chore(deps): update actions/setup-node action to v7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	major	v6 → v7

---

Release Notes

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in #​1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in #​1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in #​1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in #​1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in #​1536
• docs: Update restore-only cache documentation by @​priya-kinthali in #​1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in #​1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1569

New Contributors

• @​chiranjib-swain made their first contribution in #​1536
• @​deiga made their first contribution in #​1548
• @​jasongin made their first contribution in #​1569

Full Changelog: actions/setup-node@v6...v7.0.0

v7

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[kody-ai]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

[kody-ai]

Floating major tag in .github/workflows/publish.yml (lines 19-21) uses actions/setup-node@v7, widening supply-chain risk because future v7 commits/releases can alter action behavior without repo changes. Pin the action to a specific commit SHA (actions/setup-node@8207627) or another immutable reference so the publish workflow executes known code.

-            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
               with:
                   node-version: "24.x"
                   registry-url: "https://registry.npmjs.org"

Prompt for LLM

File .github/workflows/publish.yml:

Line 16 to 19:

Floating major tag in .github/workflows/publish.yml (lines 19-21) uses actions/setup-node@v7, widening supply-chain risk because future v7 commits/releases can alter action behavior without repo changes. Pin the action to a specific commit SHA (actions/setup-node@820762786026740c76f36085b0efc47a31fe5020) or another immutable reference so the publish workflow executes known code.

Suggested Code:

-            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
               with:
                   node-version: "24.x"
                   registry-url: "https://registry.npmjs.org"

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​