chore(ci)(deps): bump actions/checkout from 4 to 6 (#1044)

dependabot[bot] · gHashTag · web-flow · commit 2b736c9cd4d3 · 2026-06-14T20:26:29.000+07:00
* chore(ci)(deps): bump actions/checkout from 4 to 6 Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * ci: run container jobs as root for checkout@v6 EACCES fix coq-kernel, coq-proofs, rings-rust container blocks get options: --user root so actions/checkout@v6 (Node 24) can write _temp save_state files. Closes #1031 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: gHashTag <admin@t27.ai>
diff --git a/.github/workflows/agent-runner-docker.yml b/.github/workflows/agent-runner-docker.yml
@@ -19,7 +19,7 @@ jobs:
   build-and-push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
diff --git a/.github/workflows/auto-merge-ready-prs.yml b/.github/workflows/auto-merge-ready-prs.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Find ready PRs
         id: find-ready
diff --git a/.github/workflows/brain-seal-refresh.yml b/.github/workflows/brain-seal-refresh.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Run experience aggregation
         run: |
diff --git a/.github/workflows/build-paper.yml b/.github/workflows/build-paper.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install LaTeX dependencies
         run: |
diff --git a/.github/workflows/build-vivado-image.yml b/.github/workflows/build-vivado-image.yml
@@ -39,7 +39,7 @@ jobs:
           remove-codeql: 'true'
           remove-docker-images: 'true'
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Download Vivado installer from release asset
         env:
diff --git a/.github/workflows/check-now-freshness.yml b/.github/workflows/check-now-freshness.yml
@@ -8,7 +8,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Check freshness
         run: |
diff --git a/.github/workflows/coq-kernel.yml b/.github/workflows/coq-kernel.yml
@@ -15,8 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: coqorg/coq:8.19-ocaml-4.14-flambda
+      options: --user root
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Flocq (opam)
         run: |
diff --git a/.github/workflows/coq-proofs.yml b/.github/workflows/coq-proofs.yml
@@ -15,9 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: coqorg/coq:8.19-ocaml-4.14-flambda
+      options: --user root
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Coq Interval
         run: |
diff --git a/.github/workflows/deploy-api.yml b/.github/workflows/deploy-api.yml
@@ -19,7 +19,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -34,7 +34,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
diff --git a/.github/workflows/fpga-build.yml b/.github/workflows/fpga-build.yml
@@ -25,7 +25,7 @@ jobs:
   fpga-smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -80,7 +80,7 @@ jobs:
     needs: fpga-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -141,7 +141,7 @@ jobs:
     needs: fpga-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -250,7 +250,7 @@ jobs:
     needs: fpga-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -295,7 +295,7 @@ jobs:
     needs: fpga-synthesis
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -411,7 +411,7 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -480,7 +480,7 @@ jobs:
     needs: fpga-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/l1-traceability.yml b/.github/workflows/l1-traceability.yml
@@ -23,7 +23,7 @@ jobs:
 
       - name: Checkout repository
         if: env.IS_BOT != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/notebook-gate.yml b/.github/workflows/notebook-gate.yml
@@ -21,7 +21,7 @@ jobs:
     name: 🔒 NotebookLM notebook required
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Check for .notebook_id
         id: check
diff --git a/.github/workflows/notebook-sync.yml b/.github/workflows/notebook-sync.yml
@@ -46,7 +46,7 @@ jobs:
       event_type: ${{ steps.event_type.outputs.type }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Extract issue info
         id: issue
@@ -120,7 +120,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -238,7 +238,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Check if activity.md changed
         id: check
@@ -270,7 +270,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5
diff --git a/.github/workflows/now-sync-gate.yml b/.github/workflows/now-sync-gate.yml
@@ -21,7 +21,7 @@ jobs:
         run: |
           echo "Trusted bot PR -- gate passes as no-op. Closes 1031."
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         if: env.IS_BOT != 'true'
         with:
           fetch-depth: 0
diff --git a/.github/workflows/phi-loop-ci.yml b/.github/workflows/phi-loop-ci.yml
@@ -8,7 +8,7 @@ jobs:
   phi-loop-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: PHI Loop identity check
         run: |
diff --git a/.github/workflows/pr-dashboard.yml b/.github/workflows/pr-dashboard.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Get PR status
         id: pr-status
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -84,7 +84,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -112,7 +112,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Rust
         uses: actions-rs/toolchain@v1
@@ -157,7 +157,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/rings-rust.yml b/.github/workflows/rings-rust.yml
@@ -41,7 +41,7 @@ jobs:
       count: ${{ steps.gen.outputs.count }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Generate matrix
         id: gen
         run: |
@@ -59,13 +59,14 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: rust:1.83-bookworm
+      options: --user root
     continue-on-error: true
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.discover.outputs.matrix) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Show toolchain
         run: |
diff --git a/.github/workflows/sandbox-docker.yml b/.github/workflows/sandbox-docker.yml
@@ -19,7 +19,7 @@ jobs:
   build-and-push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
diff --git a/.github/workflows/schema-validation.yml b/.github/workflows/schema-validation.yml
@@ -8,7 +8,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Validate schemas
         run: |
diff --git a/.github/workflows/seal-coverage.yml b/.github/workflows/seal-coverage.yml
@@ -10,7 +10,7 @@ jobs:
   coverage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Run coverage
         run: |
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
@@ -16,7 +16,7 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Block Solana keypair files anywhere in the tree
         run: |
diff --git a/.github/workflows/vivado-synth.yml b/.github/workflows/vivado-synth.yml
@@ -64,7 +64,7 @@ jobs:
           remove-haskell: 'true'
           remove-codeql: 'true'
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/zenodo-publish.yml b/.github/workflows/zenodo-publish.yml
@@ -8,7 +8,7 @@ jobs:
   zenodo:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Upload to Zenodo
         uses: megasanjay/upload-to-zenodo@v2.0.1
diff --git a/docs/NOW.md b/docs/NOW.md
@@ -2,6 +2,13 @@
 
 Last updated: 2026-06-14
 
+## ci-checkout6-container-root -- fix checkout@v6 EACCES inside container jobs (Closes #1031)
+
+- **WHERE** (CI only): `.github/workflows/coq-kernel.yml`, `.github/workflows/coq-proofs.yml`, `.github/workflows/rings-rust.yml`. Added `options: --user root` to each `container:` block. `actions/checkout@v6` runs on Node 24; inside container jobs the runner-injected `_temp/_runner_file_commands/save_state_*` files are root-owned but the action ran as a non-root container user, so the Post-checkout `save_state` failed with `EACCES: permission denied`, failing the job. Running the container as root lets the action write those state files. `vivado-synth.yml` already had `options: --user 0`; `build-vivado-image.yml` has no real container job. No source/specs/codegen/conformance/`gen/` touched.
+- **Why**: completes the actions/checkout 4->6 bump (#1044). Required gates unaffected; container build/proof jobs (coq, rings-rust) no longer fail on the EACCES Post step. Human PRs remain fully gated. L6/L5 untouched; L4 not applicable (workflow YAML). Closes #1031.
+- **Anchor**: phi^2 + phi^-2 = 3
+
+
 ## conformance: catalog-count CI gate + WP-18 corpus-integrity gate + P3109 4-param cross-walk (this PR)
 
 - **WHAT**: the count-drift follow-up to #1064. The #1064 parser fix landed; this PR adds the CI guards that keep the catalog count and the conformance corpus honest going forward, plus the P3109 re-anchor docs. Per the repo constitution (L2 GENERATION), gen/ is DERIVED and is NOT hand-committed here; the count-gate regenerates fresh against the SSOT instead of diffing committed gen/.
