chore(deps): update github actions non-major

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v6.0.2 → 6.0.3
actions/create-github-app-token	action	minor	3.1.1 → 3.2.0

---

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/create-github-app-token (actions/create-github-app-token)

v3.2.0

Compare Source

Features

• add support for enterprise-level GitHub Apps (#​263) (952a2a7)
• support full repository names in repositories input (#​372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#​364) (43e5c34)
• validate private-key input (#​376) (f24bbd8)

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "on the 15th day of the month before 12pm"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Greptile Summary

Bumps two GitHub Actions dependencies across all workflow files: actions/checkout from v6.0.2 to 6.0.3 and actions/create-github-app-token from 3.1.1 to 3.2.0. All references remain pinned to full commit SHAs, which is the correct security posture for GitHub Actions.

• actions/checkout@6.0.3 fixes checkout initialisation for SHA-256 repositories and broadens the merge-commit SHA regex.
• actions/create-github-app-token@3.2.0 adds enterprise-level GitHub App support, full repository-name support in the repositories input, private-key validation, and a dependency bump for @actions/core.

Confidence Score: 5/5

Routine automated dependency bump with no logic changes; all action references remain pinned to full commit SHAs.

All four workflow files receive identical mechanical changes: updated SHA pins and version comments. The upstream releases are patch/minor fixes with no breaking changes. SHA-pinning is preserved throughout, so there is no supply-chain regression introduced by this PR.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Bumps actions/checkout from v6.0.2 to 6.0.3 (pinned SHA); comment drops the v prefix
.github/workflows/docs.yml	Bumps actions/checkout from v6.0.2 to 6.0.3 (pinned SHA); comment drops the v prefix
.github/workflows/lint.yml	Bumps actions/checkout from v6.0.2 to 6.0.3 (pinned SHA); comment drops the v prefix
.github/workflows/release-please.yml	Bumps actions/checkout to 6.0.3 and actions/create-github-app-token to 3.2.0, both pinned by SHA

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Push / PR] --> B{Workflow trigger}
    B --> C[ci.yml - PHP matrix 8.2 to 8.5]
    B --> D[lint.yml - PHP 8.2]
    B --> E[docs.yml - PHP 8.2]
    B --> F[release-please.yml]

    C --> G[actions/checkout 6.0.3]
    D --> G
    E --> G
    F --> H[actions/create-github-app-token 3.2.0]
    H --> G

    G --> I[shivammathur/setup-php]
    I --> J[Run tests / lint / docs / release]

Loading

_{Reviews (1): Last reviewed commit: "chore(deps): update github actions non-m..." | Re-trigger Greptile}