build(deps): bump the github-actions group with 4 updates

[dependabot]

Bumps the github-actions group with 4 updates: actions/checkout, actions/setup-node, github/codeql-action/init and github/codeql-action/analyze.

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in actions/checkout#2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in actions/checkout#2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in actions/checkout#2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in actions/checkout#2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in actions/checkout#2476
• eslint 9 by @​dependabot[bot] in actions/checkout#2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in actions/checkout#2499
• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• prep v7.0.1 release by @​aiqiaoy in actions/checkout#2531

Full Changelog: actions/checkout@v7...v7.0.1

Commits

• See full diff in compare view

Updates actions/setup-node from 6 to 7

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in actions/setup-node#1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in actions/setup-node#1533

New Contributors

• @​Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in actions/setup-node#1283

... (truncated)

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.0 to 4.37.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

... (truncated)

Commits

• 7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
• c8b5f69 Update changelog for v4.37.1
• 9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
• 3492b7e Change REMOTE_PATH_PREFIX to remote=
• 3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
• 2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
• 23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
• 1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
• e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
• 6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.0 to 4.37.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

... (truncated)

Commits

• 7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
• c8b5f69 Update changelog for v4.37.1
• 9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
• 3492b7e Change REMOTE_PATH_PREFIX to remote=
• 3654baa Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
• 2d682ac Merge pull request #4017 from github/dependabot/github_actions/dot-github/wor...
• 23f6a50 Merge pull request #4009 from github/mbg/action-state/additions
• 1ee3c75 Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...
• e053684 Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...
• 6803c56 Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: found issues before merge. Reviewed July 20, 2026, 12:11 PM ET / 16:11 UTC.

Summary
The branch updates checkout, setup-node, and CodeQL Action versions across seven GitHub Actions workflow files.

Reproducibility: not applicable. this is a dependency-maintenance PR rather than a user-reported bug. The relevant validation is an after-fix run of the self-hosted workflow.

Review metrics: 2 noteworthy metrics.

• Workflow surface: 7 files affected; 12 additions, 12 deletions. The PR is narrowly scoped to CI, release, security, Pages, and self-hosted hydration workflows.
• Action updates: 4 dependencies updated. One update is a major setup-node change, so the self-hosted workflow path merits explicit upgrade proof.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Correct the stale checkout major-version comment in .github/workflows/dependency-review.yml.
• Attach redacted successful output from the self-hosted Crabbox hydration workflow; if a re-review does not trigger after updating the body, ask a maintainer to comment @clawsweeper re-review.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR context contains successful automated checks but no after-fix live run of the changed self-hosted hydration workflow; attach redacted terminal or workflow output before merge, then update the PR body for re-review.

Risk before merge

• [P1] The self-hosted Crabbox hydration runner may fail if its Actions Runner version does not support the Node 24-based setup-node v7 runtime; ordinary hosted CI does not establish that upgrade path.

Maintainer options:

1. Verify the self-hosted runner upgrade path (recommended)
   Run the updated Crabbox hydration workflow on its self-hosted runner, confirm the runner supports the new action runtime, and attach redacted live output before merging.
2. Accept the runner compatibility risk
   Merge based on the existing checkout v7 usage only if the workflow owner confirms the Crabbox runner fleet already meets the action runtime requirement.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Correct the dependency-review checkout version comment and attach redacted successful output from the self-hosted Crabbox hydration workflow using this head.

Next step before merge

• [P2] A maintainer or workflow operator must confirm the self-hosted runner compatibility path and provide runtime evidence; this is not a safe automated repair task.

Security
Cleared: The diff only updates established GitHub Actions dependencies and preserves immutable SHA pinning for the CodeQL actions; no new permission, secret, or third-party execution surface was introduced.

Review findings

• [P3] Correct the checkout major-version annotation — .github/workflows/dependency-review.yml:21

Review details

Best possible solution:

Correct the stale checkout version comment and obtain a redacted successful run of the updated self-hosted hydration workflow before merging the dependency update.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-maintenance PR rather than a user-reported bug. The relevant validation is an after-fix run of the self-hosted workflow.

Is this the best way to solve the issue?

Unclear: the dependency updates are appropriately narrow, but merging without confirming the self-hosted runner path is not the best upgrade-safe approach.

Full review comments:

• [P3] Correct the checkout major-version annotation — .github/workflows/dependency-review.yml:21
  The new immutable checkout SHA is annotated as v6, while this dependency group updates checkout from v7.0.0 to v7.0.1. Keep the comment aligned with the referenced action so future security and dependency audits do not misidentify the pin.
  Confidence: 0.9

Overall correctness: patch is correct
Overall confidence: 0.82

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 041bf4bfd670.

Label changes

Label justifications:

• P2: This is a bounded CI and release-workflow maintenance change with a concrete self-hosted compatibility question.
• merge-risk: 🚨 compatibility: The setup-node v7 update reaches a self-hosted runner path and can fail if that runner lacks support for the action runtime.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR context contains successful automated checks but no after-fix live run of the changed self-hosted hydration workflow; attach redacted terminal or workflow output before merge, then update the PR body for re-review.

Evidence reviewed

What I checked:

• Focused workflow diff: The submitted branch changes only seven workflow files, replacing four GitHub Action dependencies; CodeQL references remain pinned to immutable commit SHAs. (.github/workflows/codeql.yml:65, 0e9b29c6f4f3)
• Self-hosted workflow affected: The update changes actions/setup-node from v6 to v7 in the Crabbox hydration workflow, which runs on a self-hosted runner; the provided successful checks do not show a hydration run. (.github/workflows/crabbox-hydrate.yml:50, 0e9b29c6f4f3)
• Workflow checks passed: The supplied PR context reports successful test, CodeQL, dependency-review, and secret-scan checks for this exact head, but those are supplemental rather than real behavior proof. (0e9b29c6f4f3)
• Runner compatibility context: The upstream setup-node documentation states that the Node 24 runtime requires Actions Runner v2.327.1 or newer; the PR changes a self-hosted workflow to setup-node v7 without showing that runner path after the update. (.github/workflows/crabbox-hydrate.yml:50, 0e9b29c6f4f3)

Likely related people:

• mvanhorn: Public repository activity identifies this person as a ClawPatch contributor, but the local history inspection needed to attribute these workflow files was unavailable; route with low confidence. (role: adjacent repository contributor; confidence: low; files: .github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/crabbox-hydrate.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

@clawsweeper re-review

Exact-head self-hosted proof is now complete for 14a6e339c122b017b124e3f7e545142141969e40.

• Corrected the stale checkout annotation (v6 to v7) in .github/workflows/dependency-review.yml.
• AWS Crabbox provider, lease cbx_69fdec2d0045 (blue-lobster), run run_1398121406a1.
• GitHub Actions hydration run 29794815153 used this PR branch and exact head.
• Self-hosted Actions Runner 2.336.0 (above setup-node v7's documented 2.327.1 minimum).
• actions/checkout@v7.0.1, pnpm/action-setup@v6.0.9, and actions/setup-node@v7 all completed successfully on the self-hosted runner.
• Hydrated runtime: Node v24.18.0, pnpm 11.1.2; remote checkout was clean at the exact head.
• The hydration workflow completed successfully after the lease was released, and the lease no longer appears in the AWS Crabbox inventory.
• AutoReview of the annotation fix: clean (0.99 correctness).
• AutoReview of the complete branch: clean (0.98 correctness).
• Exact-head CI 29794733302, CodeQL 29794733284, Dependency Review 29794733317, and Secret Scanning 29794733318 / 29794731579 all succeeded; Socket checks also passed.

No release, deployment, or production action was performed.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The item is closed; no stale verdict was published.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29825152845
• Updated: 2026-07-21T11:14:25.901Z

[steipete]

Landed on main via rebase merge as:

• ea9c964326757f601a9722797544bf8ccc61a675 — Dependabot action updates.
• bb36024e6bf6de6c77fb12480fc705f51ff3ce93 — corrected checkout version annotation.

The exact reviewed head was 14a6e339c122b017b124e3f7e545142141969e40. Validation before merge:

• AutoReview complete branch: clean, no accepted/actionable findings (0.98 correctness).
• Exact-head CI 29794733302, CodeQL 29794733284, Dependency Review 29794733317, Secret Scanning 29794733318 / 29794731579, and both Socket checks: success.
• Self-hosted AWS Crabbox proof: lease cbx_69fdec2d0045 (blue-lobster), command run run_1398121406a1, Actions hydration run 29794815153.
• Runner 2.336.0; Node v24.18.0; pnpm 11.1.2; exact clean checkout at 14a6e339c122.
• actions/checkout@v7.0.1, pnpm/action-setup@v6.0.9, and actions/setup-node@v7 all succeeded in the self-hosted hydration workflow.
• The hydration run completed successfully and the lease was released.

No release, deployment, or production action was performed.