chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0

[dependabot]

Bumps actions/setup-python from 6.3.0 to 7.0.0.

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-python#1330
• Pin SHA commits and update docs with latest versions by @​HarithaVattikuti in actions/setup-python#1338
• Remove the pip-install input by @​gowridurgad in actions/setup-python#1336

Bug Fix

• Fix to Classify stderr warning messages as warnings instead of errors in annotations by @​lmvysakh in actions/setup-python#1335
• Validate and retry manifest fetch to prevent silent failures by @​priyagupta108 in actions/setup-python#1332

Dependency Upgrade

• Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @​dependabot in actions/setup-python#1328
• Remove EOL Python versions and Bumps numpy text fixture by @​priya-kinthali in actions/setup-python#1333
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-python#1337

New Contributors

• @​lmvysakh made their first contribution in actions/setup-python#1335
• @​philip-gai made their first contribution in actions/setup-python#1337

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

• 5fda3b9 Pin SHA commits and update docs with latest versions (#1338)
• 4ab7e95 Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-0
• 0f3a009 Remove the pip-install input (#1336)
• f8cf429 Migrate to ESM and upgrade dependencies (#1330)
• 54baeea Validate and retry manifest fetch to prevent silent failures (#1332)
• c709277 Annotation code fix (#1335)
• 6849080 remove EOL Python versions and Bumps numpy text fixture (#1333)
• 0903b46 Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)
• See full diff in compare view

[frankbria]

Dependabot Triage — PR #1108: actions/setup-python 6.3.0 → 7.0.0

Classification

• Update type: High-impact core (major bump of a CI action)
• Security urgency: Low (no advisory)
• Supply-chain risk: Medium, mitigated by verified SHA pin and first-party publisher

Key observations

• Pin 5fda3b95a4ea91299a34e894583c3862153e4b97 matches tag v7.0.0 on actions/setup-python.
• First-party GitHub-maintained action; no namespace, ownership or cadence anomalies.
• Major version, so the real exposure is a CI break, not compromise — and a CI break is self-announcing on this PR rather than something that ships to users.
• Diff is 3 files / 83 lines, workflow YAML only. No lifecycle scripts, no new dependencies.
• v7.0.0 published 2026-07-20 — 21 days old; cooldown satisfied.

Recommendation

Merge now

Cooldown is already satisfied at three weeks, the pin verifies against the real tag, and the only plausible downside — a major-version CI break — is caught by this PR's own checks before it can affect anything.

Follow-up actions

• If the required checks go red on the rebased run, that is a genuine v7 incompatibility and the PR should be held for a config fix, not merged.

---

_{Supply-chain triage per the reviewing-dependabot-prs skill. Advisories verified via gh api /advisories/; action SHA pins verified by dereferencing the annotated tag to its commit. Green CI is a functional gate, not a supply-chain signal — a malicious lifecycle script passes CI happily, so the diff was scanned for one separately.}