Skip to content

chore(deps): bump actions/checkout from 4 to 6.0.3 - #719

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-6.0.3
Closed

chore(deps): bump actions/checkout from 4 to 6.0.3#719
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-6.0.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps actions/checkout from 4 to 6.0.3.

Release notes

Sourced from actions/checkout's releases.

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

... (truncated)

Commits
  • df4cb1c Update changelog for v6.0.3 (#2446)
  • 1cce339 Fix checkout init for SHA-256 repositories (#2439)
  • 900f221 fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)
  • 0c366fd Update changelog (#2357)
  • de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
  • 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
  • 8e8c483 Clarify v6 README (#2328)
  • 033fa0d Add worktree support for persist-credentials includeIf (#2327)
  • c2d88d3 Update all references from v5 and v4 to v6 (#2314)
  • 1af3b93 update readme/changelog for v6 (#2311)
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Low Risk
CI-only dependency pin with no application code changes; main caveat is v6 checkout behavior/runner requirements on release workflows that use deep fetch and publishing.

Overview
Upgrades every workflow checkout step from actions/checkout@v4 to actions/checkout@v6.0.3, with no other workflow logic or inputs changed (including fetch-depth: 0 on release/manual publish jobs).

Affected workflows: OpenAPI spec check (main and failure Slack job), dependency scan (Go and Node SBOM jobs), dev-server UI CI, Go build/test, manual publish (binary and npm jobs), and release-please (tag creation, Goreleaser publish, and npm publish).

This is a major-version bump of the checkout action; v6 changes how persisted credentials are stored and may require a sufficiently new Actions runner for container scenarios that rely on those credentials.

Reviewed by Cursor Bugbot for commit 3f8bf5f. Bugbot is set up for automated code reviews on this repo. Configure here.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
chore(deps): bump actions/checkout from 4 to 6.0.3
3f8bf5f 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6.0.3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 23, 2026
@cursor cursor Bot mentioned this pull request Oct 5, 2026
Draft
2 of 3 tasks
cursor Bot pushed a commit that referenced this pull request Oct 13, 2026
@cursoragent @nieblara
fix(deps): resolve floating action refs in actions-coverage
9ba6b44 
actions-coverage showed #719 as "v4 → v6.0.3". The floating @v4 is
v4.4.0 today, and @v6 is v6.1.0, so the exact pin v6.0.3 misses a release.

The check now resolves each floating tag to the exact release on the same
commit and shows both, for example "v4 (v4.4.0) → v6.0.3". If an exact
pin is older than the release of its floating major, or of the floating
ref that it replaces, the check asks a person and recommends a newer pin.

Co-authored-by: rniebla <rniebla@launchdarkly.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #867.

@dependabot dependabot Bot closed this Oct 14, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions/checkout-6.0.3 branch October 14, 2026 15:50
cursor Bot pushed a commit that referenced this pull request Oct 20, 2026
@cursoragent @nieblara
fix(deps): rank incomplete above needs-human
d8d6812 
SKILL.md says that needs-human means verification is complete, but the
verdict ranked needs-human above incomplete. On #719 the headline and the
exit code hid an open CI item. The verdict is now incomplete while any
item is open, and the comment still lists the questions.

Co-authored-by: rniebla <rniebla@launchdarkly.com>
cursor Bot pushed a commit that referenced this pull request Oct 20, 2026
@cursoragent @nieblara
fix(deps): ask for a rerun when CI fails in code that the PR does not…
c9a0cc2 
… change

On #869, an npm-only PR, the flaky TestStreamClientV2Handler failed the Go
job, and ci-status made the verdict block. verify.sh now records the failed
jobs and steps of each run. If every failed step is a run step that reads
only ecosystems that the PR does not change, the result is incomplete with
a rerun of the failed job as the fix.

ci-status also gives the age of the oldest run, and it is incomplete when
the base branch changed a workflow after the run (#719).

Co-authored-by: rniebla <rniebla@launchdarkly.com>
cursor Bot pushed a commit that referenced this pull request Oct 20, 2026
@cursoragent @nieblara
fix(deps): give each incomplete item its own fix
8f4e6e3 
The comment told the reader to run verify.sh again for every incomplete
item. On #719 the open item was CI, which only a rerun on GitHub closes.
Each incomplete item now has a fix: the recommendation of its check (a
GitHub rerun for ci-status), the impact review, the generated check, or a
verify.sh rerun.

Co-authored-by: rniebla <rniebla@launchdarkly.com>
cursor Bot pushed a commit that referenced this pull request Oct 20, 2026
@cursoragent @nieblara
fix(deps): ask separate questions for separate choices in actions-cov…
277bfd3 
…erage

On #719 one question asked about checkout v6 in release workflows and
about the exact pin v6.0.3. SKILL.md asks for one yes-or-no question per
decision. A check can now call ask for each choice and decide_asked at the
end. Each question becomes its own decision with its own evidence.

Co-authored-by: rniebla <rniebla@launchdarkly.com>
cursor Bot pushed a commit that referenced this pull request Oct 20, 2026
@cursoragent @nieblara
fix(deps): note the node24 effect and new inputs that default to on
019322a 
Runners already run node20 actions on node24, so actions-coverage now
says that node20 → node24 changes nothing (#719). It also reports a new
input that the repo does not set and that defaults to true, such as
setup-node v5 package-manager-cache (#865).

Co-authored-by: rniebla <rniebla@launchdarkly.com>
cursor Bot pushed a commit that referenced this pull request Oct 20, 2026
@cursoragent @nieblara
fix(deps): resolve floating action refs and report note gaps in upstr…
893a1b4 
…eam-changes

- A floating ref such as @v7 now resolves to its release (v7.0.1) before
  the notes and the compare link are read. The old code read v7 as 7.0.0,
  dropped checkout v7.0.1 and setup-node v7.1.0, and kept releases that
  main already had.
- A CHANGELOG entry that says only "version bump only" is not a note, so
  the coverage is partial. For a meta package such as typescript-eslint,
  the check also reads the CHANGELOG of each re-exported package.
- When GitHub reports the refs as diverged, the details list the commits
  of the old ref that the new ref lacks (#719).

Co-authored-by: rniebla <rniebla@launchdarkly.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants