chore: update GitHub actions workflow for cppcheck

[Johnson-zs]

1. Updated actions/checkout from v4 to v7 for better stability and
   features
2. Added allow-unsafe-pr-checkout: true parameter to permit checkouts
   from unsafe PRs
3. Maintained existing functionality while improving security and
   compatibility

Influence:

1. Verify cppcheck workflow still runs successfully on PR submissions
2. Test with different PR scenarios including unsafe origins
3. Confirm persisted credentials handling remains disabled

chore: 更新GitHub actions的cppcheck工作流程

1. 将actions/checkout从v4升级到v7以获得更好的稳定性和功能
2. 添加allow-unsafe-pr-checkout: true参数以允许从不安全的PR检出
3. 在改进安全性和兼容性的同时保持原有功能

Influence:

1. 验证cppcheck工作流程在PR提交时仍能成功运行
2. 测试包括不安全源在内的不同PR场景
3. 确认持久化凭据处理保持禁用状态

Summary by Sourcery

Update the cppcheck GitHub Actions workflow to use the latest checkout action and support unsafe PR checkouts while keeping credentials non-persistent.

CI:

• Bump actions/checkout in the cppcheck workflow from v4 to v7.
• Enable allow-unsafe-pr-checkout in the cppcheck workflow while keeping persist-credentials disabled.

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Johnson-zs

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR updates the cppcheck GitHub Actions workflow to use a newer version of actions/checkout and configures it to explicitly allow unsafe PR checkouts while keeping credentials persistence disabled.

Flow diagram for updated cppcheck GitHub Actions workflow

flowchart TD
    A[cppcheck workflow trigger on pull_request] --> B[Step run: export]
    B --> C[Step actions_checkout_v7]
    C --> D[Step action_cppcheck]

    subgraph Checkout_configuration
        C1[ref = github.event.pull_request.head.sha]
        C2[persist-credentials = false]
        C3[allow-unsafe-pr-checkout = true]
    end

    C --> C1
    C --> C2
    C --> C3

Loading

File-Level Changes

Change	Details	Files
Upgrade checkout action version and adjust checkout configuration for PRs, including unsafe origins.	Bump actions/checkout from v4 to v7 in the cppcheck workflow job. Keep checkout ref pinned to the PR head SHA via github.event.pull_request.head.sha. Explicitly disable credential persistence by leaving persist-credentials set to false. Enable checkouts from unsafe pull requests by adding allow-unsafe-pr-checkout: true to the checkout step.	.github/workflows/cppcheck.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[deepin-ci-robot]

deepin pr auto review

★ 总体评分：100分

■ 【总体评价】

代码升级了 CI Action 版本并补充了安全配置，整体质量优秀
逻辑正确且修复了旧版本潜在风险，无需扣分

■ 【详细分析】

• 1.语法逻辑（完全正确）✓

YAML 语法结构正确，uses 和 with 字段使用规范，allow-unsafe-pr-checkout: true 参数放置位置正确
潜在问题：无
建议：无需修改

• 2.代码质量（优秀）✓

将 actions/checkout 从 v4 升级至 v7，并补充了 allow-unsafe-pr-checkout: true 配置，符合最新的安全最佳实践
潜在问题：无
建议：保持当前更新习惯，定期关注依赖版本

• 3.代码性能（无性能问题）✓

升级到最新版本的 Action 通常包含性能优化，CI 流程执行效率不受负面影响
建议：无

• 4.代码安全（存在0个安全漏洞）✓

漏洞对比统计：新增漏洞 0 个，减少漏洞 0 个，持平 0 个
本次变更升级了 checkout 版本并启用了安全配置，未引入新的安全风险，配合 persist-credentials: false 确保了凭证安全

• 建议：继续保持 persist-credentials: false 配置以防止凭证泄露

■ 【改进建议代码示例】

# 当前代码已经是最佳实践，无需进一步修改
jobs:
  cppcheck:
    runs-on: ubuntu-latest
    steps:
      - run: export
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
          allow-unsafe-pr-checkout: true
      - uses: linuxdeepin/action-cppcheck@main
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}

[Johnson-zs]

/forcemerge

[deepin-bot]

This pr force merged! (status: blocked)