chore: safe weekly maintenance — checkout v6 + README format

[cursor]

Summary

Low-risk weekly maintenance: bump GitHub Actions checkout major and apply ruff formatting to README example block.

Packages updated

• actions/checkout v4 → v6 (ci.yml, publish.yml)

Security patches

None in this change set.

Commands run

• ruff format --check .
• ruff check src
• mypy
• pytest -q -m "not integration"

Checks passed (local)

• Ruff format/lint (src scope) ✅
• Mypy ✅
• Pytest ✅

Checks failed (local)

None

Areas needing human review

• gitleaks job has historically flaked in this repo (Node deprecation stderr) without finding leaks — monitor CI security job.

Approval

Intentionally left unapproved — awaiting required GitHub CI checks (especially security/gitleaks).

  

[cursor]

Safe weekly maintenance — test matrix green; security job needs human review

Test matrix (12 jobs): All lint/type/test/build jobs passed after pinning ruff==0.15.17 (floating ruff>=0.15.0 pulled 0.16.x with new rules).

Security gates: Failed — gitleaks/gitleaks-action@v2 exits with stderr is not empty due to Node.js 24 deprecation warnings (known flake; no leaks found). This predates this PR and needs a separate gitleaks-action upgrade or workflow tweak.

Changes in this PR:

• actions/checkout v4 → v6
• README example ruff format
• Pin ruff==0.15.17 in CI

Approval: Intentionally not approved — security job did not pass. Merge test-matrix fixes separately or address gitleaks first.

View PR

  

_{Sent by Cursor Automation: New Automation}