Bump MetaMask/action-checkout-and-setup from 2 to 3

[dependabot]

Bumps MetaMask/action-checkout-and-setup from 2 to 3.

Release notes

Sourced from MetaMask/action-checkout-and-setup's releases.

3.0.0

Changed

• BREAKING: Security fix, removes the inputs yarn-custom-url, use-yarn-hydrate, and yarn-hydrate-command -- replaced with yarn-tarball (#57)
• BREAKING: Made things faster when there's a cache hit, but now requires either .nvmrc or inputs.node-version (#54)

2.0.1

Fixed

• Use environment variables for script inputs (#44)

Changelog

Sourced from MetaMask/action-checkout-and-setup's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[3.0.0]

Changed

• BREAKING: Security fix, removes the inputs yarn-custom-url, use-yarn-hydrate, and yarn-hydrate-command -- replaced with yarn-tarball (#57)
• BREAKING: Made things faster when there's a cache hit, but now requires either .nvmrc or inputs.node-version (#54)

[2.0.1]

Fixed

• Use environment variables for script inputs (#44)

[2.0.0]

Changed

• BREAKING: Bump GitHub/actions/* actions to latest versions (#41)
• BREAKING: Always include runner OS and arch in cache key (#40)
• BREAKING: Include full Node version in cache key (#38)

[1.4.0]

Added

• Add parameter for platform specific caching (#34)
  • By default the cache is not platform specific, meaning the same cache is used by different operating systems.
  • The new behaviour can be enabled by setting platform-specific-caching to true.

Changed

• Use more efficient cache key (#33)

[1.3.0]

Added

• Allow to use a local stored yarn binary (#28, #30)

[1.2.0]

... (truncated)

Commits

• bbc7d8e 3.0.0 (#58)
• c42e7d2 fix: more secure input to yarn hydrate (#57)
• 49bedd2 ci: make this action faster when there's a cache hit (#54)
• dbe7107 bump: updating to the newest versions of all actions packages (#55)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
CI-only change that bumps a shared checkout/setup action; main risk is unexpected workflow breakage if v3 behavior differs (e.g., caching or Node setup).

Overview
Upgrades the MetaMask/action-checkout-and-setup GitHub Action from @v2 to @v3 across all workflows (build/lint/test, workflow linting, release PR creation, docs publishing, and release publishing).

No workflow logic changes beyond the action version bump; jobs still pass node-version/ref/fetch-depth and the existing high-risk flags as before.

^{Written by Cursor Bugbot for commit d233541. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

[cursor]

Missing required node-version for v3 action upgrade

High Severity

MetaMask/action-checkout-and-setup@v3 now requires either a .nvmrc file or the node-version input. This repository has no .nvmrc file, and several workflows (main.yml, create-release-pr.yml, publish-docs.yml, and all three jobs in publish-release.yml) don't pass node-version. These workflows will fail at runtime after this bump. The build-lint-test.yml workflows are fine since they already pass node-version via the matrix.

Additional Locations (2)

• .github/workflows/create-release-pr.yml#L24-L27
• .github/workflows/publish-release.yml#L18-L21