chore(deps): bump actions/setup-node from 6 to 7

[dependabot]

Bumps actions/setup-node from 6 to 7.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in actions/setup-node#1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in actions/setup-node#1533

New Contributors

• @​Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in actions/setup-node#1283

... (truncated)

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ca7c549b7e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Add the gate-change override for workflow bumps

With this workflow edit in a pull request, the gate-integrity job in ci.yml runs scripts/check-gate-integrity.mjs; isMachineryPath() treats every .github/workflows/ change as gate-machinery-modified and the script exits 1 unless GATE_HAS_OVERRIDE is true. Running the gate against 9e40a0c^...9e40a0c reports both changed workflow files, so this Dependabot bump will leave CI red unless the PR gets the gate-change override or the automation is adjusted to add it.

Useful? React with 👍 / 👎.

[helebest]

Automated Dependabot review — ⛔ blocked (fail-fast)

Step 1 — Code review
Bumps actions/setup-node v6 → v7 across .github/workflows/ci.yml (3 uses) and .github/workflows/live-integration.yml (1 use). The diff matches the PR description. v7 is a valid major release (migration to ESM, @actions/cache → 5.1.0, security overrides for undici/fast-xml-parser, new cache-primary-key/cache-matched-key outputs, removal of the dummy NODE_AUTH_TOKEN export). All four call sites pin node-version: "24" and cache: npm, which remain valid in v7 — no input/behavior break for how this repo uses the action.

Step 2 — Regression verification: FAILED (by design)
The required Gate integrity (no reward-hacking) check fails:

✖ Gate integrity FAILED — the verification itself was weakened:
  ✖ [gate-machinery-modified] .github/workflows/ci.yml — gate/CI machinery changed
  ✖ [gate-machinery-modified] .github/workflows/live-integration.yml — gate/CI machinery changed

This is not a defect in the bump. The repo's check:gate guard (scripts/check-gate-integrity.mjs) intentionally fails any PR that touches .github/workflows/**, so that CI-machinery changes always get an explicit human sign-off. Per CLAUDE.md, a deliberate, reviewed workflow change is unblocked only when a maintainer adds the gate-change label to the PR (GATE_HAS_OVERRIDE).

Step 4 — Decision: not merged.
Per the fail-fast policy, a required check is red, so merge is skipped. As an automated agent I will not add the gate-change label myself — that override exists precisely as a maintainer decision, and self-applying it would defeat the guard it protects.

To unblock: a maintainer reviews the workflow diff and adds the gate-change label, after which Gate integrity passes and the remaining checks (Verify, Trivy, CodeQL, audit, gitleaks) can gate the merge normally.

---

Generated by an automated review agent.

---

Generated by Claude Code

[helebest]

Automated dependency review — ⛔ blocked by policy (not merged)

Step 1 — Code review

• Scope matches the description: actions/setup-node v6 → v7, applied across .github/workflows/ci.yml and .github/workflows/live-integration.yml. The bump itself is reasonable (setup-node v7 drops Node < 20 support; CI already runs Node 24, so no functional impact).

Step 2/3 — CI: Gate integrity FAILED

✖ Gate integrity FAILED — the verification itself was weakened:
  ✖ [gate-machinery-modified] .github/workflows/ci.yml — gate/CI machinery changed
  ✖ [gate-machinery-modified] .github/workflows/live-integration.yml — gate/CI machinery changed

This is by design: the gate-integrity job (reward-hacking gate) treats any edit to .github/workflows/** as a change to the verification machinery and fails unless a maintainer has explicitly signed off with the gate-change label. (Verify and the other jobs pass on their own.)

Decision (fail-fast): Not merging. An automated agent must not self-approve a CI-machinery change. This needs a maintainer to review the setup-node v7 bump and add the gate-change label; once that label is present, gate-integrity will pass and this can be merged.

Automated review — flagging for maintainer action rather than merging.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ⚠️ needs maintainer gate-change label, not auto-merging

Step 1 — Code review
Bumps actions/setup-node v6 → v7, applied consistently to .github/workflows/ci.yml (3 occurrences) and .github/workflows/live-integration.yml (1 occurrence); node-version: "24" and cache: npm are unchanged. The diff matches the PR description. setup-node@v7 is the ESM-migration major (bundles @actions/cache 5.1.0, adds cache-primary-key/cache-matched-key outputs) with no breaking change to the inputs this repo uses. Correct, conventional, no security concerns.

Step 2 / 3 — Regression & CI
All functional checks are green on ca7c549:

• ✅ Verify (typecheck + coverage + build + e2e) — including bundle budget
• ✅ Container scan (trivy) · ✅ Dependency audit (npm audit) · ✅ Secret scan (gitleaks) · ✅ CodeQL

The one red check is Gate integrity (no reward-hacking), and it fails by design:

✖ Gate integrity FAILED — the verification itself was weakened:
  ✖ [gate-machinery-modified] .github/workflows/ci.yml — gate/CI machinery changed
  ✖ [gate-machinery-modified] .github/workflows/live-integration.yml — gate/CI machinery changed
  (GATE_HAS_OVERRIDE: false)
  … a maintainer can add the `gate-change` label to the PR.

scripts/check-gate-integrity.mjs intentionally flags any edit to .github/workflows/**. This is not a defect in the bump — it's the guard doing its job: a change to CI machinery must be an explicitly-acknowledged maintainer decision.

Step 4 — Decision
The change itself is safe and every real check passes, but this required job stays red until a maintainer adds the gate-change label (GATE_HAS_OVERRIDE), which is the sanctioned human override for CI-machinery changes. I am deliberately not self-applying that override or admin-merging from this unattended automated run, since the gate exists specifically as a human-in-the-loop control over CI changes.

➡️ Action for a maintainer: add the gate-change label, let the gate-integrity job re-run green, then squash-merge.

---

Generated by Claude Code

[helebest]

Dependabot review — actions/setup-node 6 → 7

Step 1 — Code review. GitHub Actions bump that edits workflow files under .github/workflows/ (ci.yml, live-integration.yml) to move actions/setup-node from v6 to v7. The change itself is benign.

Step 2 — Regression verification. ✅ Verify (typecheck + coverage + build + e2e) = success.

Step 3 — CI. ❌ Gate integrity (no reward-hacking) = failure — by design:

✖ Gate integrity FAILED — the verification itself was weakened:
  ✖ [gate-machinery-modified] .github/workflows/ci.yml — gate/CI machinery changed
  ✖ [gate-machinery-modified] .github/workflows/live-integration.yml — gate/CI machinery changed

The reward-hacking gate (scripts/check-gate-integrity.mjs) blocks any edit to CI machinery (.github/workflows/**) unless a maintainer applies the visible, auditable gate-change label.

Decision. 🛑 Not merged. The bump is safe, but merging requires a maintainer to add the gate-change label — an intentional human-in-the-loop acknowledgement that CI machinery was modified. I will not self-apply that override autonomously. Once a maintainer adds gate-change, Gate integrity will pass and this can merge.

---

Generated by Claude Code

[helebest]

Automated Dependabot review

Step 1 — Code review

• Consistency: Bumps the actions/setup-node pin v6 → v7 in the workflow file(s) under .github/workflows/, matching the description.
• Correctness / effectiveness: This is a major version bump (v7.0.0: migration to ESM, new cache-primary-key/cache-matched-key outputs, @actions/cache → 5.1.0). No breaking change for our usage (we don't consume the removed dummy NODE_AUTH_TOKEN export), but a major CI-action bump warrants explicit maintainer sign-off.
• Security: v7 pulls in security overrides for undici / fast-xml-parser; no advisory against the action itself.

Steps 2 & 3 — Regression / CI

• Verify ✓.
• ❌ Blocked by the required Gate integrity (no reward-hacking) check — by design. This PR edits .github/workflows/**, and scripts/check-gate-integrity.mjs fails any diff that touches the CI/gate machinery unless a maintainer applies the visible gate-change label (GATE_HAS_OVERRIDE). This is the intended guardrail, not a defect in the PR.
• Additionally mergeable_state: behind — the branch is based on an older main (2026-07-18) and needs a rebase; once rebased it will also encounter the base-branch security-scan block noted on the sibling PRs (chore(deps): bump @opentelemetry/sdk-trace-web from 2.9.0 to 2.10.0 #161–chore(deps-dev): bump the dev-dependencies group across 1 directory with 13 updates #165).

Step 4 — Decision: not merged. This requires a human maintainer decision that is outside automated scope: (1) review the major action bump and apply the gate-change label to authorize the workflow-file edit, and (2) rebase onto current main. Automation deliberately cannot self-authorize a change to the gate/CI machinery.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — actions/setup-node 6 → 7

Code review: Straightforward CI-action bump across ci.yml and live-integration.yml. The Verify check passes.

CI: ❌ the required Gate integrity check fails — by design. scripts/check-gate-integrity.mjs (isMachineryPath) flags any edit under .github/workflows/** as gate-machinery-modified, regardless of whether the edit is benign, because the gate deliberately can't judge direction. Clearing it requires a maintainer to attach the visible, auditable gate-change label to this PR (GATE_HAS_OVERRIDE).

Decision: not merging. Applying that override is a deliberate human sign-off that an automated agent should not self-grant. A maintainer can add the gate-change label if the bump is approved, after which CI will go green and this can merge.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ⚠️ CI blocked by design, not merging

Step 1 (code review): the bump itself (actions/setup-node 6 → 7, used in .github/workflows/ci.yml) is a low-risk pin update and looks fine.

Step 3 (CI): the required Gate integrity (no reward-hacking) check fails by design, because this PR edits a file under .github/workflows/**. Per scripts/check-gate-integrity.mjs (see docs/adr/0005-delivery-loop-hardening.md), any change to CI/gate machinery is blocked unless a maintainer adds the visible gate-change label to the PR — a deliberate human decision I am not self-applying in an automated run.

Note also that this PR's checks last ran on 2026-07-18; the required Dependency audit (prod, high+) and Container scan (trivy) checks now fail repo-wide (pre-existing transitive vulns / base-image CVEs that surfaced since), so a re-run would show them red independently of this bump.

Decision: not merged. A maintainer needs to add the gate-change label and re-run CI for this Action bump to become mergeable.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — not merged (maintainer action required) ⚠️

Scope: actions/setup-node 6 → 7 (major) in the CI workflow(s).

Step 1 — Code review: major-version bump of the setup-node action, which ci.yml pins as @v6 across the Verify, audit, and gate-integrity jobs. v7's notable change is default Node resolution/cache behavior. Worth adopting, but as a major bump the fresh Verify run should be confirmed green after authorization.

Blocking finding (Step 3 — CI): the required Gate integrity (no reward-hacking) check fails by design on any .github/workflows/** edit (scripts/check-gate-integrity.mjs, docs/adr/0005-delivery-loop-hardening.md). This is the intended reward-hacking guard, not a PR defect.

Resolution requires a maintainer: add the visible gate-change label (GATE_HAS_OVERRIDE) to authorize the workflow edit; the gate then passes. I have intentionally not applied the label or overridden the gate. After labeling, confirm the re-run Verify stays green (given the major bump) before squash-merging. Flagging for maintainer action.

---

Generated by Claude Code