[thomas-lg]

Takes over two Dependabot PRs that kept losing races with a moving main (#97, #94 — both one-line SHA bumps that re-conflicted after every merge), and folds in three fixes that surfaced while merging the rest of today's batch.

Action bumps

• actions/setup-node 6.4.0 → 7.0.0 (both ci.yml jobs) — takes over deps: bump actions/setup-node from 6.4.0 to 7.0.0 #97
• docker/login-action 3.7.0 → 4.6.0 (release.yml) — takes over deps: bump docker/login-action from 3.7.0 to 4.6.0 #94

login-action isn't exercised by PR CI, only by release.yml, which runs on workflow_run after CI succeeds on main. So it gets validated on merge — I'll confirm that run goes green rather than assume it.

Version-comment drift

Dependabot updates the SHA but reuses the old comment, so labels had gone stale:

• codeql-action/upload-sarif shared the v4 SHA with init/analyze but was still labelled # v3.
• One actions/checkout SHA carried both # v7 and # v7.0.1.

Both are cosmetic, but the comment is the only human-readable version in a SHA-pinned workflow, so a wrong one actively misleads.

Ignore TypeScript minor + major

@angular/build@22 declares peer typescript ">=6.0 <6.1", so #91 (TS 7) failed npm ci with ERESOLVE — and 6.1 would fail too, not just 7.x. TypeScript here is driven by Angular and should move with an Angular major, not on its own. 6.0.x patches still flow.

refresh-lockfiles.ps1 — two bugs, both found by running it

1. It hardcoded the SDK digest, which deps: bump dotnet/sdk from ed034a8 to e1ffd2a #87 (dotnet/sdk digest bump) had already made stale within an hour of the script landing. It now reads the digest out of the Dockerfile, so the drift can't recur — the script had a copy of exactly the kind of duplicated pin it exists to protect.
2. It died on first use. Windows PowerShell 5.1 wraps each line a native command writes to stderr in an ErrorRecord; with $ErrorActionPreference = 'Stop', docker's Unable to find image ... locally pull message was fatal. That meant the script worked for me (image cached) and failed for anyone running it fresh — the people most likely to need it. Natives now go through a helper that relaxes the preference and judges by exit code.

Verified

Exercised all three paths of the script against this branch:

case	result
lock files consistent	Lock files are consistent with the projects., exit 0
SDK image not cached	pull message is informational, still exit 0
real .csproj/lock mismatch	error NU1004 surfaced, exit 1

The third was reproduced by actually editing Serilog.AspNetCore back to 9.0.0 in Api.csproj and confirming both the direct and the transitive (Tests → Api) NU1004 appeared — i.e. the exact failure this whole thread started from.