From d212f6fcf6cc1e42274e9505f0fa3e2146b68181 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 31 Jul 2026 16:41:04 +0000
Subject: [PATCH] chore(deps): update actions/setup-python action to v7

---
 .github/actions/autofix/action.yml                   |  2 +-
 .github/actions/signature-verify/action.yml          |  2 +-
 .github/workflows/agents-63-issue-intake.yml         |  2 +-
 .github/workflows/agents-auto-label.yml              |  2 +-
 .github/workflows/agents-auto-pilot.yml              |  2 +-
 .github/workflows/agents-capability-check.yml        |  2 +-
 .github/workflows/agents-decompose.yml               |  2 +-
 .github/workflows/agents-dedup.yml                   |  2 +-
 .github/workflows/agents-issue-optimizer.yml         |  2 +-
 .github/workflows/agents-keepalive-loop.yml          |  2 +-
 .github/workflows/agents-verify-to-issue-v2.yml      |  2 +-
 .github/workflows/agents-verify-to-new-pr.yml        |  2 +-
 .github/workflows/agents-weekly-metrics.yml          |  2 +-
 .github/workflows/health-40-repo-selfcheck.yml       |  2 +-
 .github/workflows/health-43-ci-signature-guard.yml   |  2 +-
 .../workflows/health-44-gate-branch-protection.yml   |  2 +-
 .github/workflows/health-52-semgrep.yml              |  2 +-
 .github/workflows/health-68-consumer-sync-drift.yml  |  2 +-
 .../health-69-consumer-sync-shadow-evidence.yml      |  2 +-
 .../workflows/health-70-validate-sync-manifest.yml   |  2 +-
 .github/workflows/health-72-template-sync.yml        |  2 +-
 .../workflows/health-73-template-completeness.yml    |  2 +-
 .github/workflows/health-74-template-drift.yml       |  2 +-
 .github/workflows/health-76-codex-cli-freshness.yml  |  2 +-
 .github/workflows/health-78-backplane-contract.yml   |  2 +-
 .github/workflows/maint-39-test-llm-providers.yml    |  2 +-
 .github/workflows/maint-45-cosmetic-repair.yml       |  2 +-
 .../workflows/maint-47-disable-legacy-workflows.yml  |  2 +-
 .github/workflows/maint-50-tool-version-check.yml    |  2 +-
 .github/workflows/maint-52-sync-dev-versions.yml     |  4 ++--
 .github/workflows/maint-68-sync-consumer-repos.yml   |  6 +++---
 .github/workflows/maint-69-sync-integration-repo.yml |  2 +-
 .../maint-70-fix-integration-formatting.yml          |  2 +-
 .github/workflows/maint-71-auto-fix-integration.yml  |  2 +-
 .github/workflows/maint-74-ledger-base-sync.yml      |  2 +-
 .../workflows/maint-77-model-registry-freshness.yml  |  4 ++--
 .../workflows/maint-79-verifier-corpus-harvest.yml   |  2 +-
 .../maint-80-langsmith-metrics-dashboard.yml         |  2 +-
 .../maint-81-langsmith-fleet-conformance.yml         |  2 +-
 .github/workflows/maint-83-bootstrap-consumer.yml    |  2 +-
 .github/workflows/maint-84-prune-agent-stubs.yml     |  2 +-
 .../workflows/maint-86-model-promotion-prepare.yml   |  2 +-
 .github/workflows/maint-auto-lock-deps.yml           |  2 +-
 .../workflows/maint-auto-update-pypi-versions.yml    |  2 +-
 .github/workflows/maint-metrics-retention.yml        |  2 +-
 .github/workflows/maint-sync-env-from-pyproject.yml  |  2 +-
 .github/workflows/pr-00-gate.yml                     | 12 ++++++------
 .github/workflows/pr-11-ci-smoke.yml                 |  2 +-
 .github/workflows/reusable-10-ci-python.yml          |  8 ++++----
 .github/workflows/reusable-agents-verifier.yml       |  4 ++--
 .github/workflows/reusable-backplane-conformance.yml |  2 +-
 .github/workflows/reusable-claude-run.yml            |  2 +-
 .github/workflows/reusable-codex-run.yml             |  2 +-
 .github/workflows/reusable-cursor-run.yml            |  2 +-
 .github/workflows/reusable-gemini-run.yml            |  2 +-
 .github/workflows/reusable-model-profile-trial.yml   |  2 +-
 .github/workflows/selftest-ci.yml                    |  6 +++---
 .../.github/workflows/agents-80-pr-event-hub.yml     |  2 +-
 .../.github/workflows/agents-auto-label.yml          |  2 +-
 .../.github/workflows/agents-auto-pilot.yml          |  2 +-
 .../.github/workflows/agents-capability-check.yml    |  2 +-
 .../.github/workflows/agents-decompose.yml           |  2 +-
 .../consumer-repo/.github/workflows/agents-dedup.yml |  2 +-
 .../.github/workflows/agents-issue-optimizer.yml     |  2 +-
 .../.github/workflows/agents-verify-to-new-pr.yml    |  2 +-
 .../.github/workflows/agents-weekly-metrics.yml      |  2 +-
 .../.github/workflows/backplane-conformance.yml      |  2 +-
 .../consumer-repo/.github/workflows/pr-00-gate.yml   | 10 +++++-----
 68 files changed, 87 insertions(+), 87 deletions(-)

diff --git a/.github/actions/autofix/action.yml b/.github/actions/autofix/action.yml
index 9ac958c6a..e4e7f0cbd 100644
--- a/.github/actions/autofix/action.yml
+++ b/.github/actions/autofix/action.yml
@@ -19,7 +19,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ inputs['python-version'] }}
     - name: Load tool versions
diff --git a/.github/actions/signature-verify/action.yml b/.github/actions/signature-verify/action.yml
index 08e5af138..96635e960 100644
--- a/.github/actions/signature-verify/action.yml
+++ b/.github/actions/signature-verify/action.yml
@@ -12,7 +12,7 @@ runs:
   using: composite
   steps:
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: '3.14'
     - name: Run signature verification
diff --git a/.github/workflows/agents-63-issue-intake.yml b/.github/workflows/agents-63-issue-intake.yml
index 1456ac15a..ebb2c4d04 100644
--- a/.github/workflows/agents-63-issue-intake.yml
+++ b/.github/workflows/agents-63-issue-intake.yml
@@ -1477,7 +1477,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/agents-auto-label.yml b/.github/workflows/agents-auto-label.yml
index 06ffd7170..5abd07d68 100644
--- a/.github/workflows/agents-auto-label.yml
+++ b/.github/workflows/agents-auto-label.yml
@@ -87,7 +87,7 @@ jobs:
 
       - name: Set up Python
         if: steps.eligibility.outputs.should-run == 'true'
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.14"
 
diff --git a/.github/workflows/agents-auto-pilot.yml b/.github/workflows/agents-auto-pilot.yml
index 409d17526..e2441272b 100644
--- a/.github/workflows/agents-auto-pilot.yml
+++ b/.github/workflows/agents-auto-pilot.yml
@@ -216,7 +216,7 @@ jobs:
       - name: Set up Python
         id: setup-python
         if: steps.check_enabled.outputs.enabled == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/agents-capability-check.yml b/.github/workflows/agents-capability-check.yml
index 65142b06e..91918276a 100644
--- a/.github/workflows/agents-capability-check.yml
+++ b/.github/workflows/agents-capability-check.yml
@@ -44,7 +44,7 @@ jobs:
 
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.14"
 
diff --git a/.github/workflows/agents-decompose.yml b/.github/workflows/agents-decompose.yml
index 5cd86b416..8680e186b 100644
--- a/.github/workflows/agents-decompose.yml
+++ b/.github/workflows/agents-decompose.yml
@@ -42,7 +42,7 @@ jobs:
 
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.14"
 
diff --git a/.github/workflows/agents-dedup.yml b/.github/workflows/agents-dedup.yml
index eb30eac29..13e5368ba 100644
--- a/.github/workflows/agents-dedup.yml
+++ b/.github/workflows/agents-dedup.yml
@@ -48,7 +48,7 @@ jobs:
 
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.14"
 
diff --git a/.github/workflows/agents-issue-optimizer.yml b/.github/workflows/agents-issue-optimizer.yml
index 494d4db04..515669ab2 100644
--- a/.github/workflows/agents-issue-optimizer.yml
+++ b/.github/workflows/agents-issue-optimizer.yml
@@ -122,7 +122,7 @@ jobs:
 
       - name: Set up Python
         if: steps.check.outputs.should_run == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/agents-keepalive-loop.yml b/.github/workflows/agents-keepalive-loop.yml
index fa36a9c8e..e901a1d6d 100644
--- a/.github/workflows/agents-keepalive-loop.yml
+++ b/.github/workflows/agents-keepalive-loop.yml
@@ -936,7 +936,7 @@ jobs:
 
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/agents-verify-to-issue-v2.yml b/.github/workflows/agents-verify-to-issue-v2.yml
index 1aefcee67..890a57f4b 100644
--- a/.github/workflows/agents-verify-to-issue-v2.yml
+++ b/.github/workflows/agents-verify-to-issue-v2.yml
@@ -94,7 +94,7 @@ jobs:
 
       - name: Set up Python
         if: steps.check-merged.outputs.merged == 'true'
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
diff --git a/.github/workflows/agents-verify-to-new-pr.yml b/.github/workflows/agents-verify-to-new-pr.yml
index 76b6d489d..d0682a3f4 100644
--- a/.github/workflows/agents-verify-to-new-pr.yml
+++ b/.github/workflows/agents-verify-to-new-pr.yml
@@ -93,7 +93,7 @@ jobs:
 
       - name: Set up Python
         if: steps.check-merged.outputs.merged == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
diff --git a/.github/workflows/agents-weekly-metrics.yml b/.github/workflows/agents-weekly-metrics.yml
index b1fedc123..afc84da96 100644
--- a/.github/workflows/agents-weekly-metrics.yml
+++ b/.github/workflows/agents-weekly-metrics.yml
@@ -49,7 +49,7 @@ jobs:
 
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.14"
 
diff --git a/.github/workflows/health-40-repo-selfcheck.yml b/.github/workflows/health-40-repo-selfcheck.yml
index 0d86d6838..51d3ae68d 100644
--- a/.github/workflows/health-40-repo-selfcheck.yml
+++ b/.github/workflows/health-40-repo-selfcheck.yml
@@ -96,7 +96,7 @@ jobs:
               github.event.repository.default_branch
             }}
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: ${{ env.HAS_ADMIN_TOKEN == 'true' }}
         with:
           python-version: '3.14'
diff --git a/.github/workflows/health-43-ci-signature-guard.yml b/.github/workflows/health-43-ci-signature-guard.yml
index 7a78eda66..2e8c88e94 100644
--- a/.github/workflows/health-43-ci-signature-guard.yml
+++ b/.github/workflows/health-43-ci-signature-guard.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.14'
       - name: Read signature files
diff --git a/.github/workflows/health-44-gate-branch-protection.yml b/.github/workflows/health-44-gate-branch-protection.yml
index 6ab571b34..2a1a85023 100644
--- a/.github/workflows/health-44-gate-branch-protection.yml
+++ b/.github/workflows/health-44-gate-branch-protection.yml
@@ -182,7 +182,7 @@ jobs:
           DEFAULT_BRANCH: >-
             ${{ steps.default-branch.outputs.name || github.event.repository.default_branch }}
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: steps.fingerprint.outputs.should_run == 'true'
         with:
           python-version: '3.14'
diff --git a/.github/workflows/health-52-semgrep.yml b/.github/workflows/health-52-semgrep.yml
index 5738b2387..d0275a7e0 100644
--- a/.github/workflows/health-52-semgrep.yml
+++ b/.github/workflows/health-52-semgrep.yml
@@ -53,7 +53,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/health-68-consumer-sync-drift.yml b/.github/workflows/health-68-consumer-sync-drift.yml
index f53233737..b8b15df48 100644
--- a/.github/workflows/health-68-consumer-sync-drift.yml
+++ b/.github/workflows/health-68-consumer-sync-drift.yml
@@ -46,7 +46,7 @@ jobs:
 
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/health-69-consumer-sync-shadow-evidence.yml b/.github/workflows/health-69-consumer-sync-shadow-evidence.yml
index 61aa0a05b..dc49c86c4 100644
--- a/.github/workflows/health-69-consumer-sync-shadow-evidence.yml
+++ b/.github/workflows/health-69-consumer-sync-shadow-evidence.yml
@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/health-70-validate-sync-manifest.yml b/.github/workflows/health-70-validate-sync-manifest.yml
index 345748471..3e4c65fcf 100644
--- a/.github/workflows/health-70-validate-sync-manifest.yml
+++ b/.github/workflows/health-70-validate-sync-manifest.yml
@@ -54,7 +54,7 @@ jobs:
 
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
       - name: Install dependencies
diff --git a/.github/workflows/health-72-template-sync.yml b/.github/workflows/health-72-template-sync.yml
index 46262b38e..1705982af 100644
--- a/.github/workflows/health-72-template-sync.yml
+++ b/.github/workflows/health-72-template-sync.yml
@@ -52,7 +52,7 @@ jobs:
           ref: ${{ github.head_ref || github.ref }}
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/health-73-template-completeness.yml b/.github/workflows/health-73-template-completeness.yml
index 7967acdd0..bc8d19506 100644
--- a/.github/workflows/health-73-template-completeness.yml
+++ b/.github/workflows/health-73-template-completeness.yml
@@ -35,7 +35,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/health-74-template-drift.yml b/.github/workflows/health-74-template-drift.yml
index 922d6c361..b6a9299c3 100644
--- a/.github/workflows/health-74-template-drift.yml
+++ b/.github/workflows/health-74-template-drift.yml
@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/health-76-codex-cli-freshness.yml b/.github/workflows/health-76-codex-cli-freshness.yml
index 707ff455e..13bd1d384 100644
--- a/.github/workflows/health-76-codex-cli-freshness.yml
+++ b/.github/workflows/health-76-codex-cli-freshness.yml
@@ -28,7 +28,7 @@ jobs:
           node-version: "24"
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.14"
 
diff --git a/.github/workflows/health-78-backplane-contract.yml b/.github/workflows/health-78-backplane-contract.yml
index 2d51b3fcf..aa83a7a87 100644
--- a/.github/workflows/health-78-backplane-contract.yml
+++ b/.github/workflows/health-78-backplane-contract.yml
@@ -71,7 +71,7 @@ jobs:
           github_token: ${{ github.token }}
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-39-test-llm-providers.yml b/.github/workflows/maint-39-test-llm-providers.yml
index d25c3b750..fcc29ed83 100644
--- a/.github/workflows/maint-39-test-llm-providers.yml
+++ b/.github/workflows/maint-39-test-llm-providers.yml
@@ -29,7 +29,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-45-cosmetic-repair.yml b/.github/workflows/maint-45-cosmetic-repair.yml
index f05bea67b..d6430f2df 100644
--- a/.github/workflows/maint-45-cosmetic-repair.yml
+++ b/.github/workflows/maint-45-cosmetic-repair.yml
@@ -42,7 +42,7 @@ jobs:
           ref: ${{ env.BASE_BRANCH }}
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
diff --git a/.github/workflows/maint-47-disable-legacy-workflows.yml b/.github/workflows/maint-47-disable-legacy-workflows.yml
index 3e24c27da..f78e92138 100644
--- a/.github/workflows/maint-47-disable-legacy-workflows.yml
+++ b/.github/workflows/maint-47-disable-legacy-workflows.yml
@@ -29,7 +29,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.x'
 
diff --git a/.github/workflows/maint-50-tool-version-check.yml b/.github/workflows/maint-50-tool-version-check.yml
index f44cf251a..ebac697ab 100644
--- a/.github/workflows/maint-50-tool-version-check.yml
+++ b/.github/workflows/maint-50-tool-version-check.yml
@@ -36,7 +36,7 @@ jobs:
 
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-52-sync-dev-versions.yml b/.github/workflows/maint-52-sync-dev-versions.yml
index a6d3f8d64..688df830a 100644
--- a/.github/workflows/maint-52-sync-dev-versions.yml
+++ b/.github/workflows/maint-52-sync-dev-versions.yml
@@ -57,7 +57,7 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
@@ -154,7 +154,7 @@ jobs:
           name: sync-script
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-68-sync-consumer-repos.yml b/.github/workflows/maint-68-sync-consumer-repos.yml
index 78a8626cc..55d7afe6d 100644
--- a/.github/workflows/maint-68-sync-consumer-repos.yml
+++ b/.github/workflows/maint-68-sync-consumer-repos.yml
@@ -93,7 +93,7 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
@@ -146,7 +146,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
@@ -256,7 +256,7 @@ jobs:
           name: sync-manifest
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-69-sync-integration-repo.yml b/.github/workflows/maint-69-sync-integration-repo.yml
index 2599b4c55..4be9d0374 100644
--- a/.github/workflows/maint-69-sync-integration-repo.yml
+++ b/.github/workflows/maint-69-sync-integration-repo.yml
@@ -78,7 +78,7 @@ jobs:
 
       - name: Set up Python
         if: steps.token.outputs.token_available == 'true'
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-70-fix-integration-formatting.yml b/.github/workflows/maint-70-fix-integration-formatting.yml
index bf33bb26f..5de77b2de 100644
--- a/.github/workflows/maint-70-fix-integration-formatting.yml
+++ b/.github/workflows/maint-70-fix-integration-formatting.yml
@@ -78,7 +78,7 @@ jobs:
           path: integration-tests
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-71-auto-fix-integration.yml b/.github/workflows/maint-71-auto-fix-integration.yml
index 690fae3e5..9725d8081 100644
--- a/.github/workflows/maint-71-auto-fix-integration.yml
+++ b/.github/workflows/maint-71-auto-fix-integration.yml
@@ -170,7 +170,7 @@ jobs:
 
       - name: Set up Python
         if: steps.check_status.outputs.should_fix == 'true' && steps.integration_token.outputs.token_available == 'true'
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-74-ledger-base-sync.yml b/.github/workflows/maint-74-ledger-base-sync.yml
index c7db9621f..44f1f3460 100644
--- a/.github/workflows/maint-74-ledger-base-sync.yml
+++ b/.github/workflows/maint-74-ledger-base-sync.yml
@@ -24,7 +24,7 @@ jobs:
         uses: ./.github/actions/setup-api-client
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-77-model-registry-freshness.yml b/.github/workflows/maint-77-model-registry-freshness.yml
index b35027072..838723124 100644
--- a/.github/workflows/maint-77-model-registry-freshness.yml
+++ b/.github/workflows/maint-77-model-registry-freshness.yml
@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
@@ -133,7 +133,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-79-verifier-corpus-harvest.yml b/.github/workflows/maint-79-verifier-corpus-harvest.yml
index cb2e896a4..c99b51452 100644
--- a/.github/workflows/maint-79-verifier-corpus-harvest.yml
+++ b/.github/workflows/maint-79-verifier-corpus-harvest.yml
@@ -38,7 +38,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.14"
       - name: Harvest realized-outcome cases
diff --git a/.github/workflows/maint-80-langsmith-metrics-dashboard.yml b/.github/workflows/maint-80-langsmith-metrics-dashboard.yml
index 769751061..7f9079799 100644
--- a/.github/workflows/maint-80-langsmith-metrics-dashboard.yml
+++ b/.github/workflows/maint-80-langsmith-metrics-dashboard.yml
@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-81-langsmith-fleet-conformance.yml b/.github/workflows/maint-81-langsmith-fleet-conformance.yml
index b46fa9661..2b31c1114 100644
--- a/.github/workflows/maint-81-langsmith-fleet-conformance.yml
+++ b/.github/workflows/maint-81-langsmith-fleet-conformance.yml
@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-83-bootstrap-consumer.yml b/.github/workflows/maint-83-bootstrap-consumer.yml
index be7ac5c43..b3dc067a1 100644
--- a/.github/workflows/maint-83-bootstrap-consumer.yml
+++ b/.github/workflows/maint-83-bootstrap-consumer.yml
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-84-prune-agent-stubs.yml b/.github/workflows/maint-84-prune-agent-stubs.yml
index 23cb7d457..a80d54e61 100644
--- a/.github/workflows/maint-84-prune-agent-stubs.yml
+++ b/.github/workflows/maint-84-prune-agent-stubs.yml
@@ -31,7 +31,7 @@ jobs:
           token: ${{ secrets.OWNER_PR_PAT || github.token }}
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.14"
 
diff --git a/.github/workflows/maint-86-model-promotion-prepare.yml b/.github/workflows/maint-86-model-promotion-prepare.yml
index 188ed30c5..394c0f05b 100644
--- a/.github/workflows/maint-86-model-promotion-prepare.yml
+++ b/.github/workflows/maint-86-model-promotion-prepare.yml
@@ -39,7 +39,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.14"
       - name: Prepare promotion/rollback
diff --git a/.github/workflows/maint-auto-lock-deps.yml b/.github/workflows/maint-auto-lock-deps.yml
index 74cc6e9c5..70cc31c4f 100644
--- a/.github/workflows/maint-auto-lock-deps.yml
+++ b/.github/workflows/maint-auto-lock-deps.yml
@@ -46,7 +46,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-auto-update-pypi-versions.yml b/.github/workflows/maint-auto-update-pypi-versions.yml
index 539808f9c..2db7b8908 100644
--- a/.github/workflows/maint-auto-update-pypi-versions.yml
+++ b/.github/workflows/maint-auto-update-pypi-versions.yml
@@ -38,7 +38,7 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/maint-metrics-retention.yml b/.github/workflows/maint-metrics-retention.yml
index 15480b751..c6d7bb0f1 100644
--- a/.github/workflows/maint-metrics-retention.yml
+++ b/.github/workflows/maint-metrics-retention.yml
@@ -31,7 +31,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.14"
 
diff --git a/.github/workflows/maint-sync-env-from-pyproject.yml b/.github/workflows/maint-sync-env-from-pyproject.yml
index 40f6a477a..7a0e83b1c 100644
--- a/.github/workflows/maint-sync-env-from-pyproject.yml
+++ b/.github/workflows/maint-sync-env-from-pyproject.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/pr-00-gate.yml b/.github/workflows/pr-00-gate.yml
index ab7a9c4b0..61fcc7515 100644
--- a/.github/workflows/pr-00-gate.yml
+++ b/.github/workflows/pr-00-gate.yml
@@ -200,7 +200,7 @@ jobs:
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.14'
       - name: Run reusable workflow docs guards
@@ -258,7 +258,7 @@ jobs:
           node-version: '24'
       - run: node --test .github/scripts/__tests__/*.test.js
         if: ${{ steps.script_tests.outputs.node_tests == 'true' }}
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: ${{ steps.script_tests.outputs.python_tests == 'true' }}
         with:
           python-version: '3.14'
@@ -285,7 +285,7 @@ jobs:
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.14'
           cache: pip
@@ -317,7 +317,7 @@ jobs:
           git remote add upstream "$upstream"
           git fetch --no-tags upstream \
             "refs/heads/${base_ref}:refs/remotes/upstream/${base_ref}"
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: ${{ hashFiles('scripts/check_issue_consistency.py') != '' }}
         with:
           python-version: '3.14'
@@ -360,7 +360,7 @@ jobs:
           git remote add upstream "$upstream"
           git fetch --no-tags upstream \
             "refs/heads/${base_ref}:refs/remotes/upstream/${base_ref}"
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.14'
       - name: Install test-quality dependencies
@@ -443,7 +443,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/pr-11-ci-smoke.yml b/.github/workflows/pr-11-ci-smoke.yml
index 6dc4389b9..b5457b702 100644
--- a/.github/workflows/pr-11-ci-smoke.yml
+++ b/.github/workflows/pr-11-ci-smoke.yml
@@ -27,7 +27,7 @@ jobs:
           fetch-depth: 1  # Shallow clone for faster checkout
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
           cache: pip
diff --git a/.github/workflows/reusable-10-ci-python.yml b/.github/workflows/reusable-10-ci-python.yml
index 0efacacfa..5b937f68a 100644
--- a/.github/workflows/reusable-10-ci-python.yml
+++ b/.github/workflows/reusable-10-ci-python.yml
@@ -445,7 +445,7 @@ jobs:
 
       # Install block inlined directly (reusable workflows can't use ./ local composites in consumer context)
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: >-
             ${{
@@ -847,7 +847,7 @@ jobs:
 
       # Install block inlined directly (reusable workflows can't use ./ local composites in consumer context)
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: >-
             ${{
@@ -1230,7 +1230,7 @@ jobs:
 
       # Install block inlined directly (reusable workflows can't use ./ local composites in consumer context)
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: >-
             ${{
@@ -1572,7 +1572,7 @@ jobs:
 
       # Install block inlined directly (reusable workflows can't use ./ local composites in consumer context)
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/reusable-agents-verifier.yml b/.github/workflows/reusable-agents-verifier.yml
index fb6188182..2b7a90e74 100644
--- a/.github/workflows/reusable-agents-verifier.yml
+++ b/.github/workflows/reusable-agents-verifier.yml
@@ -658,7 +658,7 @@ jobs:
             steps.context.outputs.should_run == 'true' &&
             inputs.mode == 'evaluate'
           }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
@@ -967,7 +967,7 @@ jobs:
             steps.context.outputs.should_run == 'true' &&
             inputs.mode == 'compare'
           }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/reusable-backplane-conformance.yml b/.github/workflows/reusable-backplane-conformance.yml
index 989adfc71..053a11f2d 100644
--- a/.github/workflows/reusable-backplane-conformance.yml
+++ b/.github/workflows/reusable-backplane-conformance.yml
@@ -99,7 +99,7 @@ jobs:
           path: .backplane-contract
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/reusable-claude-run.yml b/.github/workflows/reusable-claude-run.yml
index d487b7645..25b635ef6 100644
--- a/.github/workflows/reusable-claude-run.yml
+++ b/.github/workflows/reusable-claude-run.yml
@@ -397,7 +397,7 @@ jobs:
           fi
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
           cache: pip
diff --git a/.github/workflows/reusable-codex-run.yml b/.github/workflows/reusable-codex-run.yml
index 2816d96b7..a514205b2 100644
--- a/.github/workflows/reusable-codex-run.yml
+++ b/.github/workflows/reusable-codex-run.yml
@@ -452,7 +452,7 @@ jobs:
 
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
           cache: pip
diff --git a/.github/workflows/reusable-cursor-run.yml b/.github/workflows/reusable-cursor-run.yml
index 4a181d4d6..cc105e947 100644
--- a/.github/workflows/reusable-cursor-run.yml
+++ b/.github/workflows/reusable-cursor-run.yml
@@ -414,7 +414,7 @@ jobs:
           fi
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
           cache: pip
diff --git a/.github/workflows/reusable-gemini-run.yml b/.github/workflows/reusable-gemini-run.yml
index 7865ebbf6..2bd352c81 100644
--- a/.github/workflows/reusable-gemini-run.yml
+++ b/.github/workflows/reusable-gemini-run.yml
@@ -422,7 +422,7 @@ jobs:
           fi
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
           cache: pip
diff --git a/.github/workflows/reusable-model-profile-trial.yml b/.github/workflows/reusable-model-profile-trial.yml
index 4fea60a6b..5f6dd8709 100644
--- a/.github/workflows/reusable-model-profile-trial.yml
+++ b/.github/workflows/reusable-model-profile-trial.yml
@@ -113,7 +113,7 @@ jobs:
           node-version: "24"
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
diff --git a/.github/workflows/selftest-ci.yml b/.github/workflows/selftest-ci.yml
index 9b4ff60cf..90146fa43 100644
--- a/.github/workflows/selftest-ci.yml
+++ b/.github/workflows/selftest-ci.yml
@@ -64,7 +64,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
           cache: pip
@@ -104,7 +104,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
           cache: pip
@@ -126,7 +126,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
           cache: pip
diff --git a/templates/consumer-repo/.github/workflows/agents-80-pr-event-hub.yml b/templates/consumer-repo/.github/workflows/agents-80-pr-event-hub.yml
index d9dd605f7..085c381eb 100644
--- a/templates/consumer-repo/.github/workflows/agents-80-pr-event-hub.yml
+++ b/templates/consumer-repo/.github/workflows/agents-80-pr-event-hub.yml
@@ -326,7 +326,7 @@ jobs:
 
       - name: Set up Python
         if: steps.check-merged.outputs.merged == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
diff --git a/templates/consumer-repo/.github/workflows/agents-auto-label.yml b/templates/consumer-repo/.github/workflows/agents-auto-label.yml
index 843572fa6..d2f45207c 100644
--- a/templates/consumer-repo/.github/workflows/agents-auto-label.yml
+++ b/templates/consumer-repo/.github/workflows/agents-auto-label.yml
@@ -73,7 +73,7 @@ jobs:
 
       - name: Set up Python
         if: steps.eligibility.outputs.should-run == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
diff --git a/templates/consumer-repo/.github/workflows/agents-auto-pilot.yml b/templates/consumer-repo/.github/workflows/agents-auto-pilot.yml
index 409d17526..e2441272b 100644
--- a/templates/consumer-repo/.github/workflows/agents-auto-pilot.yml
+++ b/templates/consumer-repo/.github/workflows/agents-auto-pilot.yml
@@ -216,7 +216,7 @@ jobs:
       - name: Set up Python
         id: setup-python
         if: steps.check_enabled.outputs.enabled == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'
 
diff --git a/templates/consumer-repo/.github/workflows/agents-capability-check.yml b/templates/consumer-repo/.github/workflows/agents-capability-check.yml
index 353e1cf7d..2e5a3fd59 100644
--- a/templates/consumer-repo/.github/workflows/agents-capability-check.yml
+++ b/templates/consumer-repo/.github/workflows/agents-capability-check.yml
@@ -34,7 +34,7 @@ jobs:
           github_token: ${{ github.token }}
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
diff --git a/templates/consumer-repo/.github/workflows/agents-decompose.yml b/templates/consumer-repo/.github/workflows/agents-decompose.yml
index 15f892685..0d5eccc75 100644
--- a/templates/consumer-repo/.github/workflows/agents-decompose.yml
+++ b/templates/consumer-repo/.github/workflows/agents-decompose.yml
@@ -29,7 +29,7 @@ jobs:
           github_token: ${{ github.token }}
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
diff --git a/templates/consumer-repo/.github/workflows/agents-dedup.yml b/templates/consumer-repo/.github/workflows/agents-dedup.yml
index 7c5889b69..652f82200 100644
--- a/templates/consumer-repo/.github/workflows/agents-dedup.yml
+++ b/templates/consumer-repo/.github/workflows/agents-dedup.yml
@@ -38,7 +38,7 @@ jobs:
           github_token: ${{ github.token }}
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
diff --git a/templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml b/templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml
index bcd91e5c9..95650693d 100644
--- a/templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml
+++ b/templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml
@@ -139,7 +139,7 @@ jobs:
 
       - name: Set up Python
         if: steps.check.outputs.should_run == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'
 
diff --git a/templates/consumer-repo/.github/workflows/agents-verify-to-new-pr.yml b/templates/consumer-repo/.github/workflows/agents-verify-to-new-pr.yml
index 76b6d489d..d0682a3f4 100644
--- a/templates/consumer-repo/.github/workflows/agents-verify-to-new-pr.yml
+++ b/templates/consumer-repo/.github/workflows/agents-verify-to-new-pr.yml
@@ -93,7 +93,7 @@ jobs:
 
       - name: Set up Python
         if: steps.check-merged.outputs.merged == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
diff --git a/templates/consumer-repo/.github/workflows/agents-weekly-metrics.yml b/templates/consumer-repo/.github/workflows/agents-weekly-metrics.yml
index ed8b1c500..a069074bd 100644
--- a/templates/consumer-repo/.github/workflows/agents-weekly-metrics.yml
+++ b/templates/consumer-repo/.github/workflows/agents-weekly-metrics.yml
@@ -58,7 +58,7 @@ jobs:
 
 
       - name: Setup Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
diff --git a/templates/consumer-repo/.github/workflows/backplane-conformance.yml b/templates/consumer-repo/.github/workflows/backplane-conformance.yml
index 587b57eef..3898ec1e0 100644
--- a/templates/consumer-repo/.github/workflows/backplane-conformance.yml
+++ b/templates/consumer-repo/.github/workflows/backplane-conformance.yml
@@ -29,7 +29,7 @@ jobs:
       manifest: artifacts/reference/manifest.json
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'
       - run: pip install -e .
diff --git a/templates/consumer-repo/.github/workflows/pr-00-gate.yml b/templates/consumer-repo/.github/workflows/pr-00-gate.yml
index 9c74bf389..2323887ac 100644
--- a/templates/consumer-repo/.github/workflows/pr-00-gate.yml
+++ b/templates/consumer-repo/.github/workflows/pr-00-gate.yml
@@ -210,7 +210,7 @@ jobs:
           persist-credentials: false
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'
       - name: Run reusable workflow docs guards
@@ -269,7 +269,7 @@ jobs:
           node-version: '24'
       - run: node --test .github/scripts/__tests__/*.test.js
         if: ${{ steps.script_tests.outputs.node_tests == 'true' }}
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         if: ${{ steps.script_tests.outputs.python_tests == 'true' }}
         with:
           python-version: '3.14'
@@ -298,7 +298,7 @@ jobs:
           git remote add upstream "$upstream"
           git fetch --no-tags upstream \
             "refs/heads/${base_ref}:refs/remotes/upstream/${base_ref}"
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         if: ${{ hashFiles('scripts/check_issue_consistency.py') != '' }}
         with:
           python-version: '3.14'
@@ -341,7 +341,7 @@ jobs:
           git remote add upstream "$upstream"
           git fetch --no-tags upstream \
             "refs/heads/${base_ref}:refs/remotes/upstream/${base_ref}"
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'
       - name: Install test-quality dependencies
@@ -425,7 +425,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'