[pig-tongzhi]

What

Bump actions/checkout to v4 in three workflows (3 lines changed):

Workflow	Before
.github/workflows/integration-test.yml	actions/checkout@v2
.github/workflows/coverage.yml	actions/checkout@master
.github/workflows/codeql_analysis.yml	actions/checkout@v3

Why

• v4 is the current major version, and the other workflows in this repository (e.g. bazel.yml) already use it.
• @master in coverage.yml is an unpinned ref: the action can change without any change in this repository. @v4 pins the major version like the rest of the workflows.
• No functional change in this PR: only the action version is modified, the steps and their inputs are untouched.

Scope

This PR intentionally keeps the diff to three files so it is quick to review. I left the remaining workflows (maven.yaml, license-checker.yaml, misspell_check.yml, snapshot-automation.yml) alone for now; happy to update them in a follow-up PR if you would like that.

Thanks for maintaining RocketMQ!

[RockteMQ-AI]

LGTM. Trivial change — bumping actions/checkout to v4 across three workflows. Good housekeeping to keep CI actions on current major versions and pin refs instead of @master.

---

Automated review by github-manager-bot

[RockteMQ-AI]

Issue Evaluation

Category: type/ci-maintenance | Status: Evaluated

Thank you for identifying the version inconsistency across workflows. Bumping actions/checkout to v4 is a reasonable maintenance improvement:

• Consistency: Aligns all workflows on the current major version (v4), reducing cognitive overhead.
• Security: actions/checkout@v4 uses Node.js 20 runtime, whereas v2/v3 use deprecated Node.js 12/16.
• Pinning: Replacing @master in coverage.yml with @v4 eliminates the unpinned ref risk.

Assessment: Low-risk, well-scoped change. The 3-file diff is easy to review. The decision to defer the remaining workflows (maven.yaml, license-checker.yaml, etc.) to a follow-up is pragmatic.

Note: This issue requires maintainer action — it involves modifying .github/workflows/ which typically needs committer-level merge.

---

Automated evaluation by RockteMQ-AI