ci: bump actions/setup-go from 6.4.0 to 7.0.0

[dependabot]

Bumps actions/setup-go from 6.4.0 to 7.0.0.

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-go#763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-go#771

New Contributors

• @​philip-gai made their first contribution in actions/setup-go#771

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

• Upgrade actions dependencies by @​priyagupta108 with @​Copilot in actions/setup-go#744
• Upgrade @​types/node and typescript-eslint dependencies to resolve npm audit findings by @​HarithaVattikuti in actions/setup-go#755
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-go#758
• Upgrade version to 6.5.0 in package.json and package-lock.json by @​HarithaVattikuti in actions/setup-go#762

New Contributors

• @​priyagupta108 with @​Copilot made their first contribution in actions/setup-go#744
• @​jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

Commits

• b7ad1da chore(deps): bump @​actions/cache to 6.2.0 (#771)
• 0778a10 Migrate to ESM and upgrade dependencies (#763)
• 924ae3a chore: bump version to 6.5.0 in package.json and package-lock.json (#762)
• e91cc3b Bump @​actions/cache to 5.1.0, log cache write denied (#758)
• 4a2405e chore: update @​types/node and @​typescript-eslint dependencies to latest versi...
• 78961f6 chore: update @​actions dependencies and refresh license cache (#744)
• See full diff in compare view

[aatuh]

Dependency maintenance triage — 2026-08-15

• Owner: @aatuh (dependency maintainer)
• Scope: ci: bump actions/setup-go from 6.4.0 to 7.0.0
• Disposition: Defer. Do not merge or automerge: rebase or replace the update after the non-successful checks are resolved, then obtain the required independent review.
• Live CI evidence: Non-successful completed checks: test (1.25.x)=FAILURE.
• Release impact: excluded from release-candidate dependency closure until required checks are successful and protected-branch review completes.
• Next review: 2026-08-22

[aatuh]

SEC-003 triage (2026-08-15): this branch is stale and must not be merged as-is. Deferred to the named compatible dependency/action batch; rebase or regenerate a current candidate, then run the module-appropriate checks and review its footprint/license impact by 2026-08-22. Recorded in docs/dependency-risk.md. No automerge or bypass.