Bump CI actions to current majors, point dependabot at develop

.github/dependabot.yml

@@ -6,6 +6,8 @@ updates:
   # Python dependencies
   - package-ecosystem: "pip"
     directory: "/"
+    # PRs go to develop, per the branching strategy in CLAUDE.md
+    target-branch: "develop"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -36,6 +38,8 @@ updates:
   # GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
+    # PRs go to develop, per the branching strategy in CLAUDE.md
+    target-branch: "develop"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -53,6 +57,8 @@ updates:
   # Docker
   - package-ecosystem: "docker"
     directory: "/deploy"
+    # PRs go to develop, per the branching strategy in CLAUDE.md
+    target-branch: "develop"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -70,6 +76,8 @@ updates:
   # Cloudflare Workers (npm)
   - package-ecosystem: "npm"
     directory: "/workers"
+    # PRs go to develop, per the branching strategy in CLAUDE.md
+    target-branch: "develop"
     schedule:
       interval: "weekly"
       day: "monday"

.github/workflows/auto-dev-bump.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_PAT }}

.github/workflows/auto-release.yml

@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           # Use PAT to bypass branch protection rules

.github/workflows/claude-code-review.yml

@@ -24,6 +24,12 @@ jobs:
       actions: read
 
     steps:
+      # Pinned to v6 deliberately: this job runs on pull_request_target for
+      # fork PRs and checks out the PR head, which checkout v7 blocks outright
+      # (actions/checkout#2454). Bumping this step disables fork-PR review.
+      # The block exists because checking out fork code in a
+      # pull_request_target job that holds secrets and contents: write is a
+      # privilege-escalation shape; revisit the fork lane rather than the pin.
       - name: Checkout repository
         uses: actions/checkout@v6
         with:

.github/workflows/claude.yml

@@ -26,7 +26,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
@@ -50,7 +50,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
@@ -92,7 +92,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 

.github/workflows/codeql-analysis.yml

@@ -34,7 +34,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4

.github/workflows/codeql.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/codespell.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Annotate locations with typos
         uses: codespell-project/codespell-problem-matcher@v1
       - name: Codespell

.github/workflows/docker-build.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Build Docker image for testing
         run: |
@@ -81,22 +81,22 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels)
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |

.github/workflows/process-feedback.yml

@@ -24,7 +24,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 2  # Get previous commit to detect new files
 

.github/workflows/publish-testpypi.yml

@@ -19,7 +19,7 @@ jobs:
       version: ${{ steps.get_version.outputs.version }}
       should_publish: ${{ steps.check.outputs.should_publish }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 2
 
@@ -55,7 +55,7 @@ jobs:
     if: needs.check-version.outputs.should_publish == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/publish.yml

@@ -22,7 +22,7 @@ jobs:
     name: Build distribution
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/security-scan.yml

@@ -23,10 +23,10 @@ jobs:
     continue-on-error: true
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: moderate
           comment-summary-in-pr: always
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -73,7 +73,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Build Docker image
         run: |
@@ -118,7 +118,7 @@ jobs:
     if: github.event_name == 'pull_request'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Full history for better detection
 

.github/workflows/test.yml

@@ -12,7 +12,7 @@ jobs:
     name: Lint & Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -40,7 +40,7 @@ jobs:
         python-version: ['3.12']
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
@@ -77,7 +77,7 @@ jobs:
           pytest tests/ -v -m "not integration" --cov=src --cov-report=xml:coverage-unit.xml --cov-report=term-missing
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage-unit.xml
@@ -93,7 +93,7 @@ jobs:
     outputs:
       integration_needed: ${{ steps.changes.outputs.integration_needed }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -143,7 +143,7 @@ jobs:
       needs.check-changes.outputs.integration_needed == 'true'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -173,7 +173,7 @@ jobs:
 
       - name: Upload standalone coverage to Codecov
         if: always()
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage-standalone.xml
@@ -193,7 +193,7 @@ jobs:
       (needs.check-changes.outputs.integration_needed == 'true' || github.event_name == 'workflow_dispatch')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -224,7 +224,7 @@ jobs:
 
       - name: Upload integration coverage to Codecov
         if: always()
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage-integration.xml

.github/workflows/update-hed-docs.yml

@@ -14,7 +14,7 @@ jobs:
     name: Fetch Latest HED Docs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: develop
           token: ${{ secrets.RELEASE_PAT }}

CHANGELOG.md

@@ -8,6 +8,16 @@ This file starts at 0.7.11.
 Earlier releases are described in the [GitHub releases](https://github.com/Annotation-Garden/HEDit/releases),
 which are generated from the commit log.
 
+## [Unreleased]
+
+### Changed
+
+- CI actions moved to their current majors: `actions/checkout` v7, `codecov/codecov-action`
+  v7, `actions/dependency-review-action` v5, `docker/login-action` v4,
+  `docker/metadata-action` v6. The fork-PR review lane stays on `checkout` v6, the last
+  version that permits checking out a fork PR head under `pull_request_target`. Dependabot
+  now opens its PRs against develop rather than main. (#131, #133, #143, #152, #153)
+
 ## [0.7.11] - 2026-08-20
 
 The LLM provider migration, plus token and cache accounting on every surface, and extended