From 754c76eccca084c93f7cd7d1113822ee5a5f90bd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 12 Jul 2026 00:12:58 +0000
Subject: [PATCH 1/5] .github: Bump actions/checkout from 6.0.3 to 7.0.0

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/backport.yml            | 2 +-
 .github/workflows/bot.yml                 | 2 +-
 .github/workflows/check.yml               | 6 +++---
 .github/workflows/comment.yml             | 2 +-
 .github/workflows/eval.yml                | 4 ++--
 .github/workflows/lint.yml                | 2 +-
 .github/workflows/merge-group.yml         | 2 +-
 .github/workflows/periodic-merge.yml      | 2 +-
 .github/workflows/pull-request-target.yml | 2 +-
 .github/workflows/review.yml              | 2 +-
 .github/workflows/teams.yml               | 2 +-
 .github/workflows/test.yml                | 2 +-
 12 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 6df5e18009fa..575d38d82d36 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           # Avoid materializing full nixpkgs tree
diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml
index 3e404d89c8c2..771705428cc2 100644
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-slim
     if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 84c34887b7f3..6e0547de265a 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           path: trusted
@@ -101,7 +101,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           path: trusted
@@ -147,7 +147,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           path: trusted
diff --git a/.github/workflows/comment.yml b/.github/workflows/comment.yml
index ab56a3608d0f..fd8073acbffa 100644
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index f971aa0229da..29c940accfd0 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -50,7 +50,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           path: trusted
@@ -58,7 +58,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 11bf76a7dbd6..f0ee0050870a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -122,7 +122,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted
diff --git a/.github/workflows/merge-group.yml b/.github/workflows/merge-group.yml
index e2ef4e77fe9c..cfb2968f0954 100644
--- a/.github/workflows/merge-group.yml
+++ b/.github/workflows/merge-group.yml
@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/periodic-merge.yml b/.github/workflows/periodic-merge.yml
index d84de7d4b26a..64616cc036c0 100644
--- a/.github/workflows/periodic-merge.yml
+++ b/.github/workflows/periodic-merge.yml
@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-issues: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/pull-request-target.yml b/.github/workflows/pull-request-target.yml
index 98d463cb588d..0bed3b6ce7d6 100644
--- a/.github/workflows/pull-request-target.yml
+++ b/.github/workflows/pull-request-target.yml
@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
index 9e5d32e81315..d6ec66453d98 100644
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/teams.yml b/.github/workflows/teams.yml
index 5e8e20497b7f..cbd3eaf110be 100644
--- a/.github/workflows/teams.yml
+++ b/.github/workflows/teams.yml
@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index f5a6c1bfcec4..a66bdace4061 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

From 8c09b93f2726977605fe5323d8695b04cbad8eda Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 2 Aug 2026 17:56:02 +0000
Subject: [PATCH 2/5] .github: Bump actions/checkout from 6.0.3 to 7.0.1

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/backport.yml            | 2 +-
 .github/workflows/bot.yml                 | 2 +-
 .github/workflows/check.yml               | 6 +++---
 .github/workflows/comment.yml             | 2 +-
 .github/workflows/eval.yml                | 4 ++--
 .github/workflows/lint.yml                | 2 +-
 .github/workflows/merge-group.yml         | 2 +-
 .github/workflows/periodic-merge.yml      | 2 +-
 .github/workflows/pull-request-target.yml | 2 +-
 .github/workflows/review.yml              | 2 +-
 .github/workflows/teams.yml               | 2 +-
 .github/workflows/test.yml                | 2 +-
 12 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 575d38d82d36..157708e03634 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           # Avoid materializing full nixpkgs tree
diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml
index 771705428cc2..d47bcc942131 100644
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-slim
     if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 6e0547de265a..06f9fa8d8e90 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: trusted
@@ -101,7 +101,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: trusted
@@ -147,7 +147,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: trusted
diff --git a/.github/workflows/comment.yml b/.github/workflows/comment.yml
index fd8073acbffa..73b6e03bfa40 100644
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 29c940accfd0..acad9f3467ac 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -50,7 +50,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: trusted
@@ -58,7 +58,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index f0ee0050870a..ef2a63b0962b 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -122,7 +122,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 8
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted
diff --git a/.github/workflows/merge-group.yml b/.github/workflows/merge-group.yml
index cfb2968f0954..a53f38f194df 100644
--- a/.github/workflows/merge-group.yml
+++ b/.github/workflows/merge-group.yml
@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/periodic-merge.yml b/.github/workflows/periodic-merge.yml
index 64616cc036c0..9398f3ea2310 100644
--- a/.github/workflows/periodic-merge.yml
+++ b/.github/workflows/periodic-merge.yml
@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-issues: write
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/pull-request-target.yml b/.github/workflows/pull-request-target.yml
index 0bed3b6ce7d6..0c90a89dabb2 100644
--- a/.github/workflows/pull-request-target.yml
+++ b/.github/workflows/pull-request-target.yml
@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
index d6ec66453d98..caf9421ff45b 100644
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/teams.yml b/.github/workflows/teams.yml
index cbd3eaf110be..8bf0e0419c19 100644
--- a/.github/workflows/teams.yml
+++ b/.github/workflows/teams.yml
@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a66bdace4061..cb00b3367b1e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

From 03b746c7ad4347769882436981bb6ae5a07ad10a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 2 Oct 2026 11:25:34 +0000
Subject: [PATCH 3/5] .github: Bump actions/checkout in
 /.github/actions/checkout

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/actions/checkout/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/checkout/action.yml b/.github/actions/checkout/action.yml
index ab8c663e0f0e..60171fee28d4 100644
--- a/.github/actions/checkout/action.yml
+++ b/.github/actions/checkout/action.yml
@@ -15,7 +15,7 @@ runs:
   steps:
     # We don't actually need anything in this directory, but we need a small
     # sparse checkout, and this directory is small.
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
         sparse-checkout: .github/actions

From 6f7123756191ca4feb81b0bbe0c74a02559d6b42 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Fri, 2 Oct 2026 05:31:18 -0700
Subject: [PATCH 4/5] workflows/backport: allow fork PR checkout with
 actions/checkout v7

actions/checkout v7 refuses to check out fork PR commits from
pull_request_target workflows unless allow-unsafe-pr-checkout is set.
The backport job checks out the merged PR's head to cherry-pick it,
which broke after #545205 and led to the revert in #546423.

The PR is already merged and its commits are only handled by git,
never executed, so opting in is safe.

Assisted-by: Claude Code (claude-opus-5-5)
---
 .github/workflows/backport.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 157708e03634..e2ea3d07142c 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -43,6 +43,9 @@ jobs:
           sparse-checkout: .
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
+          # The PR is already merged, and its commits are only cherry-picked by
+          # git, never executed, so checking out fork PR commits is safe here.
+          allow-unsafe-pr-checkout: true
 
       - name: Log current API rate limits
         env:

From 9d1a3338ee5236dd844d1531ce2861fdeb660b0f Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Fri, 2 Oct 2026 05:31:18 -0700
Subject: [PATCH 5/5] workflows/eval: allow fork PR checkout of ci/pinned.json

actions/checkout v7 refuses to check out fork PR commits from
pull_request_target workflows unless allow-unsafe-pr-checkout is set.
The versions job checks out ci/pinned.json at the PR's merge commit,
which matches pull_request.merge_commit_sha (or head.sha) in the event
payload and would be rejected.

Only ci/pinned.json is checked out, without persisted credentials, and
it is read as data by trusted/ci/supportedVersions.nix, so opting in is
safe.

Assisted-by: Claude Code (claude-opus-5-5)
---
 .github/workflows/eval.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index acad9f3467ac..16a758aba5f9 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -65,6 +65,9 @@ jobs:
           path: untrusted
           sparse-checkout: |
             ci/pinned.json
+          # ci/pinned.json is only read as data by trusted/ci/supportedVersions.nix,
+          # so checking out the fork PR's merge commit is safe here.
+          allow-unsafe-pr-checkout: true
 
       - name: Find commit that touched ci/pinned.json
         id: find-pinned-commit