chore(deps): update actions/setup-node action to v7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	major	v6 → v7

---

Release Notes

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in #​1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in #​1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in #​1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in #​1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in #​1536
• docs: Update restore-only cache documentation by @​priya-kinthali in #​1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in #​1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1569

New Contributors

• @​chiranjib-swain made their first contribution in #​1536
• @​deiga made their first contribution in #​1548
• @​jasongin made their first contribution in #​1569

Full Changelog: actions/setup-node@v6...v7.0.0

v7

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.39%. Comparing base (4de1fd1) to head (fcfd7d9).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2194      +/-   ##
==========================================
- Coverage   83.40%   83.39%   -0.02%     
==========================================
  Files         395      395              
  Lines       39218    39218              
==========================================
- Hits        32710    32705       -5     
- Misses       4571     4574       +3     
- Partials     1937     1939       +2     

Flag	Coverage Δ
integration	7.29% <ø> (ø)
unit	81.47% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ALRubinger]

🐑 renovate-shepherd triage: needs a human decision

actions/setup-node v6 → v7 — a major bump, outside the automerge rule, so I'm leaving it for a human rather than merging unattended.

Status: all checks pass. Nothing is broken; this is purely a major-version sign-off.

Blast radius

Four workflows pin the action:

• .github/workflows/ci.yml
• .github/workflows/release.yml
• .github/workflows/sandbox-base.yml
• .github/workflows/sandbox-features.yml

The diff is only the @v6 → @v7 ref. The node-version: "24" pin and the cache: pnpm setting are unchanged.

What a reviewer should check

setup-node majors have historically changed cache handling and the cache: pnpm interaction. This repo drives pnpm through pnpm/action-setup@v6 pinned at 11.22.0, so the ordering between the two actions matters — a setup-node cache change that runs before pnpm is provisioned is the classic failure, and it tends to show up as a cache miss or a corepack complaint rather than a hard failure.

CI being green here is good evidence, but note it does not exercise release.yml. Skim the v7 release notes for cache/corepack changes before merging.

— renovate-shepherd