From 62c60150cbbd1c547c345592f3af87469cc15d3a Mon Sep 17 00:00:00 2001
From: lex00 <121451605+lex00@users.noreply.github.com>
Date: Mon, 10 Aug 2026 12:47:25 -0600
Subject: [PATCH] ci: bump checkout and setup-node pins from v4 to v6

The release.yml rehearsal after #289 annotated both v4 pins as targeting
the deprecated Node 20 runtime. Same v6 SHAs docs.yml already uses, so
all three workflows now pin the same versions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JD1XEfzQByQEP29dMhJgvz
---
 .github/workflows/ci.yml      | 4 ++--
 .github/workflows/release.yml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b19c17..fcba21e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,8 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: '24'
           cache: npm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 180fd23..fc439bc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -42,14 +42,14 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       # No registry-url on purpose (pinhole's publish.yml learned this): with
       # it, setup-node writes an .npmrc pointing auth at NODE_AUTH_TOKEN — a
       # placeholder that overrides OIDC and 404s every publish even when the
       # trusted-publisher record exists. Without it, npm publish exchanges the
       # id-token via the package's trusted-publisher record.
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: '24'
           cache: npm