build(deps): bump actions/setup-go from 6 to 7

[dependabot]

Bumps actions/setup-go from 6 to 7.

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-go#763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-go#771

New Contributors

• @​philip-gai made their first contribution in actions/setup-go#771

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

• Upgrade actions dependencies by @​priyagupta108 with @​Copilot in actions/setup-go#744
• Upgrade @​types/node and typescript-eslint dependencies to resolve npm audit findings by @​HarithaVattikuti in actions/setup-go#755
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-go#758
• Upgrade version to 6.5.0 in package.json and package-lock.json by @​HarithaVattikuti in actions/setup-go#762

New Contributors

• @​priyagupta108 with @​Copilot made their first contribution in actions/setup-go#744
• @​jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

• Add go-download-base-url input for custom Go distributions by @​gdams in actions/setup-go#721

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in actions/setup-go#727

Documentation update

• Rearrange README.md, add advanced-usage.md by @​priyagupta108 in actions/setup-go#724
• Fix Microsoft build of Go link by @​gdams in actions/setup-go#734

New Contributors

• @​gdams made their first contribution in actions/setup-go#721

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

• Update default Go module caching to use go.mod by @​priyagupta108 in actions/setup-go#705
• Fix golang download url to go.dev by @​178inaba in actions/setup-go#469

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

... (truncated)

Commits

• b7ad1da chore(deps): bump @​actions/cache to 6.2.0 (#771)
• 0778a10 Migrate to ESM and upgrade dependencies (#763)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 18, 2026, 8:55 AM ET / 12:55 UTC.

Summary
The branch replaces nine actions/setup-go v6 references with actions/setup-go@v7 across five GitHub Actions workflow files.

Reproducibility: not applicable. this is a GitHub Actions dependency update rather than a reported runtime defect. The relevant validation is completion of the affected workflow jobs on the PR head.

Review metrics: 1 noteworthy metric.

• Workflow references: 9 changed across 5 workflow files. The action-major upgrade reaches CI, analysis, hydration, reporting, and publishing paths, so complete workflow validation matters before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Wait for lint, release-check, and test to complete successfully on the current head.

Risk before merge

• [P1] This major action update affects nine setup steps across CI and release-adjacent workflows; merge only after the remaining lint, release-check, and test runs validate the reviewed head.

Maintainer options:

1. Wait for all workflow validation (recommended)
   Merge after lint, release-check, and test finish successfully for this exact nine-reference workflow update.
2. Pause the major action upgrade
   Leave the PR open if any remaining workflow exposes runner or action-runtime incompatibility, then update the affected workflow deliberately.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Require successful lint, release-check, and test results on the current head before merge.

Next step before merge

• [P2] No repair is indicated: the remaining merge gate is ordinary completion of the workflow checks rather than a file-level defect for an automated worker to change.

Security
Cleared: The diff only updates an existing official GitHub Action reference and does not add permissions, secrets access, scripts, dependencies, or third-party execution paths.

Review details

Best possible solution:

Merge the focused update after the remaining workflow checks pass on the exact branch head, preserving the existing Go-version and caching configuration.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a GitHub Actions dependency update rather than a reported runtime defect. The relevant validation is completion of the affected workflow jobs on the PR head.

Is this the best way to solve the issue?

Yes: updating the existing shared setup action references in place is the narrowest maintainable solution, provided the complete workflow matrix succeeds.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model internal, reasoning high; reviewed against 15af97146636.

Label changes

Label changes:

• add P3: This is routine dependency-maintenance work with no reported user-facing regression.
• add merge-risk: 🚨 automation: The branch changes the action runtime used by nine CI and release-adjacent setup steps, so an incompatibility would affect repository automation after merge.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored workflow-only dependency update is exempt from the external-contributor real-behavior-proof gate; the appropriate evidence is the affected GitHub Actions workflow results.

Label justifications:

• P3: This is routine dependency-maintenance work with no reported user-facing regression.
• merge-risk: 🚨 automation: The branch changes the action runtime used by nine CI and release-adjacent setup steps, so an incompatibility would affect repository automation after merge.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored workflow-only dependency update is exempt from the external-contributor real-behavior-proof gate; the appropriate evidence is the affected GitHub Actions workflow results.

Evidence reviewed

What I checked:

• Focused workflow update: The supplied PR diff changes only actions/setup-go references, retaining the existing go-version-file: go.mod and cache: true inputs at every updated call site. (.github/workflows/ci.yml:25, 94e84792f853)
• Current-main gap: The provided base revision shows current main at 15af971 while this unmerged branch changes v6/v6.5.0 references to v7, so the requested update is not already implemented. (.github/workflows/codeql.yml:26, 15af97146636)
• Workflow coverage: The update covers CI, CodeQL, Crabbox hydration, backup reporting, and publishing workflows rather than leaving a mixed major-version setup. (.github/workflows/crabbox-hydrate.yml:42, 94e84792f853)
• Available validation: The GitHub context reports successful analyze, dependency, Docker, secret-scanning, and CodeQL checks; lint, release-check, and test are still running on the reviewed head. (.github/workflows/ci.yml:25, 94e84792f853)

Likely related people:

• unknown: The target checkout could not be queried for git log or git blame because the read-only command sandbox failed before repository history could be read; no non-author current-main owner can be supported from the supplied PR context. (role: workflow-history owner unresolved; confidence: low; files: .github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/crabbox-hydrate.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.