build(deps): bump actions/setup-go from 6 to 7

[dependabot]

Bumps actions/setup-go from 6 to 7.

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-go#763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-go#771

New Contributors

• @​philip-gai made their first contribution in actions/setup-go#771

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

• Upgrade actions dependencies by @​priyagupta108 with @​Copilot in actions/setup-go#744
• Upgrade @​types/node and typescript-eslint dependencies to resolve npm audit findings by @​HarithaVattikuti in actions/setup-go#755
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-go#758
• Upgrade version to 6.5.0 in package.json and package-lock.json by @​HarithaVattikuti in actions/setup-go#762

New Contributors

• @​priyagupta108 with @​Copilot made their first contribution in actions/setup-go#744
• @​jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

• Add go-download-base-url input for custom Go distributions by @​gdams in actions/setup-go#721

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in actions/setup-go#727

Documentation update

• Rearrange README.md, add advanced-usage.md by @​priyagupta108 in actions/setup-go#724
• Fix Microsoft build of Go link by @​gdams in actions/setup-go#734

New Contributors

• @​gdams made their first contribution in actions/setup-go#721

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

• Update default Go module caching to use go.mod by @​priyagupta108 in actions/setup-go#705
• Fix golang download url to go.dev by @​178inaba in actions/setup-go#469

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

... (truncated)

Commits

• b7ad1da chore(deps): bump @​actions/cache to 6.2.0 (#771)
• 0778a10 Migrate to ESM and upgrade dependencies (#763)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 24, 2026, 7:23 AM ET / 11:23 UTC.

ClawSweeper review

What this changes

Updates four GitHub Actions workflows from actions/setup-go@v6 to actions/setup-go@v7, affecting CI, CodeQL, Crabbox hydration, and the legacy release workflow.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep this PR open for normal merge handling. It is a narrow, clean Dependabot update across all Go-based workflows; the supplied checks succeeded, and current main still uses version 6, so the requested upgrade is not already implemented.

Priority: P3
Reviewed head: 8ca606471eb9deb8f5daa30cd392d7ab8a19dc29

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, internally consistent workflow dependency update with successful supplied checks and no discrete correctness defect found.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot workflow-only PR is exempt from the external-contributor real-behavior proof gate; the supplied completed checks provide the relevant validation signal.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot workflow-only PR is exempt from the external-contributor real-behavior proof gate; the supplied completed checks provide the relevant validation signal.
Evidence reviewed	4 items	Narrow workflow update: The PR replaces only the actions/setup-go major version while preserving the existing go-version-file: go.mod and cache configuration in all four affected workflows. All Go workflow consumers updated: The supplied PR diff changes the setup action consistently in CI, CodeQL, Crabbox hydration, and the legacy release workflow: 7 additions and 7 deletions across 4 files. Current validation signal: The provided PR check state reports successful test, lint, dependency, CodeQL, release-check, and secret-scan runs on this branch.
Findings	None	None.
Security	None	None.

How this fits together

Graincrawl’s GitHub Actions workflows provision Go before running tests, analysis, release steps, and remote validation setup. This PR changes that shared provisioning action while leaving the workflow jobs, Go version source, and cache settings intact.

flowchart LR
  A[Workflow trigger] --> B[GitHub Actions runner]
  B --> C[Checkout source]
  C --> D[Set up Go]
  D --> E[Restore Go cache]
  E --> F[CI, analysis, release, or Crabbox job]

Loading

Before merge

• Resolve merge risk (P1) - actions/setup-go version 7 is a major action upgrade used by four automation paths; although the supplied branch checks are green, maintainers should own any future GitHub-hosted-runner or cache-behavior change after merge.
• Complete next step (P2) - No concrete repair is needed: this clean Dependabot PR awaits ordinary maintainer merge handling and acceptance of the shared-workflow upgrade risk.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow coverage	4 files affected; 7 replacements	Every current setup-go use in the supplied diff is upgraded together, avoiding mixed action-major versions across CI paths.
Reported checks	10 successful, 1 skipped	The supplied branch status includes successful test, lint, dependency, CodeQL, release, and secret-scan checks.

Merge-risk options

Maintainer options:

1. Merge with workflow monitoring (recommended)
   Accept the green branch validation and monitor the next scheduled CI and release execution because the action’s major-version runtime changes affect shared automation.
2. Pause for an explicit runner check
   Keep the PR open if maintainers want a manually observed run on the repository’s release or remote-validation path before accepting the action upgrade.

Technical review

Best possible solution:

Merge the focused update after accepting the successful workflow validation, then monitor the next scheduled and release workflow runs for any runner-specific setup or cache regression.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a GitHub Actions dependency update, not a reported runtime defect. The relevant evidence is the supplied successful workflow runs on the proposed branch.

Is this the best way to solve the issue?

Yes. Updating the existing shared setup action in each current Go workflow is the narrowest consistent solution; the PR does not introduce a parallel setup path or alter workflow configuration.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model internal, reasoning high; reviewed against decf9d652ea9.

Labels

Label changes:

• add P3: This is routine CI dependency maintenance with green supplied checks and no reported user-facing regression.
• add merge-risk: 🚨 automation: The PR changes a shared GitHub Action major version used by CI, security analysis, release, and remote-validation workflows.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot workflow-only PR is exempt from the external-contributor real-behavior proof gate; the supplied completed checks provide the relevant validation signal.

Label justifications:

• P3: This is routine CI dependency maintenance with green supplied checks and no reported user-facing regression.
• merge-risk: 🚨 automation: The PR changes a shared GitHub Action major version used by CI, security analysis, release, and remote-validation workflows.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot workflow-only PR is exempt from the external-contributor real-behavior proof gate; the supplied completed checks provide the relevant validation signal.

Evidence

What I checked:

• Narrow workflow update: The PR replaces only the actions/setup-go major version while preserving the existing go-version-file: go.mod and cache configuration in all four affected workflows. (.github/workflows/ci.yml:29, 8ca606471eb9)
• All Go workflow consumers updated: The supplied PR diff changes the setup action consistently in CI, CodeQL, Crabbox hydration, and the legacy release workflow: 7 additions and 7 deletions across 4 files. (.github/workflows/codeql.yml:29, 8ca606471eb9)
• Current validation signal: The provided PR check state reports successful test, lint, dependency, CodeQL, release-check, and secret-scan runs on this branch. (.github/workflows/crabbox-hydrate.yml:42, 8ca606471eb9)
• Current-main comparison: The PR’s clean merge metadata and base-referenced diff show current main still has actions/setup-go@v6; version 7 is therefore not already present on the reviewed base. (.github/workflows/release-legacy.yml:33, decf9d652ea9)

Likely related people:

• unknown: The supplied review context identifies the affected workflow files but does not expose usable current-main blame or log output; route to the repository contributor responsible for recent CI workflow maintenance. (role: workflow-history owner; confidence: low; files: .github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/crabbox-hydrate.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Accept the remaining shared-automation upgrade risk or request one manually observed release/remote-validation run before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: build(deps): bump actions/setup-go from 6 to 7 This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.