From 4328d9376e3a9ef8e90b43e0926d2d8638ecff30 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 18 Jul 2026 16:21:16 +0000 Subject: [PATCH 1/2] chore(actions): bump actions/setup-node Bumps the github-actions group with 1 update in the / directory: [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/setup-node` from 6 to 7 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/aeon.yml | 2 +- .github/workflows/messages.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/aeon.yml b/.github/workflows/aeon.yml index 92b8405c3b..79f37f97bd 100644 --- a/.github/workflows/aeon.yml +++ b/.github/workflows/aeon.yml @@ -142,7 +142,7 @@ jobs: - name: Setup Node.js if: steps.work.outputs.mode != '' - uses: actions/setup-node@v6 + uses: actions/setup-node@v7 with: node-version: '22' diff --git a/.github/workflows/messages.yml b/.github/workflows/messages.yml index 5e56b68ad3..d61d65fd64 100644 --- a/.github/workflows/messages.yml +++ b/.github/workflows/messages.yml @@ -368,7 +368,7 @@ jobs: - name: Setup Node.js if: steps.msg.outputs.source != '' - uses: actions/setup-node@v6 + uses: actions/setup-node@v7 with: node-version: '22' From 3b5b7fdcf87c09c7c9d6015914a167c9a87c28a2 Mon Sep 17 00:00:00 2001 From: "@aaronjmars" <61592645+aaronjmars@users.noreply.github.com> Date: Mon, 20 Jul 2026 10:24:24 -0400 Subject: [PATCH 2/2] chore: refresh supply-chain convention comment for setup-node v7 The comment documenting this repo's pinned majors still said setup-node@v6, which this PR makes stale. The convention itself (pin to current major) is unchanged. Co-Authored-By: Claude --- .github/workflows/aeon.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/aeon.yml b/.github/workflows/aeon.yml index 79f37f97bd..390910f14a 100644 --- a/.github/workflows/aeon.yml +++ b/.github/workflows/aeon.yml @@ -835,7 +835,7 @@ jobs: - name: Attest skill execution if: steps.attest-gate.outputs.attest == 'true' # Pinned to the current major per this repo's supply-chain convention - # (checkout@v7, setup-node@v6). Latest major confirmed at: + # (checkout@v7, setup-node@v7). Latest major confirmed at: # https://github.com/actions/attest-build-provenance/releases # Multi-subject: one attestation over both run-scoped artifacts (the output # snapshot and its manifest). Both paths are ${GITHUB_RUN_ID}-unique, so the