chore(deps): pin dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	pinDigest	→ 11d5960
actions/checkout	action	pinDigest	→ fbc6f39

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 1am and before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[greptile-apps]

PR author is in the excluded authors list.

[cursor]

Risk: medium. Left a non-blocking comment — Cursor Security Agent was present but skipped, so this is not approved from automated signals. Cursor Bugbot was not present; human review is needed (existing reviewer assignment stands).

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Two different digests both labelled v5 for actions/checkout across templates

This template is now pinned to actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5, while the already-pinned workflow-templates/public-repo-guard.yml:45 (and .github/workflows/public-repo-guard.yml:45) uses 93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1. Two distinct commits carrying the same major-version comment is worth a quick verification that fbc6f39… really is the commit the v5 tag points at today (i.e. a newer v5.0.x), otherwise the org templates ship an older checkout than the guard workflow and the # v5 comment is misleading for future manual bumps. Also note the comment style differs (single vs double space before #), a cosmetic inconsistency across the template set.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Needs human review

Mechanical dependency pinning to commit SHAs is low-risk, but all modified workflow templates are owned by yakimoto while the author owns none of them. The designated owner should review these changes.

^{You can customize Macroscope's approvability policy. Learn more.}