chore(deps): bump actions/checkout from 6.0.2 to 7.0.1

[dependabot]

Dependency update

Update actions/checkout from the fully pinned v6.0.2 commit to the fully pinned v7.0.1 commit in all three repository workflows.

The branch previously carried an unrelated R package ABI workaround. That workflow logic has been removed, leaving only the checkout SHA update. #212 remains the single RcppParallel/oneTBB repair path.

The v7 line includes safer defaults for pull_request_target/workflow_run, SHA-256 repository handling inherited from later v6 releases, and dependency/security fixes. No workflow permissions or checkout inputs are expanded.

Merge only after current-head required checks, all review threads, and an independent approval.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 87565b2ffc9a9d4afed9e4dcf9a5b5d27cecb0ed.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• R CMD check/check: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/30213864555/job/89824533862)
• check check run: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/30213864555/job/89824533862)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 5bdae48079183edfeecdf46f420a9fe846c88c82
• Workflow run: 31832568320
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (exit 0)

R[\"r.yml check job\"]; R -->|\"step 6 Set up R package dependencies, exit code 1\"| F[\"R CMD check/check FAILURE (run 31784083807)\"]; F --> M[\"Main risk: required check red at head 5bdae48\"]; M --> V[\"Verification: re-run R CMD check/check until step 6 passes\"]; P --> Q[\"code-quality.yml quality job\"] --> N[\"No failed check listed; only pin SHA changed\"]; P --> S[\"security-audit.yml gitleaks scan\"] --> T[\"sha256sum checksum verification unchanged\"]","adversarial_validation":{"status":"failed","probes":[{"path":".github/workflows/r.yml","line":30,"hypothesis":"The PR head does not pass its required CI: the r.yml 'check' job fails at step 6 'Set up R package dependencies' with exit code 1, so merging would land a red required check on main.","attack_or_counterexample":"Run the R CMD check workflow against head SHA 5bdae48; step 6 'Set up R package dependencies' executes on the head that includes this changed checkout pin.","evidence":"Trusted current-head Failed GitHub Check evidence for head 5bdae48 reports 'R CMD check/check' check run 94715990535 (workflow run 31784083807) with conclusion FAILURE, failing step 6 'Set up R package dependencies', annotation '.github:9038-9038 [failure] Process completed with exit code 1.' and log signal '##[error]Process completed with exit code 1.'; no superseded successful same-head run is listed; source-line-sha256=bde56961e64d92c056cceb98f8237a7e03ba6927930431fd88e3da5c506abe7f at .github/workflows/r.yml:30","outcome":"confirmed"},{"path":".github/workflows/code-quality.yml","line":23,"hypothesis":"The checkout pin substitution silently drops checkout inputs (token, fetch-depth, submodules) or workflow permissions that later steps depend on.","attack_or_counterexample":"Compare the checkout step bytes before and after the bump in the focused hunks and check for any with:-block, permissions change, or harden-runner egress-policy change.","evidence":"Trusted focused hunks show each diff is exactly one line per file: the 40-hex pin changes from de0fac2e4500dabe0009e67214ff5f5447ce83dd to 3d3c42e5aac5ba805825da76410c181273ba90b1 with no with: inputs on the checkout step in any of the three workflows; the harden-runner step (egress-policy: audit) and the permissions block are unchanged, so no input or permission could be dropped; no code-quality job failure is listed in current-head Failed GitHub Check evidence; source-line-sha256=bde56961e64d92c056cceb98f8237a7e03ba6927930431fd88e3da5c506abe7f at .github/workflows/code-quality.yml:23","outcome":"falsified"},{"path":".github/workflows/security-audit.yml","line":23,"hypothesis":"The bump weakens the secret-scan supply chain, e.g., by altering the gitleaks checksum verification step.","attack_or_counterexample":"Inspect the security-audit.yml focused hunk for changes to the gitleaks install step (checksums download and sha256sum -c verification) alongside the checkout pin change.","evidence":"Trusted focused hunk for security-audit.yml shows the gitleaks install step still runs 'grep \"$GITLEAKS_FILE\" gitleaks_checksums.txt | sha256sum -c -' before extraction and sits outside the changed lines; the only changed line is the checkout pin, so the checksum-verified supply chain is preserved by the diff trace; no security-audit workflow failure is listed in current-head Failed GitHub Check evidence; source-line-sha256=bde56961e64d92c056cceb98f8237a7e03ba6927930431fd88e3da5c506abe7f at .github/workflows/security-audit.yml:23","outcome":"falsified"}],"residual_risk":"If the R CMD check/check failure is environment-flaky or the pre-existing #212 RcppParallel/oneTBB ABI issue, the checkout pin bump itself may be safe; a successful re-run of the 'check' job on head 5bdae48 would falsify the blocker. Residual: a trusted same-head green run is required to confirm, and the revert suggestion is diagnostic isolation only."},"findings":[{"path":".github/workflows/r.yml","line":30,"severity":"P1","title":"Active required check R CMD check/check fails on head SHA 5bdae48","problem":"Current-head Failed GitHub Check evidence reports check run 94715990535 (workflow run 31784083807) for 'R CMD check/check' with conclusion FAILURE: step 6 'Set up R package dependencies' exits with code 1 (annotation '.github:9038-9038 [failure] Process completed with exit code 1.', log signal '##[error]Process completed with exit code 1.'). No superseded successful same-head run is listed, so the required check is red at PR head 5bdae48 and the PR cannot be approved while it fails.","root_cause":"The failure is undiagnosed by trusted evidence. The PR body attributes the R dependency-setup breakage to the separate RcppParallel/oneTBB ABI issue (#212), but that attribution is untrusted quoted text; there is no trusted same-head green run or base-parity proof that the checkout pin bump is exonerated.","fix_direction":"Get 'R CMD check/check' green at head SHA 5bdae48: rebase/merge the current base (which the PR body states carries the #212 repair path) into this branch or land the ABI repair on this branch, then re-run the workflow until step 6 'Set up R package dependencies' completes. As a diagnostic isolation step, verify whether reverting the checkout pin in r.yml changes the outcome; if the failure only occurs with the 7.0.1 pin, keep the old pin and file a separate checkout bump.","regression_test_direction":"Re-run the 'check' job of .github/workflows/r.yml (workflow 'R CMD check') on the updated head and require step 6 'Set up R package dependencies' to pass without 'Process completed with exit code 1.'.","suggested_diff":"```diff\n- uses: actions/checkout@3d3c42e\n+ uses: actions/checkout@de0fac2\n```"}]}

-->

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 4b9296ad4187094f75a1a10f3a876ae8cafb6186.

• Head SHA: 4b9296ad4187094f75a1a10f3a876ae8cafb6186

• Workflow run: 31640424283

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 5bdae48079183edfeecdf46f420a9fe846c88c82.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• R CMD check/check: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31784083807/job/94715990535)
• check check run: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31784083807/job/94715990535)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading