Merge branch 'main' into dependabot/github_actions/peter-evans/find-comment-4.0.0

Author: nanasess

.github/workflows/benchmark-manual.yml

@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup PHP
         uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2

.github/workflows/benchmark-on-merge.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: main
           fetch-depth: 0

.github/workflows/benchmark-pr.yml

@@ -38,7 +38,7 @@ jobs:
           fi
 
       - name: Checkout PR
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           # Checkout the PR branch for pull_request events
           # For issue_comment events, checkout the PR's head
@@ -60,7 +60,7 @@ jobs:
 
       - name: Checkout PR for comment trigger
         if: github.event_name == 'issue_comment'
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ steps.pr_details.outputs.head_sha }}
 

.github/workflows/ci.yml

@@ -10,7 +10,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             -   name: Checkout
-                uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+                uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
             -   name: Install dependencies
                 uses: php-actions/composer@8a65f0d3c6a1d17ca4800491a40b5756a4c164f3 # v6
                 with:
@@ -24,7 +24,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             -   name: Checkout
-                uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+                uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
             -   name: Install dependencies
                 uses: php-actions/composer@8a65f0d3c6a1d17ca4800491a40b5756a4c164f3 # v6
                 with:
@@ -41,7 +41,7 @@ jobs:
         runs-on: ${{ matrix.os }}
         steps:
             -   name: Checkout
-                uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+                uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
             -   name: Setup PHP
                 uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2
                 with:
@@ -63,7 +63,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             -   name: Checkout
-                uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+                uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
             -   name: Setup PHP
                 uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2
                 with:
@@ -85,9 +85,9 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             -   name: Checkout
-                uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+                uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
             -   name: Checkout php-src repository
-                uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+                uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
                 with:
                     repository: php/php-src
                     path: php-src

.github/workflows/claude-code-review.yml

@@ -16,7 +16,12 @@ jobs:
     # the actions/checkout SHA), which makes claude-code-action's OIDC token exchange
     # fail with "Workflow validation failed" because the workflow no longer matches the
     # version on the default branch. Skipping avoids that expected, unavoidable failure.
-    if: github.actor != 'dependabot[bot]'
+    #
+    # Use the PR author (pull_request.user.login), NOT github.actor: github.actor is
+    # whoever triggered the run, so when merging another PR causes Dependabot to rebase
+    # this one, the run is attributed to the human merger and the check would not be
+    # skipped. The PR author stays 'dependabot[bot]' regardless of who triggers the run.
+    if: github.event.pull_request.user.login != 'dependabot[bot]'
 
     # Optional: Filter by PR author
     # if: |
@@ -33,7 +38,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 1
 

.github/workflows/claude.yml

@@ -29,7 +29,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 1
 

.github/workflows/rector.yaml

@@ -11,7 +11,7 @@ jobs:
         steps:
             -
                 if: github.event.pull_request.head.repo.full_name == github.repository
-                uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+                uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
                 with:
                     # Must be used to trigger workflow after push
                     token: ${{ secrets.ACCESS_TOKEN }}