chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0

[dependabot]

Bumps actions/setup-go from 6.0.0 to 7.0.0.

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-go#763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-go#771

New Contributors

• @​philip-gai made their first contribution in actions/setup-go#771

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

• Upgrade actions dependencies by @​priyagupta108 with @​Copilot in actions/setup-go#744
• Upgrade @​types/node and typescript-eslint dependencies to resolve npm audit findings by @​HarithaVattikuti in actions/setup-go#755
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-go#758
• Upgrade version to 6.5.0 in package.json and package-lock.json by @​HarithaVattikuti in actions/setup-go#762

New Contributors

• @​priyagupta108 with @​Copilot made their first contribution in actions/setup-go#744
• @​jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

• Add go-download-base-url input for custom Go distributions by @​gdams in actions/setup-go#721

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in actions/setup-go#727

Documentation update

• Rearrange README.md, add advanced-usage.md by @​priyagupta108 in actions/setup-go#724
• Fix Microsoft build of Go link by @​gdams in actions/setup-go#734

New Contributors

• @​gdams made their first contribution in actions/setup-go#721

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

• Update default Go module caching to use go.mod by @​priyagupta108 in actions/setup-go#705
• Fix golang download url to go.dev by @​178inaba in actions/setup-go#469

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

... (truncated)

Commits

• b7ad1da chore(deps): bump @​actions/cache to 6.2.0 (#771)
• 0778a10 Migrate to ESM and upgrade dependencies (#763)
• 924ae3a chore: bump version to 6.5.0 in package.json and package-lock.json (#762)
• e91cc3b Bump @​actions/cache to 5.1.0, log cache write denied (#758)
• 4a2405e chore: update @​types/node and @​typescript-eslint dependencies to latest versi...
• 78961f6 chore: update @​actions dependencies and refresh license cache (#744)
• 4a36011 docs: fix Microsoft build of Go link (#734)
• 8f19afc feat: add go-download-base-url input for custom Go distributions (#721)
• 27fdb26 Bump minimatch from 3.1.2 to 3.1.5 (#727)
• def8c39 Rearrange README.md, add advanced-usage.md (#724)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions match; normalized E2E selections match; severity counts match.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: cloud-onboard, security-posture, cloud-inference
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit efbccbb in the dependabot/github_ac... branch remains at 96%, unchanged from commit fed0c45 in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit efbccbb in the dependabot/github_ac... branch remains at 83%, unchanged from commit fed0c45 in the main branch.

Show a line coverage summary of the most impacted files.

File	main fed0c45	dependabot/github_ac... efbccbb	+/-
src/lib/onboard...uild-context.ts	86%	86%	0%
src/lib/cli/oclif-metadata.ts	95%	95%	0%
src/commands/sandbox/agent.ts	100%	100%	0%
src/lib/cli/argv-normalizer.ts	100%	100%	0%
src/lib/cli/public-dispatch.ts	87%	88%	+1%
src/lib/onboard...on-authority.ts	81%	82%	+1%
src/lib/securit...ate-endpoint.ts	95%	96%	+1%
src/lib/cli/com...and-registry.ts	93%	94%	+1%
src/commands/sandbox/mcp.ts	85%	86%	+1%
src/commands/uninstall.ts	90%	91%	+1%

---

_{Updated August 20, 2026 03:55 UTC}

[apurvvkumaria]

Dependency review complete, including the major-version migration.

• Release range: I reviewed every official adjacent release from setup-go v6.0.0 through v7.0.0. The v6 line adds the go.dev download fallback, .tool-versions support, go.mod as the default cache dependency, a custom download base URL, and dependency maintenance. v7 migrates the action bundle to ESM and Node 24 and updates @actions/cache to 6.2.0.
• Downstream contract: NemoClaw has one workflow consumer. It runs on hosted Ubuntu 24.04 AMD64 and ARM64 runners, requests Go 1.25.9, and disables setup-go caching. No token, cache, custom distribution, or new permission path is activated. The workflow-reference assertion now moves with the action reference.
• Release and artifact evidence: the official target release revision is Verified. Upstream release, distribution consistency, Windows installation, basic validation, Microsoft Go validation, recurring setup-go validation, and CodeQL workflows passed.
• Failure classification: the old workflow assertion failure was caused by this PR and is fixed. The old Station installer failure came from the earlier base; after incorporating current main, all 80 tests in that file pass. The old review-advisor failure was a transport/submission-service error and will rerun on the new revision.
• NemoClaw validation: six native-runtime workflow tests and 80 Station installer tests passed; 32 affected growth tests passed; repository checks, CLI build and type checking, hooks, and pre-push checks passed.
• Documentation: no public documentation change is needed because the user-facing Go version and native-runtime qualification contract are unchanged.
• Size: 2 additions and 2 deletions across the workflow and its assertion. This is not a large LOC increase.

Security review:

• Secrets and credentials: PASS — the consumer supplies no token and caching is disabled.
• Input validation: PASS — the existing fixed Go version and architecture matrix are unchanged.
• Authentication and authorization: PASS — no permissions or credential persistence changed.
• Dependencies: PASS — every adjacent release and the ESM/Node 24 migration were reviewed.
• Error handling and logging: PASS — no NemoClaw error or logging path changed.
• Cryptography: PASS — no cryptographic contract changed.
• Configuration and deployment: PASS — current hosted runners support the Node 24 action runtime; both runner architectures remain covered.
• Testing and coverage: PASS — upstream distribution/platform validation and NemoClaw workflow/installer tests passed.
• System-level safety: PASS — no service authority, sandbox policy, cleanup, or external-state mutation changed.

The remaining gates are the fresh required checks and any new actionable review feedback.

[apurvvkumaria]

Approved after the official adjacent-release, major-runtime, artifact, downstream-contract, security, documentation, and local validation review recorded above. Fresh CI and later actionable feedback remain merge gates.