[e54-bot]

Pins the last non-SHA third-party action in wright (release.yml:412, actions/checkout@v7) to 3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1, matching every other checkout site and ci-platform.md.

The SHA is the v7.0.1 tag of actions/checkout (lightweight tag, object type commit). actionlint passes.

/.github/workflows/ is CODEOWNERS-owned, so this needs the owner's review.

Fixes wrightkit/.github#124

[e54-bot]

Verdict: LGTM

Head SHA: f386af8

Checks:

• The diff is one line: .github/workflows/release.yml:412, actions/checkout@v7 becomes actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1. No other file changed.
• gh api repos/actions/checkout/git/ref/tags/v7.0.1 resolves to commit 3d3c42e5aac5ba805825da76410c181273ba90b1. The ref points to a commit, so no tag deref is needed.
• The same SHA is used by every other actions/checkout site in wright/.github on this head (74 uses: lines in total, all pinned after this change).
• No non-SHA third-party uses: remains on the head, excluding ./ and wrightkit/...@main.
• Other repos on origin/main have no non-SHA third-party uses:: opy-rs, workshop-rs, athena, and .github.
• Workflow lint / Lint workflows passed. Agent guide sync, Detect paths, Wasm core, and Build dist (ubuntu-latest) also passed. Other jobs were still pending when checked, and none had failed.

Fixes wrightkit/.github#124 is justified. Issue 124 acceptance criterion 3 names this line as the only remaining tag pin in scope.