Bump actions/checkout from 5 to 6

[dependabot]

Bumps actions/checkout from 5 to 6.

Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248
• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• v6-beta by @​ericsciple in actions/checkout#2298
• update readme/changelog for v6 by @​ericsciple in actions/checkout#2311

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

Full Changelog: actions/checkout@v5...v5.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

V6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

V5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

V5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

V4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

V4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

v4.2.0

• Add Ref and Commit outputs by @​lucacome in actions/checkout#1180
• Dependency updates by @​dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in actions/checkout#1739
• Bump actions/checkout from 3 to 4 by @​dependabot in actions/checkout#1697
• Check out other refs/* by commit by @​orhantoy in actions/checkout#1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in actions/checkout#1776

v4.1.6

• Check platform to set archive extension appropriately by @​cory-miller in actions/checkout#1732

v4.1.5

• Update NPM dependencies by @​cory-miller in actions/checkout#1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in actions/checkout#1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in actions/checkout#1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in actions/checkout#1695

... (truncated)

Commits

• 1af3b93 update readme/changelog for v6 (#2311)
• 71cf226 v6-beta (#2298)
• 069c695 Persist creds to a separate file (#2286)
• ff7abcd Update README to include Node.js 24 support details and requirements (#2248)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Resolves #2311
Resolves #2298
Resolves #2286
Resolves #2248
Resolves actions/checkout#2248
Resolves actions/checkout#2286
Resolves actions/checkout#2298
Resolves actions/checkout#2311
Resolves actions/checkout#2301
Resolves actions/checkout#2226
Resolves actions/checkout#2305
Resolves actions/checkout#1971
Resolves actions/checkout#1977
Resolves actions/checkout#2043
Resolves actions/checkout#2044
Resolves actions/checkout#2194
Resolves actions/checkout#2224
Resolves actions/checkout#2236
Resolves actions/checkout#1941
Resolves actions/checkout#1946
Resolves actions/checkout#1924
Resolves actions/checkout#1180
Resolves actions/checkout#1777
Resolves actions/checkout#1872
Resolves actions/checkout#1739
Resolves actions/checkout#1697
Resolves actions/checkout#1774
Resolves actions/checkout#1776
Resolves actions/checkout#1732
Resolves actions/checkout#1703
Resolves actions/checkout#1694
Resolves actions/checkout#1696
Resolves actions/checkout#1695

[github-actions]

🤖 Claude Code Review

Code Review Analysis

Summary

This PR updates the actions/checkout GitHub Action from v5 to v6 across all workflow files. This is a straightforward dependency update with no functional code changes.

---

Detailed Review

✅ Code Quality

• ✅ Code follows style guide: N/A - This PR only updates GitHub Actions versions, no application code is modified.
• ✅ No commented-out code: No commented-out code present.
• ✅ Meaningful variable names: N/A - No new variables introduced.
• ✅ DRY principle followed: The change is consistently applied across all 10 workflow files.
• ✅ Identify Defects: No bugs, logic errors, or security vulnerabilities introduced. This is a minor version bump of a GitHub Action that should maintain backward compatibility.

✅ Testing

• ✅ Unit tests for new functions: N/A - No new functions added.
• ✅ Integration tests for new endpoints: N/A - No new endpoints.
• ✅ Edge cases covered: N/A - This is a dependency version update.
• ✅ Test coverage > 80%: N/A - The workflows themselves will test this change when they run.

Note: The change will be validated when the workflows execute after merge. The persist-credentials: false flag remains in place, maintaining security posture.

✅ Documentation

• ✅ Readme updated if needed: Not required - this is an internal CI/CD dependency update.
• ✅ API docs updated: Not applicable.
• ✅ Inline comments for complex logic: Not applicable.
• ✅ CHANGELOG.md updated: Should be updated to note the dependency bump.

Recommendation: Consider adding an entry to CHANGELOG.md such as:

### Changed
- Updated actions/checkout from v5 to v6 in all GitHub workflows

✅ Security

• ✅ No hardcoded credentials: None present.
• ✅ Input validation implemented: N/A
• ✅ Proper error handling: N/A
• ✅ No sensitive data in logs: No changes to logging.
• ✅ No license files (.lic) or AQAAAD strings: Not present in diff.

Security Note: All workflows correctly maintain persist-credentials: false, which is a security best practice.

---

Files Changed

All changes are in GitHub workflow files:

• .github/workflows/go-test-darwin.yaml:28
• .github/workflows/go-test-linux.yaml:33
• .github/workflows/go-test-windows.yaml:27
• .github/workflows/golangci-lint.yaml:27
• .github/workflows/make-go-tag.yaml:21
• .github/workflows/publish-to-pypi.yaml:25
• .github/workflows/pylint.yaml:20
• .github/workflows/pytest.yaml:19
• .github/workflows/test-RFC8927-reconstitution.yaml:19
• .github/workflows/test-generated-files.yaml:19

---

Recommendation

✅ APPROVE - This is a clean, low-risk dependency update that:

1. Consistently updates all workflow files
2. Maintains security configurations (persist-credentials: false)
3. Introduces no functional changes to application code
4. Follows GitHub's recommended practice of keeping actions up to date

Minor suggestion: Update CHANGELOG.md to document this dependency change.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

Code Review Analysis

Code Quality

✅ Code follows style guide

The changes are YAML formatting updates in GitHub Actions workflow files. The indentation now properly uses 2 spaces consistently, which aligns with standard YAML formatting conventions.

✅ No commented-out code

No commented-out code found in the diff.

✅ Meaningful variable names

All variable and parameter names remain unchanged and are meaningful (e.g., python-version, job-status, persist-credentials).

✅ DRY principle followed

The changes maintain the existing DRY approach - the same update pattern is consistently applied across all workflow files.

✅ Identify Defects

No defects, logic errors, edge cases, or security vulnerabilities identified. The changes are:

1. Updating actions/checkout from v5 to v6 across all workflow files (9 files)
2. Fixing YAML indentation in 2 workflow files (.github/workflows/test-RFC8927-reconstitution.yaml:5-34 and .github/workflows/test-generated-files.yaml:5-89)

These are maintenance updates with no logic changes.

Testing

⚠️ Unit tests for new functions

N/A - No new functions added. These are dependency version bumps and formatting fixes only.

⚠️ Integration tests for new endpoints

N/A - No new endpoints added.

⚠️ Edge cases covered

N/A - No new functionality requiring edge case testing.

⚠️ Test coverage > 80%

N/A - No code changes that would affect test coverage. The existing test workflows themselves are being updated but continue to run the same test suites.

Documentation

✅ Readme updated if needed

Not needed - These are minor dependency updates and YAML formatting fixes that don't require README updates.

✅ API docs updated

Not needed - No API changes.

✅ Inline comments for complex logic

Not needed - YAML workflow files are self-documenting; no complex logic introduced.

❌ CHANGELOG.md updated

Missing - The PR updates actions/checkout from v5 to v6 across multiple workflows, which is a notable maintenance change that should be documented in CHANGELOG.md.

Recommendation: Add an entry like:

### Changed
- Updated actions/checkout from v5 to v6 in all GitHub Actions workflows
- Standardized YAML indentation in test workflow files

Security

✅ No hardcoded credentials

No credentials found in the diff. The existing SLACK_BOT_TOKEN continues to properly use GitHub secrets.

✅ Input validation implemented

N/A - No new inputs requiring validation.

✅ Proper error handling

The existing error handling patterns remain unchanged.

✅ No sensitive data in logs

No sensitive data being logged.

✅ No license files (.lic) or AQAAAD strings

No license files or AQAAAD strings found in the diff.

---

Summary

Overall Assessment: ✅ APPROVED with minor recommendation

This PR contains routine maintenance updates:

• Bumps actions/checkout from v5 to v6 (security and feature updates from GitHub)
• Fixes YAML indentation to use consistent 2-space formatting

Only Issue: Missing CHANGELOG.md entry for the actions/checkout version bump.

Recommendation: Add a CHANGELOG.md entry documenting the dependency update before merging.

Automated code review analyzing defects and coding standards