diff --git a/.github/workflows/build-unsigned-mac-binaries.yml b/.github/workflows/build-unsigned-mac-binaries.yml
index 2acd67585..e5a028773 100644
--- a/.github/workflows/build-unsigned-mac-binaries.yml
+++ b/.github/workflows/build-unsigned-mac-binaries.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v6.0.2
         with:
           ref: '${{ inputs.ref || github.ref }}'
           persist-credentials: false
diff --git a/.github/workflows/chained_e2e.yml b/.github/workflows/chained_e2e.yml
index a807fbfb3..e22b35a54 100644
--- a/.github/workflows/chained_e2e.yml
+++ b/.github/workflows/chained_e2e.yml
@@ -144,7 +144,7 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
@@ -190,7 +190,7 @@ jobs:
       github.repository == 'google-gemini/gemini-cli' && always() && (needs.merge_queue_skipper.result !='success' || needs.merge_queue_skipper.outputs.skip != 'true')
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
@@ -231,7 +231,7 @@ jobs:
     runs-on: 'gemini-cli-windows-16-core'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
@@ -313,7 +313,7 @@ jobs:
       github.repository == 'google-gemini/gemini-cli' && always() && (needs.merge_queue_skipper.result !='success' || needs.merge_queue_skipper.outputs.skip != 'true')
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           ref: '${{ needs.parse_run_context.outputs.sha }}'
           repository: '${{ needs.parse_run_context.outputs.repository }}'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5da8e6e05..57197aa5b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,7 +55,7 @@ jobs:
       GEMINI_LINT_TEMP_DIR: '${{ github.workspace }}/.gemini-linters'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
@@ -130,7 +130,7 @@ jobs:
     if: "github.repository == 'google-gemini/gemini-cli'"
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
       - name: 'Link Checker'
@@ -159,7 +159,7 @@ jobs:
           - 'others'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
@@ -256,7 +256,7 @@ jobs:
           - 'others'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
@@ -344,7 +344,7 @@ jobs:
       security-events: 'write'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
@@ -369,7 +369,7 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
@@ -397,7 +397,7 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.branch_ref || github.ref }}'
diff --git a/.github/workflows/deflake.yml b/.github/workflows/deflake.yml
index 5d94dfc84..52431c99e 100644
--- a/.github/workflows/deflake.yml
+++ b/.github/workflows/deflake.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           ref: '${{ github.event.pull_request.head.sha }}'
           repository: '${{ github.repository }}'
@@ -83,7 +83,7 @@ jobs:
     if: "github.repository == 'google-gemini/gemini-cli'"
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           ref: '${{ github.event.pull_request.head.sha }}'
           repository: '${{ github.repository }}'
@@ -123,7 +123,7 @@ jobs:
     if: "github.repository == 'google-gemini/gemini-cli'"
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           ref: '${{ github.event.pull_request.head.sha }}'
           repository: '${{ github.repository }}'
diff --git a/.github/workflows/docs-audit.yml b/.github/workflows/docs-audit.yml
index 687bd3fb5..f8580a7df 100644
--- a/.github/workflows/docs-audit.yml
+++ b/.github/workflows/docs-audit.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           fetch-depth: 0
           ref: 'main'
diff --git a/.github/workflows/docs-page-action.yml b/.github/workflows/docs-page-action.yml
index 60554fb80..00c9eebf8 100644
--- a/.github/workflows/docs-page-action.yml
+++ b/.github/workflows/docs-page-action.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/eval-pr.yml b/.github/workflows/eval-pr.yml
index 1dab98b2e..cfb9bdf8e 100644
--- a/.github/workflows/eval-pr.yml
+++ b/.github/workflows/eval-pr.yml
@@ -34,7 +34,7 @@ jobs:
       STEERING_DETECTED: '${{ steps.detect.outputs.STEERING_DETECTED }}'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           # Check out the trusted code from main for detection
           fetch-depth: 0
@@ -97,7 +97,7 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           # Check out the fork's PR code for the actual evaluation
           # This only runs AFTER manual approval
diff --git a/.github/workflows/evals-nightly.yml b/.github/workflows/evals-nightly.yml
index 2ee064e4a..454e1a214 100644
--- a/.github/workflows/evals-nightly.yml
+++ b/.github/workflows/evals-nightly.yml
@@ -45,7 +45,7 @@ jobs:
         run_attempt: [1, 2, 3]
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
@@ -106,7 +106,7 @@ jobs:
     runs-on: 'gemini-cli-ubuntu-16-core'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/gemini-automated-issue-dedup.yml b/.github/workflows/gemini-automated-issue-dedup.yml
index 5fa274d7e..61ce0b60c 100644
--- a/.github/workflows/gemini-automated-issue-dedup.yml
+++ b/.github/workflows/gemini-automated-issue-dedup.yml
@@ -47,7 +47,7 @@ jobs:
       duplicate_issues_csv: '${{ env.DUPLICATE_ISSUES_CSV }}'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/gemini-automated-issue-triage.yml b/.github/workflows/gemini-automated-issue-triage.yml
index d30e5d805..935506fff 100644
--- a/.github/workflows/gemini-automated-issue-triage.yml
+++ b/.github/workflows/gemini-automated-issue-triage.yml
@@ -89,7 +89,7 @@ jobs:
           echo "Manual triage checks passed."
 
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/gemini-cli-bot-brain.yml b/.github/workflows/gemini-cli-bot-brain.yml
index 88e2c9231..73c3db42d 100644
--- a/.github/workflows/gemini-cli-bot-brain.yml
+++ b/.github/workflows/gemini-cli-bot-brain.yml
@@ -67,7 +67,7 @@ jobs:
           echo "ref=$REF" >> "$GITHUB_OUTPUT"
 
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           ref: '${{ steps.determine_ref.outputs.ref }}'
           fetch-depth: 0
@@ -257,7 +257,7 @@ jobs:
           echo "ref=$REF" >> "$GITHUB_OUTPUT"
 
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           ref: '${{ steps.determine_ref.outputs.ref }}'
           fetch-depth: 0
diff --git a/.github/workflows/gemini-cli-bot-pulse.yml b/.github/workflows/gemini-cli-bot-pulse.yml
index 32fb6a007..251553b66 100644
--- a/.github/workflows/gemini-cli-bot-pulse.yml
+++ b/.github/workflows/gemini-cli-bot-pulse.yml
@@ -21,7 +21,7 @@ jobs:
     if: "github.repository == 'google-gemini/gemini-cli'"
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
           fetch-depth: 0
diff --git a/.github/workflows/gemini-lifecycle-manager.yml b/.github/workflows/gemini-lifecycle-manager.yml
index 7f0a2b948..1eeec2cda 100644
--- a/.github/workflows/gemini-lifecycle-manager.yml
+++ b/.github/workflows/gemini-lifecycle-manager.yml
@@ -32,7 +32,7 @@ jobs:
           private-key: '${{ secrets.PRIVATE_KEY }}'
 
       - name: 'Checkout repository'
-        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v4
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/gemini-scheduled-issue-dedup.yml b/.github/workflows/gemini-scheduled-issue-dedup.yml
index b18ccf7fc..781b3708f 100644
--- a/.github/workflows/gemini-scheduled-issue-dedup.yml
+++ b/.github/workflows/gemini-scheduled-issue-dedup.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/gemini-scheduled-issue-triage.yml b/.github/workflows/gemini-scheduled-issue-triage.yml
index 55ea54de3..37851bf80 100644
--- a/.github/workflows/gemini-scheduled-issue-triage.yml
+++ b/.github/workflows/gemini-scheduled-issue-triage.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/gemini-scheduled-pr-triage.yml b/.github/workflows/gemini-scheduled-pr-triage.yml
index 33072519b..2b5eb38ec 100644
--- a/.github/workflows/gemini-scheduled-pr-triage.yml
+++ b/.github/workflows/gemini-scheduled-pr-triage.yml
@@ -20,7 +20,7 @@ jobs:
       prs_needing_comment: '${{ steps.run_triage.outputs.prs_needing_comment }}'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/label-backlog-child-issues.yml b/.github/workflows/label-backlog-child-issues.yml
index 920fc1e4c..cd26e74c8 100644
--- a/.github/workflows/label-backlog-child-issues.yml
+++ b/.github/workflows/label-backlog-child-issues.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v6.0.2
         with:
           persist-credentials: false
 
@@ -42,7 +42,7 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v6.0.2
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml
index cbc5bb4f0..3dbd2b498 100644
--- a/.github/workflows/links.yml
+++ b/.github/workflows/links.yml
@@ -16,7 +16,7 @@ jobs:
       ${{ github.repository == 'google-gemini/gemini-cli' }}
     runs-on: 'ubuntu-latest'
     steps:
-      - uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+      - uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/memory-nightly.yml b/.github/workflows/memory-nightly.yml
index 5a953999d..7f2f7de30 100644
--- a/.github/workflows/memory-nightly.yml
+++ b/.github/workflows/memory-nightly.yml
@@ -15,7 +15,7 @@ jobs:
     if: "github.repository == 'google-gemini/gemini-cli'"
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/perf-nightly.yml b/.github/workflows/perf-nightly.yml
index f45ab487e..0d9be5ce0 100644
--- a/.github/workflows/perf-nightly.yml
+++ b/.github/workflows/perf-nightly.yml
@@ -15,7 +15,7 @@ jobs:
     if: "github.repository == 'google-gemini/gemini-cli'"
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release-change-tags.yml b/.github/workflows/release-change-tags.yml
index 09515f27d..1871d878c 100644
--- a/.github/workflows/release-change-tags.yml
+++ b/.github/workflows/release-change-tags.yml
@@ -40,7 +40,7 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v6.0.2
         with:
           ref: '${{ github.ref }}'
           fetch-depth: 0
diff --git a/.github/workflows/release-manual.yml b/.github/workflows/release-manual.yml
index 2a19aa113..a9447f757 100644
--- a/.github/workflows/release-manual.yml
+++ b/.github/workflows/release-manual.yml
@@ -63,13 +63,13 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           fetch-depth: 0
 
       - name: 'Checkout Release Code'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml
index cf281deae..a49010589 100644
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@@ -48,13 +48,13 @@ jobs:
       pull-requests: 'write'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           fetch-depth: 0
 
       - name: 'Checkout Release Code'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
diff --git a/.github/workflows/release-notes.yml b/.github/workflows/release-notes.yml
index d516ee928..826075e3e 100644
--- a/.github/workflows/release-notes.yml
+++ b/.github/workflows/release-notes.yml
@@ -29,7 +29,7 @@ jobs:
       pull-requests: 'write'
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v6.0.2
         with:
           persist-credentials: false
           # The user-level skills need to be available to the workflow
diff --git a/.github/workflows/release-patch-0-from-comment.yml b/.github/workflows/release-patch-0-from-comment.yml
index 29a05884a..b2f7323d9 100644
--- a/.github/workflows/release-patch-0-from-comment.yml
+++ b/.github/workflows/release-patch-0-from-comment.yml
@@ -15,7 +15,7 @@ jobs:
       actions: 'write'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           fetch-depth: 1
diff --git a/.github/workflows/release-patch-1-create-pr.yml b/.github/workflows/release-patch-1-create-pr.yml
index 26b3eaeb6..27c85ac9f 100644
--- a/.github/workflows/release-patch-1-create-pr.yml
+++ b/.github/workflows/release-patch-1-create-pr.yml
@@ -50,7 +50,7 @@ jobs:
       actions: 'write'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v5
         with:
           ref: '${{ github.event.inputs.ref }}'
           fetch-depth: 0
diff --git a/.github/workflows/release-patch-2-trigger.yml b/.github/workflows/release-patch-2-trigger.yml
index 8505f198f..63eee9c10 100644
--- a/.github/workflows/release-patch-2-trigger.yml
+++ b/.github/workflows/release-patch-2-trigger.yml
@@ -62,7 +62,7 @@ jobs:
       pull-requests: 'write'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           ref: "${{ github.event.inputs.workflow_ref || 'main' }}"
diff --git a/.github/workflows/release-patch-3-release.yml b/.github/workflows/release-patch-3-release.yml
index 3dfb992a7..5ffcea6bb 100644
--- a/.github/workflows/release-patch-3-release.yml
+++ b/.github/workflows/release-patch-3-release.yml
@@ -51,14 +51,14 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
 
       - name: 'Checkout Release Code'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.release_ref }}'
diff --git a/.github/workflows/release-promote.yml b/.github/workflows/release-promote.yml
index 2b703bff7..4477f1ecb 100644
--- a/.github/workflows/release-promote.yml
+++ b/.github/workflows/release-promote.yml
@@ -53,7 +53,7 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -170,13 +170,13 @@ jobs:
             sha: '${{ github.event.inputs.ref }}'
     steps:
       - name: 'Checkout Ref'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Checkout correct SHA'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           ref: '${{ matrix.sha }}'
@@ -217,13 +217,13 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Checkout Ref'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Checkout correct SHA'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           ref: '${{ needs.calculate-versions.outputs.PREVIEW_SHA }}'
@@ -291,13 +291,13 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Checkout Ref'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
 
       - name: 'Checkout correct SHA'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           ref: '${{ needs.calculate-versions.outputs.STABLE_SHA }}'
@@ -365,7 +365,7 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Checkout Ref'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
diff --git a/.github/workflows/release-rollback.yml b/.github/workflows/release-rollback.yml
index 1de277d17..54af70778 100644
--- a/.github/workflows/release-rollback.yml
+++ b/.github/workflows/release-rollback.yml
@@ -50,7 +50,7 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Checkout repository'
-        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v4
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.ref }}'
diff --git a/.github/workflows/release-sandbox.yml b/.github/workflows/release-sandbox.yml
index 033ad4500..5bc396098 100644
--- a/.github/workflows/release-sandbox.yml
+++ b/.github/workflows/release-sandbox.yml
@@ -24,7 +24,7 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
           ref: '${{ github.event.inputs.ref || github.sha }}'
diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index 41a9f927d..c4a294afb 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -28,7 +28,7 @@ jobs:
       issues: 'write'
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           ref: '${{ github.event.inputs.ref || github.sha }}'
           fetch-depth: 0
diff --git a/.github/workflows/test-build-binary.yml b/.github/workflows/test-build-binary.yml
index e1ad5832a..76bfe4ed4 100644
--- a/.github/workflows/test-build-binary.yml
+++ b/.github/workflows/test-build-binary.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # ratchet:actions/checkout@v4
+        uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v6.0.2
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/verify-release.yml b/.github/workflows/verify-release.yml
index 964d57408..f731340c1 100644
--- a/.github/workflows/verify-release.yml
+++ b/.github/workflows/verify-release.yml
@@ -43,7 +43,7 @@ jobs:
       - name: '📝 Print vars'
         shell: 'bash'
         run: 'echo "${{ toJSON(vars) }}"'
-      - uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8'
+      - uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         with:
           persist-credentials: false
       - name: 'Verify release'