ci(deps): bump actions/checkout from 4 to 6

[dependabot]

Bumps actions/checkout from 4 to 6.

Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248
• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• v6-beta by @​ericsciple in actions/checkout#2298
• update readme/changelog for v6 by @​ericsciple in actions/checkout#2311

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226
• Prepare v5.0.0 release by @​salmanmkc in actions/checkout#2238

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.1

What's Changed

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

What's Changed

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

v4.2.0

• Add Ref and Commit outputs by @​lucacome in actions/checkout#1180
• Dependency updates by @​dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in actions/checkout#1739
• Bump actions/checkout from 3 to 4 by @​dependabot in actions/checkout#1697
• Check out other refs/* by commit by @​orhantoy in actions/checkout#1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in actions/checkout#1776

v4.1.6

• Check platform to set archive extension appropriately by @​cory-miller in actions/checkout#1732

... (truncated)

Commits

• de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
• 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
• 8e8c483 Clarify v6 README (#2328)
• 033fa0d Add worktree support for persist-credentials includeIf (#2327)
• c2d88d3 Update all references from v5 and v4 to v6 (#2314)
• 1af3b93 update readme/changelog for v6 (#2311)
• 71cf226 v6-beta (#2298)
• 069c695 Persist creds to a separate file (#2286)
• ff7abcd Update README to include Node.js 24 support details and requirements (#2248)
• 08c6903 Prepare v5.0.0 release (#2238)
• Additional commits viewable in compare view

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Changes in this update

• actions/setup-python bumped from v5 to v6 across all 5 workflow files (deploy.yml, integration.yml, quality.yml, release.yml, test.yml). This is a standard, non-breaking upgrade.

All other changes from previous reviews remain valid and unchanged. No new code behavior introduced.

---

_{Reviewed by ling-2.6-1t-20260423:free · 592,846 tokens}

[moshehbenavraham]

@dependabot rebase

(Rebasing after vidapi #2 + #4 merged in same run. checkout 4→6 touches deploy/integration/quality/release/security/test.yml — will reattempt next run with current main. — Developer agent)

[moshehbenavraham]

@dependabot rebase

(Base drifted — main has moved twice since the last rebase yesterday (90ffc71 → 8b6c2d4 → fc0d7b8 via Max's release commit at 18:58 UTC). Will retry direct merge next scheduled run after rebase settles. — Developer agent)

[moshehbenavraham]

Reviewed by Developer agent on scheduled GitHub maintenance.

Not eligible for safe auto-merge — this is a TWO-major version bump (v4 → v6) where v6 adds material behavior beyond the Node 24 runtime upgrade.

• v5: Node 24 runtime upgrade (the safe m97 pattern — would be a clean auto-merge on its own)
• v6: Persist credentials to a SEPARATE file under $RUNNER_TEMP instead of in the local git config. Requires Actions Runner v2.329.0+ (GitHub-hosted runners are fine).

The v6 change is generally transparent for repos that don't read git-stored credentials downstream of actions/checkout. For vidapi (FastAPI, MIT, no Docker container actions reading checkout-persisted creds visible) the upgrade is likely safe — but this is a deliberate audit step, not auto-merge.

Recommended action: review v6 release notes (https://github.com/actions/checkout/releases/tag/v6.0.0), confirm none of the workflows downstream of actions/checkout rely on credentials being in the local git config, then merge manually.

Alternatively: if you'd rather take it incrementally, comment @dependabot ignore this minor version to defer v6 and let dependabot reopen with v5 only on the next scan.

🤖 Posted by the Developer agent on a scheduled GitHub maintenance run.