Bump actions/checkout from 5 to 6

[dependabot]

Bumps actions/checkout from 5 to 6.

Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248
• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• v6-beta by @​ericsciple in actions/checkout#2298
• update readme/changelog for v6 by @​ericsciple in actions/checkout#2311

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

Full Changelog: actions/checkout@v5...v5.0.1

Commits

• df4cb1c Update changelog for v6.0.3 (#2446)
• 1cce339 Fix checkout init for SHA-256 repositories (#2439)
• 900f221 fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)
• 0c366fd Update changelog (#2357)
• de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
• 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
• 8e8c483 Clarify v6 README (#2328)
• 033fa0d Add worktree support for persist-credentials includeIf (#2327)
• c2d88d3 Update all references from v5 and v4 to v6 (#2314)
• 1af3b93 update readme/changelog for v6 (#2311)
• Additional commits viewable in compare view

---

Note

Low Risk
CI-only dependency bump with no application or runtime code changes; main caveat is checkout v6’s credential persistence behavior on hosted runners, which is standard for GitHub-hosted ubuntu-latest/macos/windows jobs here.

Overview
Updates every GitHub Actions workflow that checks out the repo to use actions/checkout@v6 (or the v6.0.3 commit pin df4cb1c069e1874edd31b4311f1884172cec0e10 where workflows previously pinned a SHA).

Affected workflows include API docs deploy, cloud provider tests, lock cleanup, Java/Python/PyPI pipelines, Go tests, golangci-lint, Codecov, and CodeQL—checkout steps only; job logic and other actions are unchanged.

^{Reviewed by Cursor Bugbot for commit 73b268c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

[muir]

@dependabot recreate

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.21%. Comparing base (d8fd5d6) to head (73b268c).

Additional details and impacted files

@@              Coverage Diff              @@
##               main      #60       +/-   ##
=============================================
+ Coverage     36.47%   63.21%   +26.74%     
  Complexity       62       62               
=============================================
  Files            43       43               
  Lines          3515     3515               
  Branches        320      373       +53     
=============================================
+ Hits           1282     2222      +940     
+ Misses         2033      973     -1060     
- Partials        200      320      +120     

Flag	Coverage Δ
aws-negative	34.02% <ø> (?)
aws-positive	43.64% <ø> (?)
azure-negative	33.62% <ø> (?)
azure-positive	44.86% <ø> (?)
base	38.34% <ø> (ø)
gcp-negative	32.66% <ø> (?)
gcp-positive	42.30% <ø> (?)
go	61.65% <ø> (?)
java	61.93% <ø> (+35.78%)	⬆️
python	62.19% <ø> (+19.56%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[muir]

@dependabot recreate

[Copilot]

Pull request overview

This PR updates GitHub Actions workflows to use actions/checkout v6, modernizing CI/CD checkout behavior across Go/Java/Python pipelines and supporting workflows.

Changes:

• Bumps actions/checkout from v5 to v6 in multiple workflows using the major tag.
• Updates several workflows that pin actions/checkout by commit SHA to a v6-era commit.
• Keeps the rest of each workflow unchanged (no application/library code changes).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.github/workflows/python.yml	Updates checkout step from actions/checkout@v5 to @v6.
.github/workflows/publish-pypi.yml	Updates checkout step from actions/checkout@v5 to @v6.
.github/workflows/java.yml	Updates checkout steps from actions/checkout@v5 to @v6 (build + release jobs).
.github/workflows/golangci-lint.yml	Updates pinned actions/checkout SHA (intended v6 pin).
.github/workflows/go.yml	Updates pinned actions/checkout SHA (intended v6 pin).
.github/workflows/codeql-analysis.yml	Updates pinned actions/checkout SHA (intended v6 pin).
.github/workflows/codecov.yml	Updates pinned actions/checkout SHA (intended v6 pin).
.github/workflows/cloud_provider.yml	Updates checkout steps from actions/checkout@v5 to @v6.
.github/workflows/cloud_clear_stale_locks.yml	Updates checkout steps from actions/checkout@v5 to @v6.
.github/workflows/api-docs-pages.yml	Updates checkout step from actions/checkout@v5 to @v6.

[muir]

@cursoragent double-check copilot's comments and fix the PR if they're valid

[cursor]

Copilot's comments were valid, and the PR is fixed.

What was wrong

The four SHA-pinned workflows (codecov.yml, codeql-analysis.yml, go.yml, golangci-lint.yml) were updated to 93cb6efe..., which resolves to actions/checkout v5.0.1 (the current v5 tag), not v6. Dependabot had effectively bumped those pins from an older v5 commit to the latest v5, while the tag-based workflows correctly used @v6.

What I changed

Updated all four pinned workflows to df4cb1c069e1874edd31b4311f1884172cec0e10, which is the commit behind the upstream @v6 tag (v6.0.3). That aligns the SHA-pinned workflows with the @v6 references in the other workflows.

Commit pushed: 73b268c — "Fix pinned actions/checkout SHAs to current v6 release"