ci(github-action): update action actions/checkout (v6.0.2 → v6.0.3)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v6.0.2 → v6.0.3

---

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[its-miso]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

[its-saffron]

AI Automated Review

Analysis engine: MiniMax@https://litellm.jory.dev/v1 (anthropic)

Recommendation: Approve

This is a routine, low-risk patch update of the actions/checkout GitHub Action from v6.0.2 to v6.0.3 in .github/workflows/ai-pr-review.yaml. The change is well-formed, SHA-pinned (security best practice), and the upstream release contains only bug fixes — no breaking changes per semver.

---

Change-by-Change Findings

.github/workflows/ai-pr-review.yaml

• Old: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
• New: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
• The commit SHA df4cb1c069e1874edd31b4311f1884172cec0e10 matches the head commit on the v6.0.2...v6.0.3 compare (4 commits ahead, 0 behind). The release v6.0.3 was published on 2026-06-02.
• The version comment (# v6.0.3) is updated consistently with the SHA — good.
• No input changes (fetch-depth: 0, ref: expression) — the upgrade is purely a version bump.

Upstream Release Notes (v6.0.3)

Two fixes only, both SHA-256 related:

1. #2439 — Fix checkout init for SHA-256 repositories
2. #2414 — Expand merge commit SHA regex and add SHA-256 test cases

No breaking changes, no API/inputs/outputs changes. Patch-level bump is appropriate per semver.

Repository-Wide Consistency Note (non-blocking)

The same action is also pinned to v6.0.2 in two other workflows:

• .github/workflows/ci.yaml:28 — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
• .github/workflows/image.yaml:32 — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

This creates a temporary version drift across workflows. Not a blocker for this PR (Renovate commonly opens per-file PRs, and v6.0.3 is backward-compatible with v6.0.2), but worth noting that follow-up PRs for the other two workflows are likely pending or expected.

---

Sources

• Compare: actions/checkout@v6.0.2...v6.0.3 — 4 commits ahead, all by ericsciple/yaananth, last commit SHA df4cb1c069e1874edd31b4311f1884172cec0e10 matches the workflow pin.
• Release: https://github.com/actions/checkout/releases/tag/v6.0.3 — published 2026-06-02, references PRs #2414, #2439, #2357, #2446.
• PRs cited: actions/checkout#2414 (SHA regex fix), actions/checkout#2439 (SHA-256 init fix).
• Renovate provenance: Generated by Renovate Bot (app/its-miso is the bot identity). PR title follows the conventional-commit ci(github-action): pattern.

---

Standards Compliance

AGENTS.md does not codify specific rules for GitHub Actions version pinning, but the change aligns with good security hygiene:

• ✅ Actions are pinned by full commit SHA, not mutable tag (the v6.0.3 is a comment for human readability; the resolved reference is the immutable SHA).
• ✅ Version comment # v6.0.3 is kept in sync with the SHA — matches the repository's existing pattern across all three workflow files.
• ✅ Patch-only bump stays within the v6 major version line.
• ✅ No secret material, no node_modules/build artifacts, no source code modifications — AGENTS.md §Code Standards rules are unaffected.

Linked Issue Fit

No linked issue references found in the PR body. As a routine Renovate dependency bump, this is not expected to reference an issue. No acceptance criteria to evaluate.

Evidence Provider Findings

No evidence providers were configured for this run. No supply-chain or security findings to report beyond the SHA-pinning verification performed against the GitHub Releases enrichment data.

Tool Harness Findings

Harness reported 0 planned requests with a non-fatal planning warning ("Could not parse planning response as JSON"). No actionable tool findings — the warning is a harness-side issue, not a code defect.

Unknowns or Needs Verification

• None material. The SHA-to-release mapping is corroborated by both the compare metadata (last commit SHA matches) and the GitHub Releases enrichment (v6.0.3 published 2026-06-02). The version drift in ci.yaml and image.yaml is a minor observation, not a gap that affects this PR's correctness.