ci: correct action pin version comments and align verified-commit github-script

[allxsmith]

Pull Request

Description

Two small follow-ups to the github-actions group bump (#392):

• Pin comments corrected (15 lines, cosmetic): dependabot bumped actions/setup-node to v7.0.0 and actions/dependency-review-action to v5.0.0 but left their # v6 / # v4 trailing comments untouched. Since the repo's convention is SHA pins with human-readable # vN comments, stale comments actively mislead review. All 14 setup-node call sites now read # v7; dependency-review reads # v5.

• verified-commit composite action aligned (1 line, real change): dependabot's github-actions ecosystem only scans .github/workflows/, so the actions/github-script pin inside .github/actions/verified-commit/action.yml was left on v7 while chore(deps): bump the github-actions group across 1 directory with 6 updates #392 moved the three workflow call sites to v9.0.0. Aligned it to the same SHA (3a2844b7…), which I verified resolves to upstream tag v9.0.0.

• bulma-ui (@allxsmith/bestax-bulma)

• create-bestax (create-bestax)

• docs (@allxsmith/bestax-docs)

• Other (please specify): .github/ workflows + composite action only

Related Issue(s)

Refs #392 — follow-up.

Type of Change

• Build tooling

Checklist

• I have performed a self-review of my code

No package code touched — no tests, docs, or stories owed.

Additional Context

All six #392 SHA↔tag mappings were verified against upstream (git ls-remote) before it was merged; this PR only brings the comments and the dependabot-blind composite action in line. Note for the future: a second github-actions directory entry in dependabot.yml could cover .github/actions/verified-commit, but with a single composite action the manual alignment here seemed lighter than more config.

🤖 Generated with Claude Code

https://claude.ai/code/session_012szNNjysHff51G26SSTWeA

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Updated automated workflows to use the latest Node.js setup action.
  • Updated dependency review automation to its latest major version.
  • Updated commit verification automation for improved compatibility.
  • Existing Node.js version, caching, and workflow behavior remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 854deb5b-07c5-46dd-abab-5f31a240d2cf

📥 Commits

Reviewing files that changed from the base of the PR and between 0c48b74 and d0b2c68.

📒 Files selected for processing (13)

• .github/actions/verified-commit/action.yml
• .github/workflows/auto-close-duplicates.yml
• .github/workflows/bestaxbot-reply.yml
• .github/workflows/ci.yml
• .github/workflows/claude-implement.yml
• .github/workflows/claude-pr-loop.yml
• .github/workflows/claude-review.yml
• .github/workflows/claude.yml
• .github/workflows/dependency-review.yml
• .github/workflows/deploy.yml
• .github/workflows/story-screenshots.yml
• .github/workflows/test-deploy.yml
• .github/workflows/visual-regression.yml

---

Walkthrough

This PR updates GitHub Actions references across workflows and a composite action: actions/setup-node moves to v7, actions/github-script to v9, and actions/dependency-review-action to v5. Existing workflow inputs and execution logic remain unchanged.

Changes

GitHub Actions dependency pins

Layer / File(s)	Summary
Upgrade setup-node references .github/workflows/*.yml	Node.js setup steps across CI, deployment, automation, Claude, screenshot, and visual-regression workflows are repinned from v6 to v7.
Update other action pins .github/actions/verified-commit/action.yml, .github/workflows/dependency-review.yml	The verified-commit action uses actions/github-script v9, and dependency review uses actions/dependency-review-action v5.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• allxsmith/bestax#291: Introduces the auto-close-duplicates workflow updated here.
• allxsmith/bestax#318: Also updates GitHub Actions pins, including setup-node and dependency review.

Suggested labels: dependencies

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately names the two main CI follow-ups: action pin comment corrections and verified-commit github-script alignment.
Description check	✅ Passed	The description follows the template and includes summary, affected package selection, related issue, type of change, checklist, and context.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/dependency-pr-review-5utc7p

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Preview Deployment

Preview URL: https://e0fc1166.bestax.pages.dev

[github-actions]

🎉 This PR is included in version 3.7.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[bestax-release-bot]

🎉 This PR is included in version 2.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[bestax-release-bot]

🎉 This PR is included in version 5.8.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[bestax-release-bot]

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀