Pin third-party actions to full-length commit SHAs (with version comments) instead of mutable tags/branches to prevent supply-chain tampering via retagged releases. Resolves SonarCloud rule githubactions:S7637.
Bumps the actions group with 1 update in the / directory: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 4 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: skylartaylor <[email protected]>
- crates/mcp: JSON-RPC MCP server (18 tools, resources, prompts), headless and attached backends, end-to-end agent tests - apps/figcraft-cli: info/export/convert/render/run/commands/mcp/perf - crates/pdf: vector PDF export via krilla with embedded text; file.exportFramesPdf - apps/figcraft-web + packaging/{macos,windows,linux,freebsd,web} + release/ci workflows - engine vectoredit: edit points/handles/bend/add/delete-heal; canvas overlay and edit strip Co-Authored-By: Claude Opus 5.5 <[email protected]>