ci: bump actions/checkout from 6.0.2 to 6.0.3 by dependabot[bot] · Pull Request #201 · klodr/faxdrop-mcp

dependabot · 2026-06-03T04:47:34Z

Bumps actions/checkout from 6.0.2 to 6.0.3.

Release notes

Sourced from actions/checkout's releases.

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

... (truncated)

Commits

df4cb1c Update changelog for v6.0.3 (#2446)
1cce339 Fix checkout init for SHA-256 repositories (#2439)
900f221 fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)
0c366fd Update changelog (#2357)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

Chores
- Updated GitHub Actions workflows with newer pinned versions of checkout dependencies across multiple CI/CD pipeline files for consistency and maintenance.

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

codecov · 2026-06-03T04:48:12Z

Bundle Report

Bundle size has no change ✅

codecov · 2026-06-03T04:48:21Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (be0076f) to head (8d3450d).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #201   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           16        16           
  Lines          531       531           
  Branches       138       138           
=========================================
  Hits           531       531

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update be0076f...8d3450d. Read the comment docs.

klodr · 2026-06-03T14:29:15Z

@coderabbitai review

coderabbitai · 2026-06-03T14:29:27Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-06-03T14:29:36Z

Walkthrough

This PR updates pinned actions/checkout commit SHAs across nine GitHub Actions workflows. Seven workflows migrate from v6.0.2 to v6.0.3, while three workflows update existing v6.0.0 pins to new commit SHAs, ensuring all checkout steps use consistent, verified action versions across the CI/CD pipeline.

Changes

Checkout Action Pin Updates

Layer / File(s)	Summary
Version 6.0.2 to 6.0.3 migrations `.github/workflows/actions-pinned.yml`, `bundle-analysis.yml`, `editorconfig-check.yml`, `gitleaks.yml`, `lockfile-lint.yml`, `osv-scanner.yml`, `scorecard.yml`	Seven workflows upgrade the pinned `actions/checkout` commit SHA from v6.0.2 to v6.0.3 in their checkout steps.
Version 6.0.0 pin updates `.github/workflows/codeql.yml`, `docker.yml`, `release.yml`	CodeQL, Docker, and Release workflows update existing pinned v6.0.0 `actions/checkout` commit SHAs to new verified commit hashes without changing the version reference.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

klodr/faxdrop-mcp#102: Updates pinned actions/checkout commit SHAs across multiple workflows including lockfile-lint.yml and osv-scanner.yml.
klodr/faxdrop-mcp#151: Modifies .github/workflows/actions-pinned.yml to update the pinned actions/checkout commit SHA in the checkout step.
klodr/faxdrop-mcp#164: Updates .github/workflows/actions-pinned.yml to pin a different actions/checkout revision.

Suggested reviewers

klodr

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits format with correct type (ci), subject in imperative mood (bump), lowercase, no trailing period, and is well under 72 character limit at 45 characters.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dependabot/github_actions/actions/checkout-6.0.3

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/codeql.yml:
- Line 34: The inline comment after the uses line
"actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" is inaccurate;
update the comment to match the actual pinned version (change "# v6.0.0" to "#
v6.0.3") or remove the comment entirely so it no longer misrepresents the commit
SHA referenced by actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10.

In @.github/workflows/docker.yml:
- Around line 39-40: Update the Checkout step so it opts out of persisting
credentials by adding the persist-credentials: false input to the
actions/checkout invocation; locate the step with name "Checkout" and uses
"actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" and add the
persist-credentials: false property to avoid leaving GITHUB_TOKEN in the local
git config.
- Line 40: Update the stale version comments for the pinned actions/checkout SHA
df4cb1c069e1874edd31b4311f1884172cec0e10 by changing the trailing comment from
"# v6.0.0" to "# v6.0.3"; specifically update the uses:
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 comment occurrences
(the checkout invocation shown and the other two instances noted in the review)
so the comment accurately reflects v6.0.3.

In @.github/workflows/release.yml:
- Around line 24-25: Add persist-credentials: false to both checkout steps to
avoid persisting GITHUB_TOKEN in the git config; specifically update the steps
that use actions/checkout (the one currently showing "uses:
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" and the later
checkout step around the npm/gh release flow) by adding the persist-credentials:
false input under each checkout step so release publishing uses only the
provided GH_TOKEN and npm credentials.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: cc385420-44bf-412b-843f-c18febaa3ba0

📥 Commits

Reviewing files that changed from the base of the PR and between be0076f and 8d3450d.

📒 Files selected for processing (10)

.github/workflows/actions-pinned.yml
.github/workflows/bundle-analysis.yml
.github/workflows/codeql.yml
.github/workflows/docker.yml
.github/workflows/editorconfig-check.yml
.github/workflows/gitleaks.yml
.github/workflows/lockfile-lint.yml
.github/workflows/osv-scanner.yml
.github/workflows/release.yml
.github/workflows/scorecard.yml

coderabbitai · 2026-06-03T14:34:52Z

    steps:
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0


⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update version comment to match the actual version.

The pinned commit SHA df4cb1c069e1874edd31b4311f1884172cec0e10 corresponds to actions/checkout@v6.0.3, but the inline comment still shows # v6.0.0. This mismatch can confuse maintainers during future updates.

📝 Proposed fix to correct the version comment

- - name: Checkout repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0 + - name: Checkout repository + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0

uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 33-34: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql.yml at line 34, The inline comment after the uses line "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" is inaccurate; update the comment to match the actual pinned version (change "# v6.0.0" to "# v6.0.3") or remove the comment entirely so it no longer misrepresents the commit SHA referenced by actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10.

coderabbitai · 2026-06-03T14:34:52Z

      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0


🧹 Nitpick | 🔵 Trivial | 💤 Low value

Optional: set persist-credentials: false on this checkout.

zizmor flags credential persistence (artipacked) here. This build job only reads the repo and never pushes, so the GITHUB_TOKEN does not need to remain in the local git config after checkout. Given the repo's supply-chain posture, opting out is a cheap hardening. Pre-existing and out of scope for the SHA bump, so treat as nice-to-have.

🔒 Optional hardening

- name: Checkout uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0 + with: + persist-credentials: false

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

- name: Checkout

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.0

uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0

- name: Checkout

uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0

with:

persist-credentials: false

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 39-40: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/docker.yml around lines 39 - 40, Update the Checkout step so it opts out of persisting credentials by adding the persist-credentials: false input to the actions/checkout invocation; locate the step with name "Checkout" and uses "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" and add the persist-credentials: false property to avoid leaving GITHUB_TOKEN in the local git config.

coderabbitai · 2026-06-03T14:34:52Z

    steps:
      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0


⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Map relevant actions/checkout tags to their commit SHAs gh api repos/actions/checkout/tags --paginate \ --jq '.[] | select(.name=="v6.0.0" or .name=="v6.0.2" or .name=="v6.0.3") | "\(.name)\t\(.commit.sha)"' # What tag/commit does the pinned SHA resolve to? echo "--- pinned SHA resolves to: ---" gh api repos/actions/checkout/commits/df4cb1c069e1874edd31b4311f1884172cec0e10 --jq '.sha'

Repository: klodr/faxdrop-mcp

Length of output: 278

🏁 Script executed:

#!/bin/bash set -euo pipefail # Find all pinned actions/checkout lines in workflows, including the trailing "# v..." rg -n --hidden --no-ignore-vcs "uses:\s*actions/checkout@[0-9a-f]{40}\s*(#\s*v[0-9]+\.[0-9]+\.[0-9]+)?" .github/workflows \ || true # Specifically flag any cases where the v6.0.0 comment is paired with the df4cb... SHA rg -n --hidden --no-ignore-vcs "uses:\s*actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10\s*#\s*v6\.0\.0" .github/workflows \ || true

Repository: klodr/faxdrop-mcp

Length of output: 1806

Fix stale actions/checkout version comments for SHA df4cb1c069e1874edd31b4311f1884172cec0e10

The pinned SHA df4cb1c069e1874edd31b4311f1884172cec0e10 corresponds to actions/checkout v6.0.3 (not v6.0.0); the real v6.0.0 tag points to 1af3b93b6815bc44a9784bd300feb67ff0d1eeb3.

Update the trailing comments from # v6.0.0 to # v6.0.3 in:

.github/workflows/docker.yml:40

.github/workflows/codeql.yml:34

.github/workflows/release.yml:25 and .github/workflows/release.yml:53

This is a documentation/version-comment mismatch only; the checked-out commit is already the v6.0.3 SHA everywhere.

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 39-40: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/docker.yml at line 40, Update the stale version comments for the pinned actions/checkout SHA df4cb1c069e1874edd31b4311f1884172cec0e10 by changing the trailing comment from "# v6.0.0" to "# v6.0.3"; specifically update the uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 comment occurrences (the checkout invocation shown and the other two instances noted in the review) so the comment accurately reflects v6.0.3.

coderabbitai · 2026-06-03T14:34:52Z

      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0


🧹 Nitpick | 🔵 Trivial | 💤 Low value

Optional: persist-credentials: false on both checkouts.

zizmor flags artipacked on both steps. Release builds/publishes via gh release (uses GH_TOKEN from env) and npm publish — neither relies on the git-config-persisted GITHUB_TOKEN — so opting out is safe and tightens the credential surface. Pre-existing; nice-to-have alongside the SHA bump.

Also applies to: 52-53

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 24-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 24 - 25, Add persist-credentials: false to both checkout steps to avoid persisting GITHUB_TOKEN in the git config; specifically update the steps that use actions/checkout (the one currently showing "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" and the later checkout step around the npm/gh release flow) by adding the persist-credentials: false input under each checkout step so release publishing uses only the provided GH_TOKEN and npm credentials.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 3, 2026

dependabot Bot requested a review from klodr as a code owner June 3, 2026 04:47

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 3, 2026

coderabbitai Bot requested changes Jun 3, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: bump actions/checkout from 6.0.2 to 6.0.3#201

ci: bump actions/checkout from 6.0.2 to 6.0.3#201
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/checkout-6.0.3

dependabot Bot commented on behalf of github Jun 3, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

codecov Bot commented Jun 3, 2026

Uh oh!

codecov Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

klodr commented Jun 3, 2026

Uh oh!

coderabbitai Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Jun 3, 2026

Uh oh!

coderabbitai Bot Jun 3, 2026

Uh oh!

coderabbitai Bot Jun 3, 2026

Uh oh!

coderabbitai Bot Jun 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
	uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.0.3

What's Changed

New Contributors

Changelog

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

Summary by CodeRabbit

Uh oh!

codecov Bot commented Jun 3, 2026

Bundle Report

Uh oh!

codecov Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

klodr commented Jun 3, 2026

Uh oh!

coderabbitai Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jun 3, 2026 •

edited by coderabbitai Bot

Loading

codecov Bot commented Jun 3, 2026 •

edited

Loading

coderabbitai Bot commented Jun 3, 2026 •

edited

Loading

coderabbitai Bot commented Jun 3, 2026 •

edited

Loading