Update github actions (main) (patch)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v6.0.2 → v6.0.3
ossf/scorecard-action	action	patch	v2.4.3 → v2.4.4

---

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

ossf/scorecard-action (ossf/scorecard-action)

v2.4.4

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

• log POST failures instead of failing entire action by @​spencerschrock in #​1625

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🚀 Preview is available at https://b5c4de0c.enterprise-contract.pages.dev

[github-actions]

🚀 Preview is available at https://a9deb436.enterprise-contract.pages.dev

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 2:33 AM UTC · Ended 2:41 AM UTC
Commit: 87c4a29 · View workflow run →

[github-actions]

🚀 Preview is available at https://b89c88be.enterprise-contract.pages.dev

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure · Started 2:33 AM UTC · Completed 2:41 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:43 PM UTC · Completed 2:04 PM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.42

[github-actions]

🚀 Preview is available at https://516690e6.enterprise-contract.pages.dev

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Tiny bot-authored CI workflow version bump (3 files, 8 lines) with low git churn; protected path count and CI workflow changes add moderate risk, but the minimal scope and bot authorship keep overall risk at moderate.

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/build.yaml, .github/workflows/preview.yaml, .github/workflows/scorecards.yml — This PR modifies files under protected paths (.github/). The PR has no linked issue providing authorization for modifying governance or infrastructure files. Human approval is required for all protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.