build(deps): bump actions/setup-go from 6.5.0 to 7.0.0

[dependabot]

Bumps actions/setup-go from 6.5.0 to 7.0.0.

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-go#763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-go#771

New Contributors

• @​philip-gai made their first contribution in actions/setup-go#771

Full Changelog: actions/setup-go@v6...v7.0.0

Commits

• b7ad1da chore(deps): bump @​actions/cache to 6.2.0 (#771)
• 0778a10 Migrate to ESM and upgrade dependencies (#763)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 17, 2026, 3:28 AM ET / 07:28 UTC.

Summary
Updates five pinned actions/setup-go references from v6.5.0 to v7.0.0 across four GitHub Actions workflows.

Reproducibility: not applicable. this is a pinned GitHub Action dependency update rather than a reported product bug.

Review metrics: 2 noteworthy metrics.

• Workflow references: 5 changed across 4 workflows. The action revision is updated consistently rather than leaving mixed setup-go majors.
• Reported checks: 6 passed, 0 failed. Linux, Windows, CodeQL, and secret-scan checks found no regression on the PR head.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P1] The reported checks exercise CI and CodeQL, but do not show direct runs of crabbox-hydrate or release-assets; those paths therefore rely on setup-go v7 retaining the inputs used here.

Maintainer options:

1. Accept the bounded workflow risk (recommended)
   Merge the consistently pinned update with the six green checks, accepting that hydration and release entry points were not directly exercised on this head.
2. Smoke the unexercised workflows
   Run Crabbox hydration against the PR head and a safe non-publishing equivalent of release setup before merging.

Next step before merge

• [P2] No repair is indicated; this PR is ready for ordinary maintainer merge handling after accepting or independently smoking the two unexercised workflow paths.

Security
Cleared: The PR pins an official GitHub Action to a full immutable commit and introduces no broader permissions, secrets access, dependency source, or publishing changes.

Review details

Best possible solution:

Keep every workflow on the same immutable official setup-go v7 revision and, when practical, maintain a non-publishing smoke path for release and hydration workflow changes.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a pinned GitHub Action dependency update rather than a reported product bug.

Is this the best way to solve the issue?

Yes. Updating all existing references together to one immutable upstream release commit is the narrowest maintainable approach.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a9610b5576fa.

Label changes

Label changes:

• add P3: This is a low-risk maintenance update with no reported user-facing regression.
• add merge-risk: 🚨 automation: Two changed workflow entry points—Crabbox hydration and release assets—are not represented among the reported PR check runs.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor proof gate is not applicable to this bot-authored dependency PR; the six successful GitHub Actions checks provide appropriate supplemental validation.

Label justifications:

• P3: This is a low-risk maintenance update with no reported user-facing regression.
• merge-risk: 🚨 automation: Two changed workflow entry points—Crabbox hydration and release assets—are not represented among the reported PR check runs.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor proof gate is not applicable to this bot-authored dependency PR; the six successful GitHub Actions checks provide appropriate supplemental validation.

Evidence reviewed

What I checked:

• Current main still uses v6: The base revision uses the v6 setup-go commit in CI, CodeQL, Crabbox hydration, and release-assets workflows, so the requested dependency update is not already implemented on main. (.github/workflows/ci.yml:16, a9610b5576fa)
• Narrow coordinated update: The PR replaces five setup-go references with the same immutable v7.0.0 commit and does not alter workflow inputs, permissions, triggers, or publishing steps. (.github/workflows/ci.yml:16, 69051004a856)
• Release workflow remains pinned: The release-assets workflow changes only the full-length setup-go commit pin while retaining go-version-file and cache settings, consistent with the repository's release controls. (.github/workflows/release-assets.yml:46, 69051004a856)
• Reported validation is green: All six hydrated checks succeeded, including Linux tests, Windows tests, CodeQL analysis, and verified-secret scans. (.github/workflows/ci.yml:1, 69051004a856)
• Repository release policy considered: The full AGENTS.md was read; its strict release-artifact policy makes the unexercised release workflow relevant, but the PR does not change signing, artifact production, or publication behavior. (AGENTS.md:54, a9610b5576fa)

Likely related people:

• steipete: The repository's release model and these shared workflow paths indicate broad release ownership; direct line-level attribution could not be confirmed because the read-only shell failed before history commands executed. (role: likely release and workflow owner; confidence: low; commits: 216601c0c26b; files: .github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/crabbox-hydrate.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.