chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0

[dependabot]

Bumps actions/setup-node from 6.4.0 to 7.0.0.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

PR Validation checks failed

Workflow drift

The generated workflows are out of sync with the manifest. Run and commit:

cascade generate-workflow --own-repo --config .github/manifest.yaml --force

cascade verify output

~ .github/workflows/orchestrate.yaml

1 file(s) drifted. Run `cascade generate-workflow` and commit the result.
Error: workflow drift detected
workflow drift detected

Job: PR Gate

Failing step: Verify gated jobs succeeded or were skipped

Annotations:

.github:22 failure:  Process completed with exit code 1.

log excerpt

2026-07-15T02:37:03.6110371Z Contents: read
2026-07-15T02:37:03.6111075Z Metadata: read
2026-07-15T02:37:03.6111634Z ##[endgroup]
2026-07-15T02:37:03.6114175Z Secret source: Actions
2026-07-15T02:37:03.6115668Z Prepare workflow directory
2026-07-15T02:37:03.6439021Z Prepare all required actions
2026-07-15T02:37:03.6532033Z Complete job name: PR Gate
2026-07-15T02:37:03.7398274Z ##[group]Run if [ "true" = "true" ]; then
2026-07-15T02:37:03.7399114Z �[36;1mif [ "true" = "true" ]; then�[0m
2026-07-15T02:37:03.7399849Z �[36;1m  echo "A required check failed or was cancelled."�[0m
2026-07-15T02:37:03.7400716Z �[36;1m  echo "  unit-tests:     success"�[0m
2026-07-15T02:37:03.7401388Z �[36;1m  echo "  lint:           success"�[0m
2026-07-15T02:37:03.7402228Z �[36;1m  echo "  workflow-drift: failure"�[0m
2026-07-15T02:37:03.7402995Z �[36;1m  echo "  docs-build:     skipped"�[0m
2026-07-15T02:37:03.7403641Z �[36;1m  exit 1�[0m
2026-07-15T02:37:03.7404322Z �[36;1mfi�[0m
2026-07-15T02:37:03.7404962Z �[36;1mecho "PR Gate passed (jobs succeeded or were skipped)."�[0m
2026-07-15T02:37:03.7406284Z �[36;1mecho "  unit-tests:     success"�[0m
2026-07-15T02:37:03.7407028Z �[36;1mecho "  lint:           success"�[0m
2026-07-15T02:37:03.7407681Z �[36;1mecho "  workflow-drift: failure"�[0m
2026-07-15T02:37:03.7408398Z �[36;1mecho "  docs-build:     skipped"�[0m
2026-07-15T02:37:03.7991603Z shell: /usr/bin/bash -e {0}
2026-07-15T02:37:03.7992919Z ##[endgroup]
2026-07-15T02:37:03.8211100Z A required check failed or was cancelled.
2026-07-15T02:37:03.8211848Z   unit-tests:     success
2026-07-15T02:37:03.8212438Z   lint:           success
2026-07-15T02:37:03.8213014Z   workflow-drift: failure
2026-07-15T02:37:03.8213639Z   docs-build:     skipped
2026-07-15T02:37:03.8281319Z ##[error]Process completed with exit code 1.
2026-07-15T02:37:03.8499541Z Cleaning up orphan processes

Full job log

[joshua-temple]

Flagging this for scrutiny before merge. The version bump itself looks safe, but the diff carries collateral damage beyond setup-node.

On the version: setup-node 7.0.0 is a major with no documented breaking changes. The release notes list only enhancements (additive cache-primary-key/cache-matched-key outputs, ESM migration), bug fixes, and a dependency bump. The node20 -> node24 runtime move and its runner >= v2.327.1 requirement landed in v6.0.0, not here: action.yml already declares using: node24 at v6.4.0. The cache input description is byte-identical between the two tags, and nothing changes node-version resolution. Our usage (node-version: "22" + cache: npm, docs site needing Node >= 22.12) is unaffected.

On this diff: it touches more than the pin.

• internal/generate/action_pins.yaml is reformatted wholesale from flow style to block style (~61 lines of churn) rather than the one-line setup-node bump.
• .github/workflows/orchestrate.yaml regresses (~59 lines): it drops the Download/Install cascade CLI (from source) steps and the build-cli conditionals, removes tag_only: 'true', flips the prerelease token from CASCADE_STATE_TOKEN back to GITHUB_TOKEN, and rewrites the regenerate header comment to an absolute runner path (/home/runner/work/...).

That looks like the pin auto-fix regenerating in the runner's environment and clobbering, not anything setup-node asked for. Merging as-is would revert the from-source CLI path.

Suggest we not merge this branch. A clean hand-authored bump of the setup-node sha/version in action_pins.yaml plus the three workflow refs would be the safe route. Leaving open for a maintainer call.