chore(deps): update actions/checkout action to v6.0.3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v6.0.2 → v6.0.3

---

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Version Change: actions/checkout v6.0.2 → v6.0.3 (patch update)

Major Changes:

• SHA-256 Repository Support: Fixed checkout initialization for repositories using SHA-256 hashing algorithm (PR #2439)

  • Implemented object-format detection before git init
  • Automatically determines hash algorithm from commit SHA length (40 chars = SHA-1, 64 chars = SHA-256) or via GitHub API
  • Runs git init --object-format=sha256 when necessary for SHA-256 repos

• Merge Commit SHA Regex Enhancement: Expanded regex pattern to support both SHA-1 (40 chars) and SHA-256 (64 chars) commit hashes (PR #2414)

  • Updated ref-helper.ts to accept both hash formats in merge commit messages
  • Updated input-helper.ts for explicit SHA detection of both formats
  • Added comprehensive test coverage for both hash algorithms

Breaking Changes:

• None. This is a pure bug fix release with backward compatibility maintained.

Security Fixes:

• No security vulnerabilities addressed. Changes focus on Git hash algorithm compatibility.

🎯 Impact Scope Investigation

Usage Location Analysis:
The actions/checkout action is used in 3 workflow files across 7 job steps:

1. .github/workflows/ci.yml (5 usages):

   • hadolint job (line 22)
   • lint job (line 35)
   • build job (line 48)
   • unit-test job (line 61)
   • e2e-test job (line 78)

2. .github/workflows/claude-renovate-review.yml (1 usage):

   • claude-renovate-review job (line 25)

3. .github/workflows/release-please.yml (1 usage):

   • publish job (line 52)

Current Configuration:
All instances use:

• persist-credentials: false (security best practice)
• SHA pinning with comment annotations (e.g., # v6.0.3)
• No special SHA-256 configurations

Impact on Other Dependencies:

• No impact on other GitHub Actions dependencies
• No changes to workflow syntax or configuration requirements
• This repository uses standard SHA-1 Git (GitHub's current default)

Configuration Impact:

• No environment variables, configuration files, or settings require updates
• The update is transparent to existing workflows
• SHA-256 support is backward compatible and auto-detected

💡 Recommended Actions

Immediate Actions:

1. ✅ Merge this PR - The update is safe and backward compatible
2. ✅ No code changes required - All existing workflow configurations will continue to work without modification
3. ✅ No testing required - The patch only adds SHA-256 repository support and doesn't affect SHA-1 repository behavior

Optional Actions:

• None. This is a transparent patch update with no action items.

Long-term Considerations:

• This update future-proofs the workflows for when GitHub begins supporting SHA-256 repositories
• Current repository operations remain completely unaffected as this codebase uses SHA-1

🔗 Reference Links

• Release Notes v6.0.3
• CHANGELOG
• PR #2439: Fix checkout init for SHA-256 repositories
• PR #2414: Expand merge commit SHA regex and add SHA-256 test cases
• Comparison v6.0.2...v6.0.3

Generated by koki-develop/claude-renovate-review