build(deps): bump actions/setup-node to v7

[steipete]

Summary

• update the Pages workflow's immutable actions/setup-node pin from v6.4.0 to v7.0.0
• align the inline annotation with the pinned v7.0.0 release

Maintainer replacement for #141.

Focused proof

• actionlint .github/workflows/pages.yml
• exact actions/setup-node SHA 820762786026740c76f36085b0efc47a31fe5020 executed in an isolated tool cache with node-version: 24; it downloaded, cached, and exposed Node 24.18.0 arm64
• Node 24.18.0: node scripts/build-docs-site.mjs built 47 Pages files
• built index.html and commands/search.html served locally with HTTP 200
• CNAME remained discrawl.sh; .nojekyll present
• AutoReview clean: no accepted/actionable findings

The github-pages environment permits deployment only from main and gh-pages, so no pre-merge branch publication was attempted. Exact-head hosted checks remain the merge gate.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 18, 2026, 3:45 PM ET / 19:45 UTC.

Summary
Updates .github/workflows/pages.yml to pin actions/setup-node at the v7.0.0 immutable commit instead of the v6.4.0 commit.

Reproducibility: not applicable. This PR updates a CI workflow dependency rather than addressing a user-reproducible product defect. The proposed workflow path is directly inspectable from the one-line patch and supplied validation.

Review metrics: 2 noteworthy metrics.

• Workflow surface: 1 file changed; 1 line added, 1 removed. The proposed behavior change is confined to a single immutable action reference in the Pages deployment workflow.
• Visible validation: 4 local checks reported. The contributor reports actionlint, docs generation, generated-page HTTP responses, and Pages artifact preservation, while hosted exact-head checks remain pending.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Wait for the exact-head lint, test, and release-check jobs to complete successfully.
• After landing one branch, close the equivalent open Dependabot proposal to avoid parallel maintenance.

Risk before merge

• [P1] actions/setup-node v7 changes the action runtime used by the production Pages workflow; branch validation cannot publish into the protected github-pages environment, so the deployment-specific path is only fully exercised after landing.

Maintainer options:

1. Gate on exact-head workflow checks (recommended)
   Allow the narrow update to proceed only after the PR head’s remaining lint, test, and release-check jobs complete successfully, then use the existing protected deployment path for the Pages run.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Require successful exact-head lint, test, and release-check jobs before merging; retain the immutable v7.0.0 SHA pin.

Next step before merge

• [P2] No repair lane is appropriate: there is no discrete defect to fix, and the remaining work is ordinary exact-head CI completion and maintainer selection between equivalent open PRs.

Security
Cleared: The visible diff keeps an immutable GitHub Action SHA pin and adds no permissions, secrets, third-party source, install step, or new executable path.

Review details

Best possible solution:

Land one reviewed v7 immutable pin after the exact-head checks pass, then close the duplicate Dependabot proposal rather than maintaining two open branches for the same Pages workflow change.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a CI workflow dependency rather than addressing a user-reproducible product defect. The proposed workflow path is directly inspectable from the one-line patch and supplied validation.

Is this the best way to solve the issue?

Yes: replacing the immutable setup-node v6 pin with the v7.0.0 immutable pin in the one affected workflow is the narrowest maintainable path. Keeping both this PR and the equivalent open Dependabot proposal would create avoidable review duplication.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model internal, reasoning high; reviewed against 5192dce87a2d.

Label changes

Label changes:

• add P3: This is a small, scoped dependency-maintenance update with no reported user-facing regression.
• add merge-risk: 🚨 automation: The patch changes the action runtime used by Pages automation, and the protected deployment environment cannot be fully exercised from the PR branch.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a collaborator-authored workflow-only PR, so the external-contributor proof gate does not apply; its body nevertheless supplies actionlint and real local docs-site validation.

Label justifications:

• P3: This is a small, scoped dependency-maintenance update with no reported user-facing regression.
• merge-risk: 🚨 automation: The patch changes the action runtime used by Pages automation, and the protected deployment environment cannot be fully exercised from the PR branch.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a collaborator-authored workflow-only PR, so the external-contributor proof gate does not apply; its body nevertheless supplies actionlint and real local docs-site validation.

Evidence reviewed

What I checked:

• Focused workflow diff: The proposed branch changes only the Pages job’s Set up Node action reference from the v6 SHA to 820762786026740c76f36085b0efc47a31fe5020, annotated as v7.0.0. (.github/workflows/pages.yml:36, 4c7da9cbe4ca)
• Current-base behavior: The pull-file patch is against the supplied current main SHA and shows that main still uses the v6.4.0 actions/setup-node pin, so the requested update is not already implemented. (.github/workflows/pages.yml:36, 5192dce87a2d)
• Related replacement PR: The PR body identifies this as a maintainer replacement for the still-open Dependabot proposal with the same dependency/version update; neither open branch is a safe reason to close the other before one lands. (0d4471c36c17)
• Validation supplied: The PR body records actionlint, a Node 24.18.0 docs-site build of 47 files, local HTTP 200 checks for generated pages, and preservation of CNAME and .nojekyll; the relevant exact-head lint, release-check, and test checks were still in progress in the supplied state. (.github/workflows/pages.yml:36, 4c7da9cbe4ca)

Likely related people:

• unresolved: The available read-only command sandbox could not start, so current-main blame and log history for the Pages workflow could not be inspected; the ownership trail should be refreshed from .github/workflows/pages.yml before rerouting. (role: workflow-history owner; confidence: low; files: .github/workflows/pages.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.