From b79534e2d9f70179ce048037561797ed3e834052 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 31 Jul 2026 02:24:08 +0000
Subject: [PATCH] chore(deps): pin actions/checkout@v7 in cargo-dist release
 workflow

Dependabot's release.yml bump failed `dist plan` because cargo-dist 0.32.0
still templates checkout@v6. Pin the v7.0.0 SHA via github-action-commits
and regenerate so plan stays consistent with ci/publish workflows.

Co-authored-by: Michael Assaf <snowmead@users.noreply.github.com>
---
 .github/workflows/release.yml | 10 +++++-----
 dist-workspace.toml           |  4 ++++
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c798e55..f97f48f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -56,7 +56,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           persist-credentials: false
           submodules: recursive
@@ -116,7 +116,7 @@ jobs:
       - name: enable windows longpaths
         run: |
           git config --global core.longpaths true
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           persist-credentials: false
           submodules: recursive
@@ -175,7 +175,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           persist-credentials: false
           submodules: recursive
@@ -225,7 +225,7 @@ jobs:
     outputs:
       val: ${{ steps.host.outputs.manifest }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           persist-credentials: false
           submodules: recursive
@@ -320,7 +320,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           persist-credentials: false
           submodules: recursive
diff --git a/dist-workspace.toml b/dist-workspace.toml
index e061d97..4326a43 100644
--- a/dist-workspace.toml
+++ b/dist-workspace.toml
@@ -22,3 +22,7 @@ targets = [
 publish-jobs = ["./publish-crates", "./publish-npm"]
 # Only run the cheap "plan" check on PRs; full builds on tags.
 pr-run-mode = "plan"
+
+# Pin GitHub Actions used in the generated release.yml (matches ci/publish workflows).
+[dist.github-action-commits]
+"actions/checkout" = "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0