chore(ci): Bump actions/setup-node from 4 to 7

[dependabot]

Bumps actions/setup-node from 4 to 7.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in actions/setup-node#1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in actions/setup-node#1533

New Contributors

• @​Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in actions/setup-node#1283

... (truncated)

Commits

• 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
• 7207c4f chore: update dependencies and add license files (#1642)
• 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
• fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
• 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
• 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
• a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
• 680d1e4 Support absolute paths in node-version-file (#1633)
• db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
• 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

∵ causari · AI code survival

279 commits analyzed (git metadata only, retroactive, no setup).

AI-tagged (metadata matched): 82.0% line-weighted (5142 of 6267 lines still at HEAD, 14 commits) · 82.0% capped · median 92.5%

Of the lines introduced by metadata-matched commits, this percentage is the share git blame -w -M -C still attributes to those commits. It is not the share of the repository and it is not a quality score. Metadata matched does not prove who wrote each line. UNKNOWN and untagged are commits with no such signal; they are not a finding that a human wrote them.

Age-matched gap: +3.4 percentage points (AI-tagged 84.6% minus untagged 81.2% in the matched age windows). Positive means the metadata-matched lines have the higher line-weighted survival in those windows, over 1 matched age window holding 75% of the AI-tagged lines. Lines outside those windows are not in this gap.

Same repository, untagged lines: 192669 of 241806 still at HEAD (79.7% line-weighted, 265 commits).

Line age	AI-tagged	Untagged
0-30 d	84.6% (13 commits)	81.2% (184 commits)
30-90 d	—	63.0% (41 commits)
90-180 d	74.3% (1 commit)	63.9% (40 commits)

Agent	Commits	Introduced	Survived	Line-weighted	Capped	Median
cursor	14	6267	5142	82.0%	82.0%	92.5%

_{PROBABLE = heuristic. Counts lines from AI-tagged commits still attributed to them by git blame -w -M -C; inline completions leave no git trace and are not measured. Capped: each commit weighs at most min(p95 of per-commit introduced lines, 10000 lines); median: median of per-commit rates. Untagged = commits with no AI signal (human, inline-completed and untagged-agent code alike); age = commit date to HEAD date. absent means no introduced lines are included in the measurement (JSON null), not a measured zero and not a claim that the commits introduced nothing. An unavailable age-matched gap is not a gap of zero. Method v4: causari.dev/method. --json stores the commit, method, blame flags and counts. It does not store refs/notes/ai. The JSON field is still verified: metadata matched, not authorship proved.}

Read the age-matched gap as the comparison. An agent line marked below floor is not comparable. Meeting the floor is not a reliability guarantee.

Export: re audit <target> --json (the counts and commit b4b6f1a2537e4e8c534286e97f96dc9c29bc9cce), --summary for this Markdown, --seal to sign those JSON bytes for that commit and method v4. --badge and --card write SVGs. re report is the local ledger, not this audit.

The export stores the counts, commit b4b6f1a2537e4e8c534286e97f96dc9c29bc9cce, method v4, blame -w -M -C, and the coverage flags. It does not store refs/notes/ai. That ref is not part of the commit; adding or removing it can change the counts while the stored SHA stays the same. A repository that has moved has a different commit, and this export does not reproduce it.

Sealed: cs_2026_RFIJ34DKSBDRJUUMG644MGSDJM (crovia.seal.v1) over this audit of b4b6f1a2537e, written to causari-audit.seal.json. Verify offline with re seal verify causari-audit.seal.json or at https://causari.dev/verify — the seal proves these exact numbers were signed for this commit, not that they are true.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	causari	7a58be0	Commit Preview URL Branch Preview URL	Oct 14 2026, 06:35 PM

[dependabot]

Dependabot can't parse your survival-report-recover.yml. Because of this, Dependabot cannot update this pull request.