ci(review): pin actions/checkout to v7.0.1

.github/workflows/ci.yml.example

@@ -10,6 +10,6 @@ jobs:
     name: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # Replace with project-specific setup and validation commands.
       - run: echo "Configure CI for this project"

.github/workflows/review.yml

@@ -11,15 +11,15 @@ jobs:
     name: repository checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: ./scripts/check-repository.sh
 
   pr-title:
     name: conventional PR title
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: ./scripts/check-pr-title.sh "$PR_TITLE"
         env:
           PR_TITLE: ${{ github.event.pull_request.title }}
@@ -30,7 +30,7 @@ jobs:
     if: github.event_name == 'pull_request' && github.event.pull_request.user.type != 'Bot'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: printf '%s\n' "$PR_BODY" | ./scripts/check-pr-body.sh
         env:
           PR_BODY: ${{ github.event.pull_request.body }}

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Unreleased
 
+- Workflows pin `actions/checkout` to the v7.0.1 commit SHA; downstream repositories take action bumps from this template instead of editing `review.yml` locally.
 - `configure-github-repository.sh` accepts `--approvals N` (use 0 for a single maintainer) and repeatable `--check NAME` for project CI jobs.
 - Removed trailing blank lines that failed `git diff --cached --check` in repositories copying the template files.
 - Plans now pair technical decisions with a detailed execution plan: preconditions, completion contract, ordered tasks with exit conditions, validation ledger, and rollback per batch.