checkout

This is infrastructure that ships billions of CI runs. v7 added real security wins: refusing unsafe fork checkouts by default (pwn request vulnerability fix), moving to ESM for dependency compatibility, credentials isolation in v6. No marketing, no rebadging—just a tool that does one thing correctly. The 'not taking contributions' note is a red flag for maintenance, but GitHub will keep this alive because it's literally foundational to Actions. Signal: pure utility. Slop minimal because there...