamllint.yaml --output-document=.yamllint.yaml
       - run: yamllint --strict .spectral.yaml
   spectral-lint-asyncapi:
@@ -36,7 +36,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       - run: npm install -g @stoplight/spectral-cli
       - run: spectral lint ${{ inputs.specification }}
diff --git a/.github/workflows/verify-github-workflows.yaml b/.github/workflows/verify-github-workflows.yaml
index c849bdd..be88ad1 100644
--- a/.github/workflows/verify-github-workflows.yaml
+++ b/.github/workflows/verify-github-workflows.yaml
@@ -16,7 +16,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest # yamllint already installed in `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: ${{ inputs.use-local-yamllint-config }} || wget https://raw.githubusercontent.com/Harmelodic/workflows/refs/heads/main/.yamllint.yaml --output-document=.yamllint.yaml
       - run: yamllint --strict .github/workflows
   schema-validation:
@@ -24,7 +24,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: npm install -g ajv-cli
       - run: wget https://www.schemastore.org/github-workflow.json
       - run: find .github/workflows/*.yaml | xargs -I {} ajv --strict=false -s github-workflow.json -d {}
diff --git a/.github/workflows/verify-go-project.yaml b/.github/workflows/verify-go-project.yaml
index 339ba6f..b5ec14d 100644
--- a/.github/workflows/verify-go-project.yaml
+++ b/.github/workflows/verify-go-project.yaml
@@ -10,7 +10,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: .go-version
diff --git a/.github/workflows/verify-java-project.yaml b/.github/workflows/verify-java-project.yaml
index 6e313f9..d9f072d 100644
--- a/.github/workflows/verify-java-project.yaml
+++ b/.github/workflows/verify-java-project.yaml
@@ -16,7 +16,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest # yamllint already installed in `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: ${{ inputs.use-local-yamllint-config }} || wget https://raw.githubusercontent.com/Harmelodic/workflows/refs/heads/main/.yamllint.yaml --output-document=.yamllint.yaml
       - run: yamllint --strict src
   maven-verify:
@@ -24,7 +24,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
         with:
           distribution: temurin
diff --git a/.github/workflows/verify-javascript-project.yaml b/.github/workflows/verify-javascript-project.yaml
index da3f7ef..5eb3309 100644
--- a/.github/workflows/verify-javascript-project.yaml
+++ b/.github/workflows/verify-javascript-project.yaml
@@ -8,7 +8,7 @@ jobs:
   npm-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
diff --git a/.github/workflows/verify-kustomization.yaml b/.github/workflows/verify-kustomization.yaml
index 161facf..3bb5e79 100644
--- a/.github/workflows/verify-kustomization.yaml
+++ b/.github/workflows/verify-kustomization.yaml
@@ -20,7 +20,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest # yamllint already installed in `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: ${{ inputs.use-local-yamllint-config }} || wget https://raw.githubusercontent.com/Harmelodic/workflows/refs/heads/main/.yamllint.yaml --output-document=.yamllint.yaml
       - run: yamllint --strict ${{ inputs.directory }}
   kustomize-build:
@@ -28,7 +28,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - run: sudo snap install kustomize
       - run: kustomize build ${{ inputs.directory }}
   conftest-test:
@@ -36,7 +36,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - run: sudo snap install kustomize
       - name: Install conftest as per https://www.conftest.dev/install/
         run: |
diff --git a/.github/workflows/verify-mkdocs.yaml b/.github/workflows/verify-mkdocs.yaml
index 0ee07a8..e8778fa 100644
--- a/.github/workflows/verify-mkdocs.yaml
+++ b/.github/workflows/verify-mkdocs.yaml
@@ -16,7 +16,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest # yamllint already installed in `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: ${{ inputs.use-local-yamllint-config }} || wget https://raw.githubusercontent.com/Harmelodic/workflows/refs/heads/main/.yamllint.yaml --output-document=.yamllint.yaml
       - run: yamllint --strict docs/
       - run: yamllint --strict mkdocs.yaml
@@ -25,7 +25,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23
         with:
           globs: '**/*.md' # Lint all Markdown files in the project.
@@ -34,7 +34,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version-file: .python-version
diff --git a/.github/workflows/verify-openapi.yaml b/.github/workflows/verify-openapi.yaml
index f59d0ff..5079edd 100644
--- a/.github/workflows/verify-openapi.yaml
+++ b/.github/workflows/verify-openapi.yaml
@@ -20,7 +20,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest # yamllint already installed in `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: ${{ inputs.use-local-yamllint-config }} || wget https://raw.githubusercontent.com/Harmelodic/workflows/refs/heads/main/.yamllint.yaml --output-document=.yamllint.yaml
       - run: yamllint --strict ${{ inputs.specification }}
   yamllint-spectral-config:
@@ -28,7 +28,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest # yamllint already installed in `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: ${{ inputs.use-local-yamllint-config }} || wget https://raw.githubusercontent.com/Harmelodic/workflows/refs/heads/main/.yamllint.yaml --output-document=.yamllint.yaml
       - run: yamllint --strict .spectral.yaml
   spectral-lint-openapi:
@@ -36,7 +36,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       - run: npm install -g @stoplight/spectral-cli
       - run: spectral lint ${{ inputs.specification }}
diff --git a/.github/workflows/verify-project-yaml.yaml b/.github/workflows/verify-project-yaml.yaml
index d56c9aa..81a3dc6 100644
--- a/.github/workflows/verify-project-yaml.yaml
+++ b/.github/workflows/verify-project-yaml.yaml
@@ -16,7 +16,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest # yamllint already installed in `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: ${{ inputs.use-local-yamllint-config }} || wget https://raw.githubusercontent.com/Harmelodic/workflows/refs/heads/main/.yamllint.yaml --output-document=.yamllint.yaml
       - run: yamllint --strict .
   require-no-yml-extension:
@@ -24,7 +24,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       - run: |
           if find . | grep ".yml$"; then
diff --git a/.github/workflows/verify-python-project.yaml b/.github/workflows/verify-python-project.yaml
index 9ef9c46..ec3ed01 100644
--- a/.github/workflows/verify-python-project.yaml
+++ b/.github/workflows/verify-python-project.yaml
@@ -15,7 +15,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version-file: .python-version
diff --git a/.github/workflows/verify-rego-policy.yaml b/.github/workflows/verify-rego-policy.yaml
index 4fd81e3..ac182fb 100644
--- a/.github/workflows/verify-rego-policy.yaml
+++ b/.github/workflows/verify-rego-policy.yaml
@@ -16,7 +16,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest # yamllint already installed in `ubuntu-latest` runner image.
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7
       - run: ${{ inputs.use-local-yamllint-config }} || wget https://raw.githubusercontent.com/Harmelodic/workflows/refs/heads/main/.yamllint.yaml --output-document=.yamllint.yaml
       - run: yamllint --strict .regal.yaml
   conftest-verify:
@@ -24,7 +24,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Install conftest as per https://www.conftest.dev/install/
         run: |
           LATEST_VERSION=$(wget -O - "https://api.github.com/repos/open-policy-agent/conftest/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/' | cut -c 2-)
@@ -39,7 +39,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Install Regal as per https://github.com/StyraInc/regal/
         run: |
           curl -L -o regal "https://github.com/StyraInc/regal/releases/latest/download/regal_Linux_x86_64"
diff --git a/.github/workflows/verify-renovate-config.yaml b/.github/workflows/verify-renovate-config.yaml
index c2e1ba6..bd0d7b5 100644
--- a/.github/workflows/verify-renovate-config.yaml
+++ b/.github/workflows/verify-renovate-config.yaml
@@ -8,7 +8,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: rinchsan/renovate-config-validator@8cf44ae5646f111f838a03ac7ebd4e1c1f9be983 # v0.2.1
         with:
           pattern: '*.json' # Regular expression for filename to validate, default to *.json
diff --git a/.github/workflows/verify-terraform.yaml b/.github/workflows/verify-terraform.yaml
index bddbee7..a1e9e54 100644
--- a/.github/workflows/verify-terraform.yaml
+++ b/.github/workflows/verify-terraform.yaml
@@ -20,7 +20,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: terraform-linters/setup-tflint@b480b8fcdaa6f2c577f8e4fa799e89e756bb7c93 # v6
       - run: ${{ inputs.use-local-tflint-config }} || wget https://raw.githubusercontent.com/Harmelodic/workflows/refs/heads/main/.tflint.hcl --output-document=.tflint.hcl
       - run: tflint --init
@@ -30,7 +30,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.14"
@@ -41,7 +41,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
       - run: terraform -chdir=${{ inputs.directory }} fmt -recursive && git diff --exit-code
   terraform-validate:
@@ -50,7 +50,7 @@ jobs:
       id-token: write # Fetch OIDC Token for GCP Auth
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
