chore(ci): bump checkout v7, setup-node v7, setup-python v7; normalize maturin-action pin (PF-040)

[dean0x]

Summary

One hand-authored branch instead of four Dependabot PRs. Dependabot's diffs were cut against older bases and would leave call sites behind: #111 (checkout) touches 13 of the 16 current actions/checkout@v6 sites, #189 (setup-node) 5 of 6. All 27 first-party action sites are bumped here, plus the maturin-action pin normalization from #356. Tag pins (@v7) are kept for first-party actions/* per repo convention; resolved SHAs are recorded below.

Bumps

action	from → to	released	soak	action runtime	breaking item → applies here?
actions/checkout	v6 → v7 (3d3c42e5aac5ba805825da76410c181273ba90b1, v7.0.1)	v7.0.0 2026-06-18 / v7.0.1 2026-07-20	80 / 48 d	node24 → node24	v7.0.0 blocks fork-PR refs under pull_request_target / workflow_run (v7.0.1 relaxes it for the default input) → no such trigger in .github/ — the only hit, release.yml:132, is a --jq '.workflow_runs' API filter. CI is pull_request; release is push: tags + workflow_dispatch.
actions/setup-node	v6 → v7 (820762786026740c76f36085b0efc47a31fe5020, v7.0.0)	2026-07-14	54 d	node24 → node24	dummy NODE_AUTH_TOKEN export removed → both registry-url sites already bind the token explicitly (see below).
actions/setup-python	v5 → v7 (5fda3b95a4ea91299a34e894583c3862153e4b97, v7.0.0)	2026-07-20	48 d	node20 → node24	pip-install input removed → the repo passes only python-version. Removes setup-python from the per-run "Node.js 20 is deprecated" annotation.
PyO3/maturin-action	3e2bdf6ba6453a61e649744019b8a2d906c7eb38 → e83996d129638aa358a18fbd1dfb82f0b0fb5d3b	tag v1.51.0 (2026-04-09)	150 d	node24 (JS action)	none — same version; annotated-tag object → the commit it points to (PF-040).

Call sites: checkout 16 (ci.yml 9, release.yml 7); setup-node 6 (ci.yml 2, release.yml 4); setup-python 5 (ci.yml only); maturin-action 2 (release.yml wheel + sdist legs). No job is renamed, so the 15 required branch-protection contexts are unchanged.

setup-node v7 — NODE_AUTH_TOKEN

setup-node v7 no longer exports a dummy NODE_AUTH_TOKEN when registry-url is set. The two registry-url sites in release.yml:

• release.yml:43 (version-gate) — the npm whoami credential probe binds NODE_AUTH_TOKEN at step level (:46) and guards it non-empty (:52).
• release.yml:765 (publish-npm) — NODE_AUTH_TOKEN is job-level env (:756), covering every npm command in the job.

The one npm invocation after a registry-url setup-node without the token in scope is npm run test:gates in version-gate. npm's .npmrc env-replacement leaves an undefined ${NODE_AUTH_TOKEN} as a literal rather than throwing, and the command never contacts the registry, so it is inert. The branch dry-run exercises version-gate end to end; publish-npm is tag-guarded and not rehearsable, so its job-level env is the static proof.

maturin-action — PF-040

3e2bdf6… was the annotated tag object for v1.51.0, not a commit. It worked because maturin-action is a JS action (runs.using: node24), but the commit SHA is the canonical pin form. Live dereference:

gh api repos/PyO3/maturin-action/git/tags/3e2bdf6ba6453a61e649744019b8a2d906c7eb38
tag=v1.51.0 type=commit commit=e83996d129638aa358a18fbd1dfb82f0b0fb5d3b

The # v1.51.0 trailing comments are kept. RELEASING.md cites PyO3/maturin-action@v1.51.0 in version form and stays accurate.

TypeScript 7 disposition

Dependabot #169 (typescript 6.0.3 → 7.0.2) fails structurally: the three CJS tsconfigs (packages/{bundler-utils,webpack-loader,rspack-loader}/tsconfig.cjs.json) use moduleResolution=node10, which TS 7 removed (TS5108). A rebase cannot fix it. #169 is closed; the migration is tracked in #364 (milestone v0.5.0). .github/dependabot.yml now ignores typescript version-update:semver-major — this filters version updates only; security updates still arrive. The entry is removed when #364 lands.

Verification

• Local: both workflows + dependabot.yml parse (js-yaml); node scripts/verify-no-control-bytes.mjs clean (552 files scanned); npm run test:gates 155/155 pass, 0 fail (42 suites).
• CI run on the branch head a0f7707: 34047423520 — success. All 22 checks completed+success: the 15 required contexts, the CodeQL umbrella (success, not neutral this time), four Analyze (…), Watch startup race (probe), security/snyk. No cancelled runs (PF-017).
• Branch dry-run of release.yml (workflow_dispatch, publishes nothing): 34047806587 — success, dispatched only after CI had completed (PF-039).
  • version-gate under actions/checkout@v7 + actions/setup-node@v7 with registry-url: "Verify publish credentials" → npm credentials verified: token resolves to npm user 'dean0x'; PyPI OIDC probe → PyPI trusted publisher OK; test:gates 155/155; CI-history gate → 16 job(s), all completed+success (floor: 15).
  • build-napi 7/7 success. stage-and-verify-napi: Stage per-platform packages success, A3 — name <-> loader verification gate success.
  • build-python 8/8 success on PyO3/maturin-action@e83996d1; the readelf gate on the x86_64 musl leg shows NEEDED libc.so (musl) and no libc.so.6.
  • publish-crates, publish-npm, publish-python, github-release: skipped (tag-guarded).
• "Node.js 20 is deprecated" annotation on a0f7707 (CI + dry-run check-runs, read via the check-runs annotations API): actions/setup-python no longer appears. Remaining: jetli/wasm-pack-action@0d096b0… (4 check-runs; .github/actions/setup-wasm/action.yml:9, using: node16) and — newly surfaced, release.yml-only — mlugg/setup-zig@v2 (2 check-runs, the two musl build-napi legs). Both pre-existing; B-phase follow-up, not this PR.
• security/snyk (dean0x): success — "No manifest changes detected in 5 projects" (advisory; no first-party code or dependency changes here; the Snyk MCP is still ENOENT locally — reinstall before C1).

Supersedes

Supersedes Dependabot #111, #189, #241, #356. Replaces #169 (→ #364). Tracking: #69 (v0.4.3 action plan, step A3).