chore: bump actions/setup-node from 6.2.0 to 7.0.0

[dependabot]

Bumps actions/setup-node from 6.2.0 to 7.0.0.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in actions/setup-node#1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in actions/setup-node#1533

New Contributors

• @​Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in actions/setup-node#1283

... (truncated)

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

[kriscendobot]

Botanist verdict: MERGE-NOW (blocked only at the maintainer-approval gate)

Upgrade: actions/setup-node v6.x → v7.0.0 (github-actions ecosystem), bumping all 24 uses: pins across 10 workflow files to 820762786026740c76f36085b0efc47a31fe5020.

Base-ref census (the github-actions analogue of the lockfile diff)

On base llm, actions/setup-node is pinned at a mix of v6.2.0 (6044e13b…) and v6.5.0 (249970729c…), max v6.5.0 — uniformly behind the v7.0.0 target. This is a genuine forward major bump, not superseded by the base or by any sibling Dependabot PR. The PR moves every site cleanly to v7.0.0.

Pin provenance (tag→commit, the one check with no npm analogue)

Resolved actions/setup-node@refs/tags/v7.0.0 (lightweight tag) → commit 820762786026740c76f36085b0efc47a31fe5020, which equals the hash the diff pins, on the incoming side. Owner actions/setup-node confirmed. Resolved 2026-08-05. The zizmor and check-action-pins CI checks are green, corroborating that every trailing # v7.0.0 comment agrees with its hash.

Advisory check

No open GitHub Security Advisory affects actions/setup-node in the actions ecosystem (/advisories?ecosystem=actions&affects=actions/setup-node → empty). No CVE is closed by this bump and none is introduced.

Source read (v6 → v7.0.0)

Both v6.5.0 and v7.0.0 declare runs.using: 'node24' — the runner runtime is unchanged. Every input this repo consumes (node-version, node-version-file, cache) is still present in v7.0.0's action.yml; no consumed input was removed. The major reflects an internal ESM migration (#1574), new cache-primary-key/cache-matched-key outputs, removal of the dummy NODE_AUTH_TOKEN export (#1558), and using mirrorToken only when provided (#1548) — no new network surface, no new filesystem writes, no telemetry. Publisher of v7.0.0 is gowridurgad, a long-standing recurring setup-node releaser (v5.0.0, v6.1/6.3/6.4) — no new-releaser signal.

Maturity

v7.0.0 published 2026-07-14T02:46:05Z; maturity floor (publish + 7 days) = 2026-07-21T02:46:05Z, passed. As a github-actions bump there is no transitive lockfile set, so the floor is the tag's own publish instant. Well past floor as of 2026-08-05.

CI

All 26 check-runs on head 2dbc601e1c88aa716988f26026e61dac209025cb are green (incl. test/cover on 22.x & 24.x, test-xs, test262, browser-tests, zizmor, check-action-pins). Inputs are stable, so no consuming-code migration was needed and none was pushed.

Disposition

All MERGE-NOW gate legs are satisfied: CI green ∧ maturity floor passed ∧ source read benign ∧ no advisory on the moved version ∧ pin provenance verified. Conducting through the deterministic spine, the merge is blocked only at the maintainer-approval gate — this repo's branch protection reports the PR MERGEABLE/BLOCKED with an empty reviewDecision (no current APPROVED review). A single maintainer approval is the only remaining blocker; on approval the next conductor pass merges it cleanly.

Verdict rendered by the garden botanist. This is not a finding against the upgrade — it is merge-ready.

_{model claude-opus-4-8 · harness claude · garden c7d730c3}