build(deps): bump actions/setup-node from 6.4.0 to 7.0.0

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps actions/setup-node from 6.4.0 to 7.0.0.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: found issues before merge. Reviewed July 18, 2026, 8:55 AM ET / 12:55 UTC.

Summary
The PR updates .github/workflows/pages.yml to pin actions/setup-node from the v6.4.0 revision to the v7.0.0 revision.

Reproducibility: not applicable. This PR is a GitHub Actions dependency update rather than a report of broken user-facing behavior. The relevant validation is completion of the Pages workflow on the proposed revision.

Review metrics: 2 noteworthy metrics.

• Workflow surface: 1 workflow file; 1 line replaced. The change is isolated to the Pages deployment workflow, making post-merge workflow validation more useful than broad application testing.
• Action upgrade: v6.4.0 → v7.0.0. This is a semver-major GitHub Action update, so completed CI and one publishing run are the relevant compatibility evidence.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Update the inline annotation from # v6 to # v7.
• [P2] Wait for the pending required checks and confirm a Pages workflow run completes successfully.

Risk before merge

• [P1] actions/setup-node v7 is a major action release used by the Pages publishing workflow; complete the pending checks and verify the next Pages run before relying on the upgrade.

Maintainer options:

1. Correct annotation and validate publishing (recommended)
   Update the stale # v6 annotation, then merge after the required checks and a Pages workflow execution confirm the v7 action behaves normally.
2. Accept the documentation-only mismatch
   Maintainers may merge after checks if they explicitly accept the stale inline annotation, though it leaves future workflow audits with incorrect version metadata.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Update the setup-node version annotation to `# v7`, then merge only after required checks succeed and the Pages workflow is validated.

Next step before merge

• A maintainer should request the one-line annotation correction and confirm the pending workflow checks and Pages execution before merging this major action update.

Security
Cleared: The diff retains immutable SHA pinning for the official actions/setup-node action and does not change workflow permissions, token handling, or dependency sources.

Review findings

• [P3] Correct the action-version annotation — .github/workflows/pages.yml:36

Review details

Best possible solution:

Correct the inline annotation to # v7, then merge after the required checks and a Pages workflow run confirm the pinned v7 action works with Node 24.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is a GitHub Actions dependency update rather than a report of broken user-facing behavior. The relevant validation is completion of the Pages workflow on the proposed revision.

Is this the best way to solve the issue?

Yes, with the annotation correction: preserving SHA pinning while updating the referenced action is the narrowest maintainable approach, provided the deployment workflow succeeds on v7.

Full review comments:

• [P3] Correct the action-version annotation — .github/workflows/pages.yml:36
  The replacement SHA is the v7.0.0 revision named in this PR, but the inline comment still says # v6. Update it to avoid misleading future workflow and supply-chain audits.
  Confidence: 0.99

Overall correctness: patch is correct
Overall confidence: 0.87

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model internal, reasoning high; reviewed against 15af97146636.

Label changes

Label changes:

• add P3: This is low-risk dependency maintenance with a small workflow-only correction needed before merge.
• add merge-risk: 🚨 automation: The changed dependency executes inside the Pages GitHub Actions workflow, and its major-version behavior is not fully settled until the workflow completes successfully.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot workflow-only PR is exempt from contributor real-behavior proof; completed CI and a successful Pages workflow run provide the relevant validation.

Label justifications:

• P3: This is low-risk dependency maintenance with a small workflow-only correction needed before merge.
• merge-risk: 🚨 automation: The changed dependency executes inside the Pages GitHub Actions workflow, and its major-version behavior is not fully settled until the workflow completes successfully.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot workflow-only PR is exempt from contributor real-behavior proof; completed CI and a successful Pages workflow run provide the relevant validation.

Evidence reviewed

What I checked:

• Narrow workflow diff: The branch changes one line in the Pages workflow, replacing the pinned actions/setup-node v6.4.0 commit with the v7.0.0 commit. (.github/workflows/pages.yml:36, 0d4471c36c17)
• Version annotation mismatch: The new SHA is identified in the PR as v7.0.0, but its inline workflow annotation remains # v6, which would misstate the pinned major version for future audits. (.github/workflows/pages.yml:36, 0d4471c36c17)
• Current CI state: Security-oriented checks and CodeQL have succeeded; lint, release-check, and test were still in progress in the supplied PR state, so merge validation is not yet complete. (0d4471c36c17)

Likely related people:

• unresolved: The supplied context identifies the changed workflow but does not provide current-main blame or log metadata sufficient to attribute its ownership without guessing. (role: workflow-history owner; confidence: low; files: .github/workflows/pages.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Superseded by #144, now merged as 530fae9620fcffb447d0a7ed6d4671e318b61be7. The maintainer replacement carries the corrected v7.0.0 annotation and focused Pages proof, including a successful landed-SHA Pages run.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.