chore(deps): update actions/setup-go action to v7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-go	action	major	v6 → v7

---

Release Notes

actions/setup-go (actions/setup-go)

v7.0.0

Compare Source

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in #​771

New Contributors

• @​philip-gai made their first contribution in #​771

Full Changelog: actions/setup-go@v6...v7.0.0

v7

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.40%. Comparing base (4de1fd1) to head (dcbe77d).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2192      +/-   ##
==========================================
- Coverage   83.40%   83.40%   -0.01%     
==========================================
  Files         395      395              
  Lines       39218    39218              
==========================================
- Hits        32710    32708       -2     
- Misses       4571     4572       +1     
- Partials     1937     1938       +1     

Flag	Coverage Δ
integration	7.29% <ø> (ø)
unit	81.48% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ALRubinger]

🐑 renovate-shepherd triage: needs a human decision

actions/setup-go v6 → v7 — a major bump, so the config's automerge rule deliberately does not cover it and I don't merge it unattended.

Status: all 22 checks pass. There is nothing broken to fix here; the only thing standing between this and merge is a human's call on the major.

Blast radius

Four workflows pin the action:

• .github/workflows/ci.yml
• .github/workflows/release.yml
• .github/workflows/sandbox-agents.yml
• .github/workflows/sandbox-agents-watch.yml

The diff is purely the @v6 → @v7 ref; no with: inputs changed. The Go toolchain pin (go-version: "1.26") and the multi-module cache-dependency-path block are untouched.

What a reviewer should check

The risk with a setup-go major is usually a change in caching behaviour or default go-version resolution, which can surface as a slow or subtly-wrong cache rather than a red check. Since release.yml is in scope, confirm the release path still resolves the intended toolchain — CI green covers the PR-time workflows but not a tag-triggered release run.

Worth a skim of the v7 release notes before merging.

— renovate-shepherd