Update actions/checkout action to v6

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v4 → v6

---

Release Notes

actions/checkout (actions/checkout)

v6

Compare Source

v5

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bri-tong]

Code Review: Update actions/checkout action to v6

Summary

This is an automated Renovate bot PR that bumps actions/checkout from v4 to v6 (a major version jump spanning two major releases) across both CI workflow files (build.yml and deploy-apk.yml). The change is minimal and mechanically correct — two one-line substitutions. The PR has already been merged.

Blocking Issues

None. The change is straightforward and low-risk for a GitHub Actions version bump.

Non-blocking Suggestions

1. Major version jump (v4 → v6) — verify compatibility: This skips an entire major version (v5). While Renovate correctly targets the latest, the PR body contains empty release notes (just comparison links with no content). It would be prudent to verify the actions/checkout v5 and v6 changelogs for any breaking changes, particularly around:

   • Node.js runtime version requirements (Actions runner compatibility)
   • Changes to default behavior (e.g., fetch-depth, persist-credentials, submodule handling)
   • Any new required inputs or changed defaults

2. Consider SHA pinning for supply-chain security: Both workflow files use tag-based references (@v6) rather than pinned commit SHAs. While this matches the existing project convention, pinning to a full SHA (e.g., actions/checkout@<sha> # v6) is a security best practice that protects against tag hijacking. This is not a regression introduced by this PR, but worth considering as a future improvement — tools like StepSecurity or Renovate's pinDigests option can automate this.

3. Other actions may also need updates: I notice actions/setup-java@v5 and gradle/wrapper-validation-action@v3.5.0 are used in the same workflows. Keeping these in sync with their latest versions (as Renovate likely handles separately) is good hygiene.

Questions / Clarifications

None — the intent is clear and the change is correct.