Upgrade actions/checkout to v7 and let fork pull requests be checked out

[Jordanh1996]

Background

These workflows use actions/checkout v3 and v4. Their pull_request_target jobs can't check out pull requests opened from a fork: actions/checkout refuses with Refusing to check out fork pull request code from a 'pull_request_target' workflow.

Description

Every actions/checkout step in .github/workflows now uses v7. The pull_request_target checkouts of the pull request head get allow-unsafe-pr-checkout: true in the Frogbot and test workflows, which are already gated by the frogbot environment approval and the "safe to test" label, and persist-credentials: false so the token isn't left on disk for pull request code. Same setup as jfrog-idea-plugin, jfrog-vscode-extension and jfrog-cli-security.

Tests

CI on this PR. Since pull_request_target runs the base branch's workflow, the fork fix takes effect after merge.

• All tests passed. If this feature is not already covered by the tests, I added new tests.

---

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}