CI: bump actions/checkout to v7 (v4 targets Node.js 20, now deprecated)

[jnasbyupgrade]

GitHub Actions runners have started warning that Node.js 20 is deprecated and actions pinned to it are being forced onto Node.js 24 at runtime. actions/checkout@v4 is one of those; v7 is the current latest major and already targets Node 24 natively. Bumped every actions/checkout@v4 reference across ci.yml, claude-code-review.yml, and claude.yml.

Also fixes two latent issues in claude-code-review.yml found by checking a real run's log (unrelated to the checkout bump, but the same file was already open):

• Added claude_args: '--allowedTools mcp__github_inline_comment__create_inline_comment'. The review runs in agent mode (a bare prompt:, no @claude mention), which only registers MCP tools listed in claude_args, not the code-review plugin's own frontmatter - without this the inline-comment tool never starts and every review was silently falling back to one consolidated PR comment instead of real inline comments.
• Added actions: write to the job's permissions. There's no narrower cache-write-only scope; without it, the action's internal cache-save step was silently failing with a warning every run, with the job still reporting success.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a657e123-4200-40f0-9119-f8df1294d129

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Claude finished @jnasbyupgrade's task in 1m 45s —— View job

---

Code Review: CI: bump actions/checkout to v7

• Gather context (PR body, diff, workflow files)
• Review ci.yml changes
• Review claude-code-review.yml changes
• Review claude.yml changes
• Post review feedback

Summary

Clean, well-scoped maintenance change. All 5 actions/checkout call sites across the 3 workflows are bumped from v4 → v7, and exactly one of them (claude-code-review.yml's "Check out PR head" step) gets the extra allow-unsafe-pr-checkout: true opt-in — correctly, since it's the only site that both runs under pull_request_target and checks out a fork's PR head (repository: ${{ github.event.pull_request.head.repo.full_name }}, ref: ${{ github.event.pull_request.head.sha }}).

I verified the other 4 sites don't need the opt-in:

• ci.yml's three checkouts run on plain pull_request/push and check out the same repo's own ref — v7's fork-checkout guard doesn't apply.
• claude.yml's checkout is triggered by issue_comment/issues/pull_request_review*, none of which are pull_request_target or workflow_run, and it also checks out the default ref (no fork override).

The added allow-unsafe-pr-checkout: true opt-in in claude-code-review.yml (lines 94-101) is justified by, and documented right next to, the pre-existing security guards on that job (.github/workflows/claude-code-review.yml:33-35): gated to jnasbyupgrade's own PRs via github.event.pull_request.user.login, persist-credentials: false, and the checked-out code is only ever read for review context, never built or executed. That reasoning matches the PR description and holds up against the actual job condition.

Notes (non-blocking)

• I don't have network access in this environment, so I couldn't independently confirm against the actual actions/checkout v7 release notes that allow-unsafe-pr-checkout is the exact real input name/behavior introduced for the fork-PR-under-pull_request_target guard. The PR description already flags that a real CI run is needed to confirm the Node 24 deprecation warning is gone — that same CI run will also prove out whether this input name/behavior is correct (if it's wrong, the "Check out PR head" step would simply fail outright, so it's a fail-fast risk, not a silent one).
• No other actions/checkout, workflow_run, or pull_request_target usages exist elsewhere in .github/workflows/ that were missed.

No bugs or security issues found; nothing to change.

[github-actions]

Claude finished @jnasbyupgrade's task in 2m 0s —— View job

---

Code Review: CI: bump actions/checkout to v7

• Gather context (PR diff, workflow files)
• Review ci.yml changes
• Review claude-code-review.yml changes
• Review claude.yml changes
• Post review feedback

Summary

The PR now has two commits, and the second (3fde15d) supersedes the approach described in the PR body — the allow-unsafe-pr-checkout: true opt-in mentioned in the description is gone. Reviewing the current state of the branch.

ci.yml (3 sites) and claude.yml (1 site): plain v4 → v7 bumps, no other changes, both check out this repo's own ref under non-pull_request_target triggers. Nothing to flag. ci.yml's CI run on this PR already completed successfully (run 31052382179), confirming v7 works fine here.

claude-code-review.yml: commit 3fde15d replaces the allow-unsafe-pr-checkout: true fork checkout with a plain checkout of the base ref, reasoning that anthropics/claude-code-action fetches the PR's actual content itself via refs/pull/<n>/head rather than needing it checked out locally. This is a better fix than the opt-in — it removes the fork-checkout entirely instead of punching a hole in v7's new guard. I can also confirm empirically: this very review is running from that exact workflow, and the local checkout does contain both of this PR's commits, matching the claim that the action fetches PR content correctly without a repository:/ref: override.

One regression worth a look: the old step had persist-credentials: false (.github/workflows/claude-code-review.yml:105 now, vs. the removed block). The new step drops it entirely, so it falls back to actions/checkout's default of persist-credentials: true — meaning the job's GITHUB_TOKEN (which has pull-requests: write, checks: read, and now actions: write) gets persisted into the git config on disk for this pull_request_target job. claude.yml's checkout (.github/workflows/claude.yml:42) keeps persist-credentials: false for comparison, so this looks like an oversight from trimming the with: block rather than a deliberate choice — the commit message only discusses dropping repository:/ref:/allow-unsafe-pr-checkout, not persist-credentials. Worth re-adding for defense-in-depth, at no functional cost since claude-code-action is given github_token explicitly anyway.

The other two changes bundled into that same commit (actions: write for cache-write, claude_args: '--allowedTools mcp__github_inline_comment__create_inline_comment' for inline comments) are unrelated to the actions/checkout bump but are well-documented inline with plausible, specific justifications (cache-reservation warning, silently-falling-back-to-consolidated-comment behavior). Worth being aware this PR now does more than its title says, but not a blocker.

Fix this →

No bugs or security issues that would block merging; the persist-credentials point is a hardening suggestion, not a functional blocker.

[github-actions]

Code Review: CI: bump actions/checkout to v7

• Gather context (PR diff, workflow files, prior review comments)
• Review ci.yml changes
• Review claude-code-review.yml changes
• Review claude.yml changes
• Check status of previously flagged persist-credentials issue
• Post review feedback

[github-actions]

Claude finished @jnasbyupgrade's task in 3m 45s —— View job

---

Code Review: CI: bump actions/checkout to v7

• Gather context (PR diff, workflow files, prior review comments)
• Review ci.yml changes
• Review claude-code-review.yml changes
• Review claude.yml changes
• Check status of previously flagged persist-credentials issue
• Post review feedback

Summary

Reviewed the current state of the branch (commit de5997f, one commit).

Previously flagged persist-credentials regression: resolved, and not by this PR. The 2026-08-05 review flagged that persist-credentials: false had been dropped from claude-code-review.yml's "Check out base ref" step. It's present again now (.github/workflows/claude-code-review.yml:102), but git show de5997f -- .github/workflows/claude-code-review.yml shows this PR's own diff never touches that line — it was already there before this commit. That line was restored by #53 ("Stop checking out the fork PR head in claude-code-review.yml"), which merged to master separately and this branch already includes. So there's nothing left to do here; the fix predates this PR.

This PR's actual diff (verified via git show de5997f) is exactly what the description says, three independent pieces:

• ci.yml: 6 call sites, claude.yml: 1 call site — plain v4 → v7, all checking out this repo's own ref under non-pull_request_target triggers. No fork-checkout guard concerns. This PR's own ci.yml run already completed successfully (run 31410030612), so the v7 bump is empirically confirmed working there.
• claude-code-review.yml: v4 → v7 on the one checkout step (base ref only, no fork override — consistent with the file's own top-of-file SECURITY comment), plus the two independently-justified additions: actions: write (matches the well-known actions/cache requirement that cache-save needs this scope when a job uses a restricted permissions: block — legitimately no narrower scope exists) and claude_args: '--allowedTools mcp__github_inline_comment__create_inline_comment' for inline comments in agent mode.

Why none of the claude-code-review.yml changes can be observed from this very review run — confirmed empirically, not just asserted: this run (31410028317) is itself a claude-review job, and pull_request_target always executes the workflow file from master, never the PR's copy. I checked origin/master's copy directly: it still has actions/checkout@v4, no actions: write, and no claude_args at all. That's exactly why the mcp__github_inline_comment__create_inline_comment tool isn't available in this session, and why actions: write/the v7 checkout aren't in effect here either — this run is executing the pre-fix workflow, precisely as the PR body's own "Note for reviewers" predicts. None of this is a defect in the PR; it's an inherent, already-documented limitation of testing a pull_request_target workflow change from within itself. Real confirmation of the checkout-refusal avoidance, the inline-comment fix, and the cache-write fix all require a real run after this merges — same as the Node 20 deprecation-warning claim, which also can't be checked from a log or diff.

No bugs or security issues found. Nothing blocking merge.
(branch actions-bump-node20)