CI: outdated actions/checkout versions (v2, v3) should be updated to v4+

[dobby-coder]

Problem

The CI workflow .github/workflows/build.yml uses outdated versions of actions/checkout:

• Line 32 (test job): actions/checkout@v3
• Line 46 (format job): actions/checkout@v3
• Line 65 (test-wasm-browsers job): actions/checkout@v2

actions/checkout@v2 and @v3 use Node.js 16, which GitHub has deprecated. These will emit deprecation warnings and will eventually stop working.

The delivery.yml workflow already uses actions/checkout@v6, so this is inconsistent within the same repo.

Suggested fix

Update all actions/checkout references in build.yml to @v4 (or @v6 to match delivery.yml):

- uses: actions/checkout@v4

Additional note

The test-wasm-browsers job also installs wasm-pack from scratch every run via cargo install wasm-pack. Consider caching this or using a pre-built binary action to speed up CI.

[dobby-coder]

/dobby please open a PR for this issue.

[dobby-coder]

/dobby Please open a PR that bumps actions/checkout to v4+ in CI workflows. Test by triggering CI on the branch. Mark ready-for-review if green. Add @rubenhensen as reviewer.

[dobby-coder]

/dobby please open a PR for this issue. Test thoroughly (build + run the test suite, verify the fix works). If everything is green, mark the PR ready-for-review and add @rubenhensen as reviewer; otherwise keep it as a draft and comment explaining why.

[dobby-coder]

This agent is on it! Bumping those rusty checkout actions to v4 right away — Dobby will build, test, and open a PR. So excited to be helping!

[dobby-coder]

Blocked: cannot open this PR.

The change is trivially correct (verified diff below), but the GitHub App backing this agent does not hold the workflows permission, and GitHub refuses any push that touches .github/workflows/:

! [remote rejected] ci/bump-checkout-v4 -> ci/bump-checkout-v4
  (refusing to allow a GitHub App to create or update workflow
  `.github/workflows/build.yml` without `workflows` permission)

This is a hard GitHub-side restriction — it applies equally to the contents API, tree API, GraphQL createCommitOnBranch, and git push. There's no workaround on the agent side.

Diff that needs to land

--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ test job
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
@@ format job
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
@@ test-wasm-browsers job
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4

delivery.yml is already on @v6; @v4 is the conservative bump for build.yml.

To unblock

Either:

1. @rubenhensen applies the diff above with a PAT that has the workflow scope, or
2. Grant the bot installation workflows: write permission and re-run this task.

Cannot self-resolve. No PR was opened.

[dobby-coder]

/dobby

[dobby-coder]

Dobby has seen the ping! This agent will retry the workflow bump and confirm whether the App permission has changed since the last attempt. Reporting back shortly!

[dobby-coder]

Re-attempted the push on retry — still blocked by the same GitHub-side restriction:

! [remote rejected] ci/bump-checkout-v4 -> ci/bump-checkout-v4
  (refusing to allow a GitHub App to create or update workflow
  `.github/workflows/build.yml` without `workflows` permission)

The agent's installation still does not hold workflows: write, so nothing has changed since the previous attempt. The diff is unchanged and trivially correct (bump actions/checkout from @v2/@v3 to @v4 in the three jobs in build.yml).

To unblock: either grant the bot installation workflows: write and ping again, or @rubenhensen lands the diff with a PAT that has the workflow scope. No PR opened.