ci: bump checkout/setup-python actions

[mvdwetering]

Summary by CodeRabbit

• Chores
  • Updated automated publishing, release, and testing workflows to use newer GitHub Actions versions.
  • Improved workflow credential handling during repository checkout.
  • Existing dependency installation, package building, publishing, release, and testing processes remain unchanged.
  • No changes to end-user functionality or product behavior.

[coderabbitai]

Walkthrough

The pull request updates GitHub Actions versions in the publish, release, and test workflows. Checkout uses v5. Python setup uses v6 where applicable. The publish workflow disables persisted checkout credentials. Build and publishing steps remain unchanged.

Changes

Workflow action updates

Layer / File(s)	Summary
Refresh workflow action versions .github/workflows/python-publish.yml, .github/workflows/release.yml, .github/workflows/test.yml	The workflows update actions/checkout to v5 and actions/setup-python to v6 where applicable. The publish workflow sets persist-credentials: false and preserves its build and Twine publishing steps.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Poem

A rabbit checks each workflow line,
Checkout five now runs on time.
Python six joins the release trail,
Credentials no longer set the sail.
Builds and uploads stay the same.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the updates to the checkout and setup-python GitHub Actions.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/bump-gh-actions-20260801

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/python-publish.yml:
- Line 20: Disable persisted checkout credentials for the checkout steps in
.github/workflows/python-publish.yml:20, .github/workflows/release.yml:18, and
.github/workflows/test.yml:21 by setting persist-credentials to false; leave
.github/workflows/release.yml:68 unchanged because that job requires credentials
for git push --follow-tags.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 19e769f9-4d1b-43d0-ad7c-045965ba15f0

📥 Commits

Reviewing files that changed from the base of the PR and between e3ad05c and 83d1b5e.

📒 Files selected for processing (3)

• .github/workflows/python-publish.yml
• .github/workflows/release.yml
• .github/workflows/test.yml

[Copilot]

🟢 Ready to approve

The changes are limited to action version bumps and do not introduce functional workflow logic changes that would block merging.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR updates GitHub Actions workflow dependencies to newer major versions of actions/checkout and actions/setup-python, ensuring CI and release pipelines use updated action runtimes.

Changes:

• Bump actions/checkout from v4 to v5 across workflows.
• Bump actions/setup-python from v5 to v6 where Python is set up (test + publish workflows).

File summaries

File	Description
.github/workflows/test.yml	Updates checkout/setup-python action majors for the test matrix job.
.github/workflows/release.yml	Updates checkout action major for validation and release jobs.
.github/workflows/python-publish.yml	Updates checkout/setup-python action majors for PyPI publishing workflow.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/python-publish.yml:
- Line 20: Update the actions/checkout@v5 step in the publishing workflow to set
persist-credentials to false, preventing the checkout token from remaining
available to later build or publish commands.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 95393d46-5904-4af7-8ad2-b55d4eae5494

📥 Commits

Reviewing files that changed from the base of the PR and between 83d1b5e and e7ecc84.

📒 Files selected for processing (1)

• .github/workflows/python-publish.yml

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/python-publish.yml:
- Around line 21-22: Correct the YAML indentation in the actions/checkout@v5
step by indenting the with block and its persist-credentials setting one
additional space, preserving persist-credentials: false.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: bf5ad4c8-e461-456c-8649-56b23395bb71

📥 Commits

Reviewing files that changed from the base of the PR and between e7ecc84 and 26913f4.

📒 Files selected for processing (1)

• .github/workflows/python-publish.yml