[codex] chore(ci): update setup-python for Node 24

[iktakahiro]

Summary

• bump actions/setup-python from v5 to v6 in the test workflow
• add explicit read-only contents permissions for least-privilege workflow execution
• remove the redundant ref: ${{ github.ref }} override from actions/checkout

Root cause

GitHub Actions is warning because actions/setup-python@v5 still runs on the deprecated Node.js 20 runtime. The v6 release updates the action for Node.js 24 compatibility, which aligns the workflow with the upcoming GitHub-hosted runner runtime change.

Impact

This removes the Node.js 20 deprecation warning from the Python test workflow without changing the project test matrix or validation steps.

Validation

• make format
• make test

Summary by CodeRabbit

• Chores
  • Enhanced CI/CD pipeline security by implementing stricter permission configurations, reducing potential security risks.
  • Upgraded testing infrastructure components to latest stable versions for improved reliability and performance.
  • Streamlined workflow configuration for better maintainability.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 1dff7480-eb58-46ad-a328-71903bea50fa

📥 Commits

Reviewing files that changed from the base of the PR and between a6ffbd4 and 2ab0221.

📒 Files selected for processing (1)

• .github/workflows/test.yaml

---

Walkthrough

The GitHub Actions test workflow was updated with tightened permissions by adding explicit permissions: { contents: read } configuration. The actions/setup-python action was upgraded from version 5 to version 6, and the explicit ref parameter was removed from the checkout step.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow .github/workflows/test.yaml	Added top-level permissions: { contents: read }, upgraded actions/setup-python from @v5 to @v6, and removed explicit ref parameter from checkout step to rely on default behavior.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

🐰 With paws, I hop through workflows bright,
Permissions tightened, security tight!
Python upgraded, checkout made clean,
The finest CI I've ever seen! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: upgrading setup-python from v5 to v6 for Node 24 compatibility, which is the primary objective of the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-actions-setup-python-v6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}