chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0

[dependabot]

Bumps actions/setup-node from 6.4.0 to 7.0.0.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 16, 2026, 4:38 AM ET / 08:38 UTC.

Summary
Updates three SHA-pinned actions/setup-node invocations from v6.4.0 to v7.0.0 across the CI and release workflows.

Reproducibility: not applicable. This PR performs routine workflow dependency maintenance rather than fixing a reported runtime defect.

Review metrics: 2 noteworthy metrics.

• Pinned action references: 3 changed across 2 workflows. The patch has a tightly bounded automation surface and preserves full-SHA dependency pinning.
• Reported checks: 12 successful, 4 intentionally skipped. The update passed workflow linting, security analysis, browser smoke, and the full Node/platform matrix.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🌊 off-meta tidepool
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

• [P1] The tag-only publishing job is not directly executed by pull-request checks, although its setup-node inputs match the configurations exercised successfully by CI.

Maintainer options:

1. Decide the mitigation before merge
   Merge the immutable-SHA update after normal branch protections pass, retaining the existing workflow inputs and tag-driven release design.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P2] No repair is needed; the clean PR should proceed through normal maintainer merge and branch-protection handling.

Security
Cleared: The PR retains immutable SHA pinning to the official verified setup-node v7.0.0 commit and introduces no broader permissions, secrets, or third-party execution surface.

Review details

Best possible solution:

Merge the immutable-SHA update after normal branch protections pass, retaining the existing workflow inputs and tag-driven release design.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this PR performs routine workflow dependency maintenance rather than fixing a reported runtime defect.

Is this the best way to solve the issue?

Yes; updating the three existing immutable pins in place is the narrowest maintainable way to adopt the official setup-node v7 release without changing workflow behavior or structure.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4141f0fffb93.

Label changes

Label changes:

• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦞 diamond lobster, so this older rating label is no longer current.

Label justifications:

• P3: This is a low-risk, narrowly scoped GitHub Actions dependency update with no reported user-facing regression.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This bot-authored dependency PR is exempt from contributor real-setup proof; the successful workflow matrix and security checks provide appropriate validation for the changed automation.

Evidence reviewed

What I checked:

• Current main still needs the update: Current main pins actions/setup-node v6.4.0 in both CI jobs and the tag-driven release workflow, so the PR is not obsolete or implemented on main. (.github/workflows/ci.yml:56, 4141f0fffb93)
• Focused immutable-pin diff: The PR changes only three setup-node references in two workflow files, replacing the v6.4.0 commit with the v7.0.0 commit while retaining full-SHA pinning and existing inputs. (.github/workflows/release.yml:38, 0ff2d12a6ddd)
• Upstream action provenance: The target SHA 820762786026740c76f36085b0efc47a31fe5020 is the verified, immutable official actions/setup-node v7.0.0 release commit; the release includes the ESM migration and dependency updates described in the PR. (.github/workflows/ci.yml:56, 820762786026)
• Validation status: The supplied PR checks report successful workflow linting, CodeQL and action analysis, browser smoke coverage, and Node 22/24 checks on Ubuntu, macOS, and Windows; four dispatch jobs were intentionally skipped. (.github/workflows/ci.yml:1, 0ff2d12a6ddd)
• Workflow ownership history: Repository history connects vincentkoc to the initial repository setup, CI registry hardening, and release-validation hardening, making them the strongest routing candidate for this workflow-only update. (.github/workflows/release.yml:1, c1ca6f199108)
• Repository policy applied: The full AGENTS.md treats release automation as tag-driven and requires focused workflow changes and repository checks; this two-file dependency update is consistent with that guidance. (AGENTS.md:278, 4141f0fffb93)

Likely related people:

• vincentkoc: Introduced the repository baseline and authored recent CI registry and release-validation hardening in the affected automation area. (role: workflow and release-area contributor; confidence: high; commits: 1c239f1b6870, 8ffb44049333, c1ca6f199108; files: .github/workflows/ci.yml, .github/workflows/release.yml, .github/dependabot.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

• reviewed 2026-07-16T03:49:09.581Z sha 0ff2d12 :: needs maintainer review before merge. :: none

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.