chore(ci): update actions/checkout to v7 and enable unsafe PR checkout

[add-uos]

Update GitHub Actions checkout action from v2 to v7 for latest features. Add allow-unsafe-pr-checkout option for PR workflow compatibility.

更新 GitHub Actions checkout 到 v7 版本，启用 unsafe PR checkout 选项以提升 PR 工作流兼容性。

Log: 更新 cppcheck CI 工作流配置
Influence: CI 工作流使用最新的 checkout action，提升 PR 检测稳定性。# 请为您的变更输入提交说明。以 '#' 开始的行将被忽略，而一个空的提交

Summary by Sourcery

CI:

• Upgrade actions/checkout in the cppcheck workflow to v7 and enable unsafe PR checkout for PR-based executions.

[deepin-ci-robot]

deepin pr auto review

★ 总体评分：40分

■ 【总体评价】

代码升级了 checkout action 版本，但引入了不安全的 PR checkout 配置
逻辑正确但因引入供应链攻击风险扣60分

■ 【详细分析】

• 1.语法逻辑（正确）✓

具体分析内容，指出代码位置、函数名及问题原因：.github/workflows/cppcheck.yml 文件中的 YAML 缩进和字段格式完全正确，actions/checkout@v7 及其 with 块参数符合 GitHub Actions 规范。
潜在问题：无
建议：无

• 2.代码质量（良好）✓

具体分析内容：将过时的 actions/checkout@v3 升级到较新的 v7 版本，符合保持依赖更新的最佳实践，参数配置清晰明了。
潜在问题：无
建议：无

• 3.代码性能（无性能问题）✓

具体分析内容：该变更仅涉及 CI 流程配置，不影响运行时代码性能，checkout action 的版本升级通常在拉取速度上有小幅优化。
潜在问题：无
建议：无

• 4.代码安全（存在 1 个安全漏洞）✕

漏洞对比统计：新增漏洞 1 个，减少漏洞 0 个，持平 0 个
总体风险描述，指出漏洞位置和攻击面：在 .github/workflows/cppcheck.yml 中新增了 allow-unsafe-pr-checkout: true 参数，攻击面为外部贡献者提交的恶意 Pull Request，可能导致 CI 环境被控制或敏感信息泄露。

• 安全漏洞1（无） ：不安全的 PR Checkout 配置 在 .github/workflows/cppcheck.yml 中，通过设置 allow-unsafe-pr-checkout: true，允许在处理外部 Pull Request 时以不安全的方式拉取并执行代码，恶意 PR 提交者可利用此配置在 CI 环境中执行恶意脚本，进而窃取仓库的 secrets 或篡改构建产物 ——非常重要

• 建议：移除 allow-unsafe-pr-checkout: true 参数，恢复默认的安全限制；如果确实需要特定权限，应通过配置 github_token 的最小权限或使用 pull_request_target 事件配合严格的沙箱环境来实现。

■ 【改进建议代码示例】

diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index e808a89b1..85544faee 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - run: export
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
-          allow-unsafe-pr-checkout: true
       - uses: linuxdeepin/action-cppcheck@main
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}

[deepin-ci-robot]

@add-uos: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
github-pr-review-ci	f4d0b32	link	true	/test github-pr-review-ci

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: add-uos, lzwind

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sourcery-ai]

Sorry @add-uos, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery