ci(deps): bump the github-actions group with 2 updates (#1676)

Bumps the github-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [renovatebot/github-action](https://github.com/renovatebot/github-action).


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

Updates `renovatebot/github-action` from 46.1.15 to 46.1.16
- [Release notes](https://github.com/renovatebot/github-action/releases)
- [Changelog](https://github.com/renovatebot/github-action/blob/main/CHANGELOG.md)
- [Commits](renovatebot/github-action@v46.1.15...v46.1.16)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: renovatebot/github-action
  dependency-version: 46.1.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/_build-and-release.yml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: true
 
@@ -108,7 +108,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -165,7 +165,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download all artifacts
         uses: actions/download-artifact@v8

.github/workflows/_update-addon-config.yml

@@ -59,7 +59,7 @@ jobs:
           APP_TOKEN: ${{ steps.app-token.outputs.token }}
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: master
           fetch-depth: 1

.github/workflows/addon-publish-dev.yml

@@ -45,7 +45,7 @@ jobs:
       dev_version: ${{ steps.version.outputs.dev_version }}
       short_sha: ${{ steps.version.outputs.short_sha }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Generate dev version
         id: version
@@ -77,7 +77,7 @@ jobs:
             platform: linux/arm64
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         submodules: true
 

.github/workflows/addon-publish.yml

@@ -39,7 +39,7 @@ jobs:
             platform: linux/arm64
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         submodules: true
         # Check out the release tag so uv sync installs the bumped pyproject.toml.

.github/workflows/build-binary.yml

@@ -47,7 +47,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # Pull the skills-vendor submodule so PyInstaller's
           # `collect_all('ha_mcp')` packages the bundled skill files into
@@ -122,7 +122,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/build-haos-test-image.yml

@@ -57,7 +57,7 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Required for the skills bundle submodule at
           # src/ha_mcp/resources/skills-vendor (test_skills_resources.py).

.github/workflows/codeql-quality.yml

@@ -72,7 +72,7 @@ jobs:
             suite: codeql/javascript-queries:codeql-suites/javascript-code-quality.qls
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/deploy.yml

@@ -24,7 +24,7 @@ jobs:
         working-directory: ./site
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node
         uses: actions/setup-node@v6

.github/workflows/e2e-tests.yml

@@ -38,7 +38,7 @@ jobs:
     timeout-minutes: 15
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         submodules: true
 

.github/workflows/haos-e2e-inaddon-tests.yml

@@ -69,7 +69,7 @@ jobs:
     outputs:
       run: ${{ steps.filter.outputs.run }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Classify changed files
         id: filter
         env:
@@ -119,7 +119,7 @@ jobs:
     timeout-minutes: 45
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: true
           # Full history so merge-ref git operations resolve cleanly.