Update Checkout to v7 (#527)

v4 triggers warnings of the form:

> Node.js 20 actions are deprecated. The following actions are running
on Node.js 20 and may not work as expected: actions/checkout@v4. Actions
will be forced to run with Node.js 24 by default starting June 2nd,
2026. Node.js 20 will be removed from the runner on September 16th,
2026. Please check if updated versions of these actions are available
that support Node.js 24. To opt into Node.js 24 now, set the
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the
runner or in your workflow file. Once Node.js 24 becomes the default,
you can temporarily opt out by setting
ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see:
https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

---------

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>

kkarrenn@: bypassing the Test/credentials_json checks as they require service account key rotation and not relevant to this change. Gave up attempting to rotate the keys - they're needed for testing only IIUC.

Author: jsoref

.github/workflows/publish.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
+        uses: 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0' # ratchet:actions/checkout@v7.0.0
 
       - name: 'Publish'
         id: 'publish'

.github/workflows/test.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: 'ubuntu-latest'
 
     steps:
-      - uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
+      - uses: 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0' # ratchet:actions/checkout@v7.0.0
 
       - uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
@@ -76,7 +76,7 @@ jobs:
       id-token: 'write'
 
     steps:
-      - uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
+      - uses: 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0' # ratchet:actions/checkout@v7.0.0
 
       - uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
@@ -130,7 +130,7 @@ jobs:
       id-token: 'write'
 
     steps:
-      - uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
+      - uses: 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0' # ratchet:actions/checkout@v7.0.0
 
       - uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
@@ -199,7 +199,7 @@ jobs:
           - 'macos-latest'
 
     steps:
-      - uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
+      - uses: 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0' # ratchet:actions/checkout@v7.0.0
 
       - uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:
@@ -261,7 +261,7 @@ jobs:
     strategy:
       fail-fast: false
     steps:
-      - uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
+      - uses: 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0' # ratchet:actions/checkout@v7.0.0
 
       - uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
         with:

README.md

@@ -26,7 +26,7 @@ support](https://cloud.google.com/support).**
 
 ## Prerequisites
 
--   Run the `actions/checkout@v4` step _before_ this action. Omitting the
+-   Run the `actions/checkout@v7` step _before_ this action. Omitting the
     checkout step or putting it after `auth` will cause future steps to be
     unable to authenticate.
 
@@ -58,7 +58,7 @@ jobs:
       id-token: 'write'
 
     steps:
-    - uses: 'actions/checkout@v4'
+    - uses: 'actions/checkout@v7'
 
     - uses: 'google-github-actions/auth@v3'
       with:
@@ -248,7 +248,7 @@ regardless of the authentication mechanism.
      jobs:
       job_id:
         steps:
-        - uses: 'actions/checkout@v4' # Must come first!
+        - uses: 'actions/checkout@v7' # Must come first!
         - uses: 'google-github-actions/auth@v3'
      ```
 

docs/EXAMPLES.md

@@ -77,7 +77,7 @@ value into a GitHub Secret named 'GOOGLE_CREDENTIALS'.
 jobs:
   job_id:
     steps:
-    - uses: 'actions/checkout@v4'
+    - uses: 'actions/checkout@v7'
 
     - uses: 'google-github-actions/auth@v3'
       with:
@@ -97,7 +97,7 @@ jobs:
       id-token: 'write'
 
     steps:
-    - uses: 'actions/checkout@v4'
+    - uses: 'actions/checkout@v7'
 
     - id: 'auth'
       uses: 'google-github-actions/auth@v3'
@@ -133,7 +133,7 @@ jobs:
       id-token: 'write'
 
     steps:
-    - uses: 'actions/checkout@v4'
+    - uses: 'actions/checkout@v7'
 
     - id: 'auth'
       uses: 'google-github-actions/auth@v3'
@@ -170,7 +170,7 @@ jobs:
       id-token: 'write'
 
     steps:
-    - uses: 'actions/checkout@v4'
+    - uses: 'actions/checkout@v7'
 
     - id: 'auth'
       uses: 'google-github-actions/auth@v3'
@@ -220,7 +220,7 @@ jobs:
       id-token: 'write'
 
     steps:
-    - uses: 'actions/checkout@v4'
+    - uses: 'actions/checkout@v7'
 
     - id: 'auth'
       uses: 'google-github-actions/auth@v3'

docs/TROUBLESHOOTING.md

@@ -21,12 +21,12 @@
     to these resources are eventually consistent. Usually they happen
     immediately, but sometimes they can take up to 5 minutes to propagate.
 
-1.  Ensure `actions/checkout@v4` is **before** the `auth` action in your
+1.  Ensure `actions/checkout@v7` is **before** the `auth` action in your
     workflow.
 
     ```yaml
     steps:
-      - uses: 'actions/checkout@v4'
+      - uses: 'actions/checkout@v7'
       - uses: 'google-github-actions/auth@v3'
     ```