ci(deps)(deps): bump the github-actions group with 3 updates

dependabot[bot] · web-flow · commit e5adee2d711c · 2026-06-05T17:24:23.000Z
Bumps the github-actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [github/codeql-action](https://github.com/github/codeql-action). Updates `actions/checkout` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...df4cb1c) Updates `anthropics/claude-code-action` from 1.0.133 to 1.0.137 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@787c5a0...41ea764) Updates `github/codeql-action` from 4.36.0 to 4.36.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7211b7c...8aad20d) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.137 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
diff --git a/.github/workflows/local-org-policy-live-audit.yml b/.github/workflows/local-org-policy-live-audit.yml
@@ -73,7 +73,7 @@ jobs:
 
     steps:
       - name: Checkout developer-meta-files
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/local-org-policy-live-probe.yml b/.github/workflows/local-org-policy-live-probe.yml
@@ -73,7 +73,7 @@ jobs:
 
     steps:
       - name: Checkout developer-meta-files
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/local-org-tools-mock-tests.yml b/.github/workflows/local-org-tools-mock-tests.yml
@@ -65,7 +65,7 @@ jobs:
       image: debian:trixie
     steps:
       - name: Checkout developer-meta-files
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-bandit.yml b/.github/workflows/reusable-bandit.yml
@@ -101,7 +101,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 
@@ -113,7 +113,7 @@ jobs:
 
       - name: Checkout developer-meta-files (discovery + step-summary helpers)
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           repository: org-ai-assisted/developer-meta-files
           ref: ${{ env.DMF_REF }}
diff --git a/.github/workflows/reusable-claude-code-review.yml b/.github/workflows/reusable-claude-code-review.yml
@@ -192,12 +192,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 
       - name: Run Claude Code Review
-        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251  # v1
+        uses: anthropics/claude-code-action@41ea7642c1436fa0ee57aae58347904b71a5af27  # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           ## Note: the action no longer accepts an 'allowed_users'
diff --git a/.github/workflows/reusable-codeql.yml b/.github/workflows/reusable-codeql.yml
@@ -169,13 +169,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 
       - name: Checkout developer-meta-files (ci/ helpers + step-summary)
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           repository: org-ai-assisted/developer-meta-files
           ref: ${{ env.DMF_REF }}
@@ -211,7 +211,7 @@ jobs:
         run: bash -c "${PREPARE_COMMAND}"
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v4.36.0
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
         with:
           languages: ${{ inputs.language }}
           build-mode: ${{ inputs.build-mode }}
@@ -226,7 +226,7 @@ jobs:
         run: bash -c "${BUILD_COMMAND}"
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v4.36.0
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
         with:
           category: "/language:${{ inputs.language }}"
 
diff --git a/.github/workflows/reusable-coverity.yml b/.github/workflows/reusable-coverity.yml
@@ -143,12 +143,12 @@ jobs:
 
     steps:
       - name: Checkout consumer repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 
       - name: Checkout developer-meta-files (orchestration scripts)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           repository: org-ai-assisted/developer-meta-files
           ref: master
diff --git a/.github/workflows/reusable-cppcheck.yml b/.github/workflows/reusable-cppcheck.yml
@@ -92,13 +92,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 
       - name: Checkout developer-meta-files (ci/ helpers + step-summary)
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           repository: org-ai-assisted/developer-meta-files
           ref: ${{ env.DMF_REF }}
diff --git a/.github/workflows/reusable-pre-push-static.yml b/.github/workflows/reusable-pre-push-static.yml
@@ -101,14 +101,14 @@ jobs:
           git config --global --add safe.directory '*'
 
       - name: Checkout caller repo (full history for git diff)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Checkout developer-meta-files (gate script)
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           repository: org-ai-assisted/developer-meta-files
           ref: ${{ env.DMF_REF }}
diff --git a/.github/workflows/reusable-scorecard.yml b/.github/workflows/reusable-scorecard.yml
@@ -110,7 +110,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 
@@ -129,13 +129,13 @@ jobs:
           retention-days: 14
 
       - name: Upload to GitHub code scanning
-        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v4.36.0
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
         with:
           sarif_file: results.sarif
 
       - name: Checkout developer-meta-files (step-summary helper)
         if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           repository: org-ai-assisted/developer-meta-files
           ref: ${{ env.DMF_REF }}
diff --git a/.github/workflows/reusable-secrets-audit.yml b/.github/workflows/reusable-secrets-audit.yml
@@ -61,7 +61,7 @@ jobs:
       ## back to master.
       - name: Checkout developer-meta-files (audit script)
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           repository: org-ai-assisted/developer-meta-files
           ref: ${{ env.DMF_REF }}
