Skip to content

chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0 - #9677

Merged
apurvvkumaria merged 4 commits into
mainfrom
dependabot/github_actions/actions/setup-go-7.0.0
Aug 20, 2026
Merged

chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0#9677
apurvvkumaria merged 4 commits into
mainfrom
dependabot/github_actions/actions/setup-go-7.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/setup-go from 6.0.0 to 7.0.0.

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

New Contributors

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump actions/setup-go from 6.0.0 to 7.0.0
daf0040 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@4469467...b7ad1da)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 19, 2026
@copy-pr-bot

copy-pr-bot Bot commented Aug 19, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@github-actions

github-actions Bot commented Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Model comparison: normalized findings match; normalized terminology decisions match; normalized E2E selections match; severity counts match.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: cloud-onboard, security-posture, cloud-inference
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

@github-code-quality

github-code-quality Bot commented Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit efbccbb in the dependabot/github_ac... branch remains at 96%, unchanged from commit fed0c45 in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit efbccbb in the dependabot/github_ac... branch remains at 83%, unchanged from commit fed0c45 in the main branch.

Show a line coverage summary of the most impacted files.
File main fed0c45 dependabot/github_ac... efbccbb +/-
src/lib/onboard...uild-context.ts 86% 86% 0%
src/lib/cli/oclif-metadata.ts 95% 95% 0%
src/commands/sandbox/agent.ts 100% 100% 0%
src/lib/cli/argv-normalizer.ts 100% 100% 0%
src/lib/cli/public-dispatch.ts 87% 88% +1%
src/lib/onboard...on-authority.ts 81% 82% +1%
src/lib/securit...ate-endpoint.ts 95% 96% +1%
src/lib/cli/com...and-registry.ts 93% 94% +1%
src/commands/sandbox/mcp.ts 85% 86% +1%
src/commands/uninstall.ts 90% 91% +1%

Updated August 20, 2026 03:55 UTC

@apurvvkumaria apurvvkumaria added the v0.0.112 Release target label Aug 20, 2026
@apurvvkumaria apurvvkumaria self-assigned this Aug 20, 2026
@apurvvkumaria
merge(main): incorporate current workflow checks
103fb0a 
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
@apurvvkumaria
test(e2e): align setup-go dependency pin
f088f28 
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
@apurvvkumaria
merge(main): incorporate current workflow prerequisites
efbccbb 
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
@apurvvkumaria

apurvvkumaria commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator

Dependency review complete, including the major-version migration.

  • Release range: I reviewed every official adjacent release from setup-go v6.0.0 through v7.0.0. The v6 line adds the go.dev download fallback, .tool-versions support, go.mod as the default cache dependency, a custom download base URL, and dependency maintenance. v7 migrates the action bundle to ESM and Node 24 and updates @actions/cache to 6.2.0.
  • Downstream contract: NemoClaw has one workflow consumer. It runs on hosted Ubuntu 24.04 AMD64 and ARM64 runners, requests Go 1.25.9, and disables setup-go caching. No token, cache, custom distribution, or new permission path is activated. The workflow-reference assertion now moves with the action reference.
  • Release and artifact evidence: the official target release revision is Verified. Upstream release, distribution consistency, Windows installation, basic validation, Microsoft Go validation, recurring setup-go validation, and CodeQL workflows passed.
  • Failure classification: the old workflow assertion failure was caused by this PR and is fixed. The old Station installer failure came from the earlier base; after incorporating current main, all 80 tests in that file pass. The old review-advisor failure was a transport/submission-service error and will rerun on the new revision.
  • NemoClaw validation: six native-runtime workflow tests and 80 Station installer tests passed; 32 affected growth tests passed; repository checks, CLI build and type checking, hooks, and pre-push checks passed.
  • Documentation: no public documentation change is needed because the user-facing Go version and native-runtime qualification contract are unchanged.
  • Size: 2 additions and 2 deletions across the workflow and its assertion. This is not a large LOC increase.

Security review:

  • Secrets and credentials: PASS — the consumer supplies no token and caching is disabled.
  • Input validation: PASS — the existing fixed Go version and architecture matrix are unchanged.
  • Authentication and authorization: PASS — no permissions or credential persistence changed.
  • Dependencies: PASS — every adjacent release and the ESM/Node 24 migration were reviewed.
  • Error handling and logging: PASS — no NemoClaw error or logging path changed.
  • Cryptography: PASS — no cryptographic contract changed.
  • Configuration and deployment: PASS — current hosted runners support the Node 24 action runtime; both runner architectures remain covered.
  • Testing and coverage: PASS — upstream distribution/platform validation and NemoClaw workflow/installer tests passed.
  • System-level safety: PASS — no service authority, sandbox policy, cleanup, or external-state mutation changed.

The remaining gates are the fresh required checks and any new actionable review feedback.

apurvvkumaria
apurvvkumaria approved these changes Aug 20, 2026
View reviewed changes

@apurvvkumaria apurvvkumaria left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved after the official adjacent-release, major-runtime, artifact, downstream-contract, security, documentation, and local validation review recorded above. Fresh CI and later actionable feedback remain merge gates.

@apurvvkumaria
apurvvkumaria merged commit 40dc272 into main Aug 20, 2026
39 checks passed
@apurvvkumaria
apurvvkumaria deleted the dependabot/github_actions/actions/setup-go-7.0.0 branch August 20, 2026 03:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@apurvvkumaria apurvvkumaria apurvvkumaria approved these changes

Assignees

@apurvvkumaria apurvvkumaria

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code v0.0.112 Release target

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@apurvvkumaria