chore(deps): update actions/checkout digest to df4cb1c

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout (changelog)	action	digest	de0fac2 → df4cb1c

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Summary by CodeRabbit

• Chores
  • Updated the pinned GitHub Actions checkout revision used by the workflow to ensure CI remains compatible and reliable while keeping the same version annotation.
  • Applied consistently across the workflow’s checkout steps (with no other workflow logic changes).

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.

[stranske-keepalive]

Workflow source needed

PR #557 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The pinned commit SHA for actions/checkout (v6) is updated in two places within .github/workflows/pr-00-gate.yml: once in the detect job and once in the summary job. No workflow logic, job structure, or behavior is changed.

Changes

PR Gate Workflow — Dependency Pin Update

Layer / File(s)	Summary
Update pinned checkout SHA in detect and summary jobs .github/workflows/pr-00-gate.yml	Replaces the previous actions/checkout@<sha> commit hash with a new SHA in both the detect job (line 52) and the summary job (line 93), keeping the v6 label.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested reviewers

• stranske

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore(deps): update actions/checkout digest to df4cb1c' directly and clearly summarizes the main change: updating the actions/checkout dependency to a new digest version.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/actions-checkout-digest

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/pr-00-gate.yml:
- Around line 51-53: The pull_request workflow contains two checkout steps that
do not disable credential persistence. Add `persist-credentials: false` as a
parameter to both the `actions/checkout` step at line 52 (labeled "Checkout
repository") and the checkout step at line 93 to prevent unnecessary token
persistence and reduce credential exposure when subsequent workflow steps
execute repository-local code.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9c0b165e-e947-4b23-bebf-14bae269eb9a

📥 Commits

Reviewing files that changed from the base of the PR and between ae7d839 and 8a2f910.

📒 Files selected for processing (1)

• .github/workflows/pr-00-gate.yml

📜 Review details

🧰 Additional context used

📓 Path-based instructions (5)

{pyproject.toml,.github/workflows/**/*.{yml,yaml}}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Ensure coverage threshold settings in pyproject.toml [tool.coverage.report] fail_under match the coverage-min settings in workflow files to prevent threshold conflicts

Files:

• .github/workflows/pr-00-gate.yml

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

For startup_failure GitHub Actions workflow errors, verify YAML syntax validity, avoid permissions: block on workflow_call reusable workflows, and check for circular workflow references

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/pr-00-gate.yml

.github/workflows/pr-00-gate.{yml,yaml}

📄 CodeRabbit inference engine (CLAUDE.md)

pr-00-gate.yml is a create-only standard file that should be kept aligned with the standard gate in stranske/Workflows unless this repo has a documented reason to diverge.

Files:

• .github/workflows/pr-00-gate.yml

**/.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumer repos should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/pr-00-gate.yml

**/.github/workflows/pr-00-gate.{yml,yaml}

📄 CodeRabbit inference engine (AGENTS.md)

pr-00-gate.yml is a create-only standard file that should be kept aligned with the standard gate in stranske/Workflows unless this repo has a documented reason to diverge

Files:

• .github/workflows/pr-00-gate.yml

🪛 zizmor (1.25.2)

.github/workflows/pr-00-gate.yml

[warning] 51-52: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/pr-00-gate.yml:
- Line 52: The version labels in the checkout action steps are inconsistent with
other workflows in the repository. In `.github/workflows/pr-00-gate.yml` at
lines 52 and 93, both uses of
`actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10` have the version
label `# v6`, but they should be updated to `# v6.0.3` to match the more precise
labeling convention used elsewhere in the codebase (e.g., in
`maint-coverage-guard.yml`). Update both line 52 and line 93 to change the
version label from `# v6` to `# v6.0.3` for consistency.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d3486b86-7a38-4d96-80f8-9996feefadbe

📥 Commits

Reviewing files that changed from the base of the PR and between 3e0dd5c and d23b22e.

📒 Files selected for processing (1)

• .github/workflows/pr-00-gate.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Skip review (not opted in)

🧰 Additional context used

📓 Path-based instructions (5)

{pyproject.toml,.github/workflows/**/*.{yml,yaml}}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Ensure coverage threshold settings in pyproject.toml [tool.coverage.report] fail_under match the coverage-min settings in workflow files to prevent threshold conflicts

Files:

• .github/workflows/pr-00-gate.yml

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

For startup_failure GitHub Actions workflow errors, verify YAML syntax validity, avoid permissions: block on workflow_call reusable workflows, and check for circular workflow references

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/pr-00-gate.yml

.github/workflows/pr-00-gate.{yml,yaml}

📄 CodeRabbit inference engine (CLAUDE.md)

pr-00-gate.yml is a create-only standard file that should be kept aligned with the standard gate in stranske/Workflows unless this repo has a documented reason to diverge.

Files:

• .github/workflows/pr-00-gate.yml

**/.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumer repos should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/pr-00-gate.yml

**/.github/workflows/pr-00-gate.{yml,yaml}

📄 CodeRabbit inference engine (AGENTS.md)

pr-00-gate.yml is a create-only standard file that should be kept aligned with the standard gate in stranske/Workflows unless this repo has a documented reason to diverge

Files:

• .github/workflows/pr-00-gate.yml

🪛 zizmor (1.25.2)

.github/workflows/pr-00-gate.yml

[warning] 51-52: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🔀 Multi-repo context stranske/Workflows

Summary of Linked Repositories Research

Based on my exploration of the stranske/Workflows repository, I have identified relevant cross-repository context for this PR:

Key Findings:

Inconsistent version pinning across workflows: [::stranske/Workflows::]

• 99 workflows still use the loose version reference actions/checkout@v6
• 8 workflows already use the pinned digest actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
• This PR updates the gate workflow (lines 72 and 430) to the pinned digest, bringing it into alignment with the migration pattern

Template alignment: [::stranske/Workflows::]

• The template consumer repository (.github/workflows/pr-00-gate.yml in templates/consumer-repo/) already uses the pinned digest
• This suggests the main repo is catching up to ensure consistency across template and production workflows

Gradual migration pattern: [::stranske/Workflows::]

• Workflows that have already migrated to the pinned digest include critical orchestration workflows (agents-70-orchestrator, agents-auto-pilot, agents-guard, autofix, etc.)
• This indicates a deliberate, staged rollout rather than a one-time mass update

No breaking changes expected: [::stranske/Workflows::]

• The update remains within the v6 major version (v6.0.3 digest)
• This is purely a security/consistency fix, not a version upgrade
• All dependent workflows using the updated gate workflow should continue to function normally

🔇 Additional comments (3)

.github/workflows/pr-00-gate.yml (3)

51-52: LGTM!

---

92-93: LGTM!

---

71-71: Coverage thresholds are properly aligned. The workflow sets coverage-min: "80" and pyproject.toml sets fail_under = 80 — no threshold conflicts exist.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.