chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0

[dependabot]

Bumps actions/setup-python from 6.3.0 to 7.0.0.

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-python#1330
• Pin SHA commits and update docs with latest versions by @​HarithaVattikuti in actions/setup-python#1338
• Remove the pip-install input by @​gowridurgad in actions/setup-python#1336

Bug Fix

• Fix to Classify stderr warning messages as warnings instead of errors in annotations by @​lmvysakh in actions/setup-python#1335
• Validate and retry manifest fetch to prevent silent failures by @​priyagupta108 in actions/setup-python#1332

Dependency Upgrade

• Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @​dependabot in actions/setup-python#1328
• Remove EOL Python versions and Bumps numpy text fixture by @​priya-kinthali in actions/setup-python#1333
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-python#1337

New Contributors

• @​lmvysakh made their first contribution in actions/setup-python#1335
• @​philip-gai made their first contribution in actions/setup-python#1337

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

• 5fda3b9 Pin SHA commits and update docs with latest versions (#1338)
• 4ab7e95 Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-0
• 0f3a009 Remove the pip-install input (#1336)
• f8cf429 Migrate to ESM and upgrade dependencies (#1330)
• 54baeea Validate and retry manifest fetch to prevent silent failures (#1332)
• c709277 Annotation code fix (#1335)
• 6849080 remove EOL Python versions and Bumps numpy text fixture (#1333)
• 0903b46 Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Final PR diff is limited to the exact setup-python v7 SHA/comment and its matching workflow pin-contract assertion. The dependency audit is documented on the PR and the focused contract test passed 2/2. This internal CI dependency update has no user-facing documentation impact.
• Agent: Codex Desktop

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 1ad285f in the dependabot/github_ac... branch remains at 96%, unchanged from commit 2f6298e in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 1ad285f in the dependabot/github_ac... branch remains at 80%, unchanged from commit 2f6298e in the main branch.

Show a code coverage summary of the most impacted files.

File	main 2f6298e	dependabot/github_ac... 1ad285f	+/-
src/lib/inferen...del-registry.ts	100%	97%	-3%
src/lib/adapter.../auth-config.ts	96%	96%	0%
src/lib/inferen...lama-version.ts	100%	100%	0%
src/lib/onboard...der-metadata.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/inferen...time-context.ts	87%	93%	+6%

---

_{Updated July 25, 2026 03:09 UTC}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 1 more warning, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[prekshivyas]

Maintainer dependency audit

Reviewed final PR head 1ad285f61995a05f287b87db70e4c1224953d18e against base 2f6298ee165f4821f635be962fedff5e165701ee and the complete actions/setup-python migration from v6.3.0 to v7.0.0.

Identity and release boundary

• One adjacent release range, eight upstream commits: v6.3.0 (ece7cb06caefa5fff74198d8649806c4678c61a1) → v7.0.0 (5fda3b95a4ea91299a34e894583c3862153e4b97).
• Both endpoints are published, non-prerelease GitHub releases; the commits are GitHub-verified, ancestry is linear, and the moving v7 tag currently resolves to the pinned v7.0.0 commit.
• NemoClaw consumes the exact commit SHA. The target tree is 9b13ee70cbe700418bb31fc58cd04a4b6dc98184; action.yml dispatches the committed dist/setup/index.js and dist/cache-save/index.js bundles.
• Upstream license is MIT. The target includes 50 generated npm license records. There are no release assets or published SBOM/provenance artifacts, so the verified commit/tree and exact SHA pin remain the available supply-chain identity.

Contract audit

• The only NemoClaw consumer is .github/workflows/platform-vitest-main.yaml. It runs only on main pushes or maintainer dispatch, with contents: read and checkout credentials disabled.
• NemoClaw supplies exact Python 3.14, cache: pip, and the repository-owned literal ci/platform-vitest-macos-requirements.lock. It does not use the removed pip-install input.
• Node 24, action entrypoints, outputs, Python selection, and the used cache inputs are unchanged. The ESM conversion changes packaging, not the consumed interface.
• Manifest validation/retry now fails closed on empty or truncated manifests; stderr beginning with WARNING: is emitted as a warning. NemoClaw does not parse annotations or setup-python logs.
• The cache dependency upgrades preserve the consumed pip-cache contract. Cache correctness is not an installation trust boundary here: the following pip install uses --require-hashes and the pinned requirements lock.

Advisory review

OSV and the GitHub Advisory Database currently report:

• brace-expansion@1.1.15 and 5.0.6: GHSA-3jxr-9vmj-r5cp and GHSA-mh99-v99m-4gvg.
• fast-xml-parser@5.9.3: GHSA-8r6m-32jq-jx6q.

The prior v6.3.0 bundle already contains an affected brace-expansion version. The target adds another affected brace-expansion line and the affected XML parser. In this NemoClaw workflow, brace expansion receives the fixed repository-owned cache path; the XML parser is reachable only while parsing TLS responses from the GitHub/Azure cache service. No PR-controlled glob or XML input reaches either vulnerable operation, and this workflow is not PR-triggered. I classify these as low-exposure upstream watch items, not an exploitable downstream regression. Upgrade to the first patched setup-python v7 release when upstream publishes one.

Verification and disposition

• DEP-1 removed pip-install: no impact, unused downstream.
• DEP-2 ESM and toolkit dependency majors: no interface migration, covered by upstream source/tests and unchanged downstream inputs.
• DEP-3 manifest retry/validation and warning annotations: compatible behavior improvement.
• DEP-4 vulnerable transitives: documented/watch, no repository-controlled exploit path in this consumer.
• DEP-5 missing upstream SBOM/attestation: documented provenance gap, mitigated by the verified immutable commit/tree; no separate release artifact is consumed.

Focused downstream contract: npx vitest run --project integration test/platform-vitest-main-workflow.test.ts → 2 tests passed. The missing exact-pin assertion was updated in ea8dbdd0b.

[prekshivyas]

Reviewed the setup-python v7 major-version migration, exact SHA pin, downstream workflow contract, and focused pin-contract test. The dependency audit is recorded on the PR; all current CI, E2E coordination, automated advisors, CodeRabbit, conflict, and contributor-compliance gates pass at head 1ad285f against base 2f6298e.