[dependabot]

Bumps the github-actions group with 1 update: actions/setup-node.

Updates actions/setup-node from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 17, 2026, 3:35 AM ET / 07:35 UTC.

Summary
Updates the pinned actions/setup-node action from v6.4.0 to v7.0.0 across five GitHub Actions workflows.

Reproducibility: not applicable. this is a routine workflow dependency update rather than a reported product defect.

Review metrics: 3 noteworthy metrics.

• Workflow Pins: 5 changed, 0 added, 0 removed. The update consistently changes every existing setup-node v6.4.0 pin in the submitted scope.
• Direct Action Executions: 8 successful jobs. Benchmarks, coverage, and the six-job Node/OS matrix directly exercised setup-node v7 on the PR head.
• Indirect Workflow Paths: 2 of 5 workflows. Pages and Crabbox hydration were changed without their specialized trigger paths running directly.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🌊 off-meta tidepool
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

• [P1] The changed Pages and dispatch-only Crabbox hydration paths could expose a runner- or trigger-specific setup-node v7 incompatibility that the successful hosted CI matrix does not directly settle.

Maintainer options:

1. Merge With Existing Matrix Proof (recommended)
   Accept the successful cross-platform setup-node executions as sufficient coverage for the narrowly pinned official action update.
2. Validate Specialized Workflows First
   Run the Pages and Crabbox hydration trigger paths on the exact head to remove the remaining automation uncertainty.

Next step before merge

• No automated repair is needed; the workflow owner should decide whether the existing cross-platform checks sufficiently cover the two specialized trigger paths.

Maintainer decision needed

• Question: Is the successful eight-job hosted-runner coverage sufficient for this setup-node major update, or should the Pages and Crabbox hydration paths be run directly before merge?
• Rationale: The common setup-node configurations are well exercised, but two changed workflows use specialized triggers whose end-to-end paths are not represented in the listed checks.
• Likely owner: steipete — Their related toolchain-refresh history makes them the best available owner for deciding whether specialized workflow coverage is required.
• Options:
  • Accept Current Coverage (recommended): Merge based on the clean cross-platform Node 22/24 matrix, workflow lint, benchmarks, and coverage results.
  • Run Specialized Paths: Manually validate the Pages and Crabbox hydration workflows on this exact head before merging.

Security
Cleared: The diff introduces no concrete security or supply-chain defect: it uses the official action, remains pinned to a full immutable commit, and does not broaden workflow permissions or secret access.

Review details

Best possible solution:

Land the immutable v7 pin once the workflow owner accepts the existing cross-platform coverage, optionally running the Pages and Crabbox hydration paths first if those specialized environments require direct confirmation.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a routine workflow dependency update rather than a reported product defect.

Is this the best way to solve the issue?

Yes; consistently replacing the official action with a full immutable v7 release SHA is the narrowest maintainable update, with only specialized workflow validation left to maintainer preference.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 74cbdc7b8090.

Label changes

Label justifications:

• P3: This is low-risk dependency maintenance with green checks and no current user-facing regression.
• merge-risk: 🚨 automation: The PR changes a major-version action pin in five workflows, including deployment and dispatch-only automation not directly exercised by the listed checks.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot-authored dependency PR, so the external-contributor real-setup proof gate does not apply; successful workflow executions provide supplemental validation.

Evidence reviewed

What I checked:

• Current main still uses the old action: At base SHA 74cbdc7, the affected workflows still pin actions/setup-node commit 48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e for v6.4.0, so the PR remains necessary. (.github/workflows/ci.yml:50, 74cbdc7b8090)
• Narrow consistent diff: The single PR commit replaces only the immutable setup-node SHA and version comment in five workflows, with five additions and five deletions and no permission, secret, trigger, or script changes. (.github/workflows/benchmarks.yml:28, f46416df2ce4)
• Strong hosted-runner validation: The exact head passed workflow lint, benchmarks, coverage, and the Node 22/24 matrix on Linux, macOS, and Windows; eight successful jobs directly executed setup-node v7. (.github/workflows/ci.yml:50, f46416df2ce4)
• Specialized paths remain indirect: The Pages and Crabbox hydration configurations were changed, but their deployment/manual-dispatch behavior was not directly demonstrated by the listed PR checks. (.github/workflows/crabbox-hydrate.yml:50, f46416df2ce4)
• Official pinned upstream release: The replacement is the official actions/setup-node v7.0.0 release commit 820762786026740c76f36085b0efc47a31fe5020, pinned by full SHA rather than a mutable tag. (.github/workflows/pages.yml:36, f46416df2ce4)
• Re-review continuity: Both earlier ClawSweeper cycles reviewed the same head SHA and reported no line-level findings; no new commits introduced a new correctness concern. (f46416df2ce4)

Likely related people:

• steipete: The provided repository history identifies steipete as the author of the related toolchain-refresh work in chore(deps): refresh toolchain #37, making them the clearest routing candidate for workflow dependency acceptance. (role: adjacent toolchain owner; confidence: medium; files: .github/workflows/benchmarks.yml, .github/workflows/ci.yml, .github/workflows/coverage.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (2 earlier review cycles)

• reviewed 2026-07-16T06:39:54.390Z sha f46416d :: needs maintainer review before merge. :: none
• reviewed 2026-07-16T20:03:00.160Z sha f46416d :: needs maintainer review before merge. :: none

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-actions group This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.