chore(deps): bump the actions group with 2 updates

[dependabot]

Bumps the actions group with 2 updates: actions/checkout and actions/setup-node.

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Commits

• See full diff in compare view

Updates actions/setup-node from 6 to 7

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in actions/setup-node#1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in actions/setup-node#1533

New Contributors

• @​Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in actions/setup-node#1283

... (truncated)

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: found issues before merge. Reviewed July 22, 2026, 11:55 PM ET / July 23, 2026, 03:55 UTC.

Summary
The PR updates actions/checkout to v7.0.1 and actions/setup-node to v7 across four GitHub Actions workflow files.

Reproducibility: not applicable. this is a dependency-maintenance PR, not a reported product defect. The relevant validation is an observed successful run of the changed workflows after the waiting period.

Review metrics: 2 noteworthy metrics.

• Workflow scope: 4 files affected; 17 additions and 17 deletions. The update changes shared CI, media, Pages, and release automation rather than one isolated test job.
• Dependency change mix: 1 patch update and 1 major update. The setup-node v6-to-v7 transition is the compatibility-sensitive portion of the grouped update.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🦐 gold shrimp
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Wait until the seven-day stabilization period for actions/setup-node v7.0.0 has elapsed.
• [P1] Add redacted successful CI or release-path output after the waiting period; updating the PR body should trigger re-review, or a repository maintainer can comment @clawsweeper re-review.

Proof guidance:

• [P1] Needs real behavior proof before merge: Successful automated checks are supplemental only; add redacted after-fix workflow or release-path output once the waiting period has passed, removing tokens, private endpoints, and other sensitive values before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

• [P1] Merging before the required stabilization window would run a newly released major actions/setup-node runtime in CI and release automation.
• [P1] Automated checks do not show a real post-update release or workflow run, so compatibility of the changed Actions runtime remains unproven.

Maintainer options:

1. Wait, then prove the workflow update (recommended)
   Retain the Dependabot branch until the seven-day stabilization window expires and attach redacted successful live workflow or release-path evidence before merging.
2. Decline this major action upgrade
   Close the Dependabot update if maintainers do not intend to adopt actions/setup-node v7 after the stabilization period.

Next step before merge

• [P2] A repository owner should revisit this after the mandatory waiting period and evaluate real workflow evidence; no mechanical branch repair can make the new action version eligible early.

Security
Needs attention: The PR introduces newly released third-party Action code into privileged release automation before the repository’s mandatory stabilization period.

Review findings

• [P1] Defer setup-node v7 until stabilization completes — .github/workflows/release.yml:98

Review details

Best possible solution:

Keep the existing action versions until the stabilization window expires, then merge only after a redacted successful run demonstrates the affected CI and release workflow paths with the updated pins.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-maintenance PR, not a reported product defect. The relevant validation is an observed successful run of the changed workflows after the waiting period.

Is this the best way to solve the issue?

No: the version-only diff is mechanically narrow, but it conflicts with the repository’s required seven-day stabilization delay and has not supplied real workflow evidence after adoption.

Full review comments:

• [P1] Defer setup-node v7 until stabilization completes — .github/workflows/release.yml:98
  The repository requires stable dependency releases to age seven days before adoption. This line pins newly released actions/setup-node v7.0.0 into the release workflow before that window has elapsed; retain the existing v6 pin until eligible. This is the still-unfixed finding from the prior review cycle on unchanged code.
  Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 67b6c475ba27.

Label changes

Label justifications:

• P1: A major runtime upgrade affects active CI and release workflows, but the evidence does not indicate a current user-facing outage.
• merge-risk: 🚨 security-boundary: The diff updates third-party Action code that executes with repository workflow permissions, including release automation.
• merge-risk: 🚨 automation: The changed references execute in CI, media, Pages, and release workflows, so a runtime incompatibility could disrupt automation.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Successful automated checks are supplemental only; add redacted after-fix workflow or release-path output once the waiting period has passed, removing tokens, private endpoints, and other sensitive values before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

Security concerns:

• [medium] Delay new action code in release automation — .github/workflows/release.yml:98
  The release workflow would execute actions/setup-node v7.0.0 before the required seven-day stabilization delay, so its supply-chain and runtime behavior should not be accepted yet.
  Confidence: 0.97

What I checked:

• Repository dependency policy: The repository’s fully supplied AGENTS.md requires a seven-day stabilization delay before stable dependency adoption; the proposed actions/setup-node v7.0.0 release had not reached that window in the prior review context. (AGENTS.md, 67b6c475ba27)
• Workflow surface: The PR updates checkout and Node setup references in CI, media, Pages, and release automation; the release workflow uses pinned action SHAs for the affected third-party code. (.github/workflows/release.yml:98, f26f869ba8df)
• Review continuity: The unchanged PR head was previously blocked for the same unmet stabilization requirement; no new commit addresses that finding. (.github/workflows/release.yml:98, f26f869ba8df)
• Automated validation: The supplied check set reports successful CI, extension E2E, Firefox smoke, and GitGuardian runs, but those are supplemental rather than a real after-fix workflow or release-path proof. (.github/workflows/ci.yml:20, f26f869ba8df)

Likely related people:

• steipete: The repository owner is the best available routing candidate for an intentional exception to the project-wide dependency-adoption policy; local git-history inspection was unavailable in the read-only sandbox. (role: likely workflow-area decision owner; confidence: low; commits: 67b6c475ba27; files: .github/workflows/ci.yml, .github/workflows/media-live.yml, .github/workflows/pages.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (6 earlier review cycles)

• reviewed 2026-07-22T09:38:21.371Z sha f26f869 :: found issues before merge. :: [P1] Defer the action upgrades until the stabilization window passes
• reviewed 2026-07-22T11:28:22.961Z sha f26f869 :: found issues before merge. :: [P1] Defer the action upgrade until stabilization passes
• reviewed 2026-07-22T17:12:10.464Z sha f26f869 :: found issues before merge. :: [P1] Defer setup-node v7 until stabilization completes
• reviewed 2026-07-22T21:08:56.027Z sha f26f869 :: found issues before merge. :: [P1] Defer action upgrades until stabilization completes
• reviewed 2026-07-22T23:09:39.866Z sha f26f869 :: found issues before merge. :: [P1] Defer setup-node v7 until stabilization completes
• reviewed 2026-07-23T01:18:48.593Z sha f26f869 :: found issues before merge. :: [P1] Defer setup-node v7 until stabilization completes

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(deps): bump the actions group with 2 updates This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.