fix: update checkout version to dodge deprecation

.github/workflows/deploy-on-merge.yml

@@ -5,7 +5,7 @@ on:
     branches:
       - main
     paths-ignore:
-      - 'terraform/**'
+      - "terraform/**"
 
 # Requires these repository secrets:
 #   TAILSCALE_CLIENT_ID  — Tailscale OAuth client ID (federated identity)
@@ -40,7 +40,7 @@ jobs:
         host: ${{ fromJson(needs.discover.outputs.hosts) }}
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Tailscale
         uses: tailscale/github-action@v4

.github/workflows/deploy.yml

@@ -4,15 +4,15 @@ on:
   workflow_dispatch:
     inputs:
       target:
-        description: 'Target host (e.g. helsinki-a, london-b, all)'
+        description: "Target host (e.g. helsinki-a, london-b, all)"
         required: true
         type: string
       playbook:
-        description: 'Ansible playbook to run (e.g. site.yml, update.yml)'
+        description: "Ansible playbook to run (e.g. site.yml, update.yml)"
         required: true
         type: string
       dry_run:
-        description: 'Dry run (--check mode)'
+        description: "Dry run (--check mode)"
         required: false
         type: boolean
         default: true
@@ -30,7 +30,7 @@ jobs:
     outputs:
       hosts: ${{ steps.prepare.outputs.hosts }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Build host matrix
         id: prepare

.github/workflows/lint-ansible.yml

@@ -8,7 +8,7 @@ jobs:
     name: ansible-lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Check for Ansible files
         id: check

.github/workflows/lint-docker-compose.yml

@@ -8,7 +8,7 @@ jobs:
     name: docker compose config
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Stub missing env files referenced by Compose
         run: |

.github/workflows/terraform.yml

@@ -4,8 +4,8 @@ on:
   push:
     branches: [main]
     paths:
-      - 'terraform/**'
+      - "terraform/**"
-      - '.github/workflows/terraform.yml'
+      - ".github/workflows/terraform.yml"
 
 # Requires these repository secrets:
 #   AGE_SECRET_KEY     — age private key for SOPS decryption
@@ -15,7 +15,7 @@ jobs:
     name: Plan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install OpenTofu
         uses: opentofu/setup-opentofu@v1

.github/workflows/validate-caddyfile.yml

@@ -8,7 +8,7 @@ jobs:
     name: caddy validate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Check for Caddyfile
         id: check

.github/workflows/validate-terraform.yml

@@ -8,7 +8,7 @@ jobs:
     name: tofu validate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install OpenTofu
         uses: opentofu/setup-opentofu@v1