chore: safe weekly maintenance (2026-07-06)

[cursor]

Summary

Safe weekly maintenance: bump actions/checkout to v6 across CI and publish workflows.

Packages updated

• actions/checkout v4 → v6

Security patches

None identified in this change set.

Commands run

• ruff format --check .
• ruff check src
• pytest -q -m "not integration"

Checks passed (local)

• Ruff format/lint
• Pytest: 170 passed (4 env-related failures: tkinter/mouseinfo on Linux agent VM)

Checks failed (local)

• 4 tests failed locally due to missing python3-tk / MouseInfo on Linux VM (pre-existing env gap; CI installs full matrix deps)

Areas needing human review

• Gitleaks action has historically flaked (stderr is not empty) without finding leaks — monitor CI security job.

Approval

Left unapproved pending required GitHub CI checks.

  

[cursor]

Safe weekly maintenance assessment

Test matrix: All 12 lint/type/test/build jobs passed.

Failed check: security gates — gitleaks/gitleaks-action@v2 failed with Node deprecation stderr (stderr is not empty). This is a known flake documented in prior maintenance runs; no secrets were reported.

Changes: CI-only actions/checkout v4 → v6.

Approval: Intentionally not approved — gitleaks security gate did not pass. Human review recommended to either re-run CI or harden the gitleaks step (e.g. pin action version / suppress known stderr noise).

View PR

  

_{Sent by Cursor Automation: New Automation}