Bump actions/setup-go from 6 to 7

[dependabot]

Bumps actions/setup-go from 6 to 7.

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-go#763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-go#771

New Contributors

• @​philip-gai made their first contribution in actions/setup-go#771

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

• Upgrade actions dependencies by @​priyagupta108 with @​Copilot in actions/setup-go#744
• Upgrade @​types/node and typescript-eslint dependencies to resolve npm audit findings by @​HarithaVattikuti in actions/setup-go#755
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-go#758
• Upgrade version to 6.5.0 in package.json and package-lock.json by @​HarithaVattikuti in actions/setup-go#762

New Contributors

• @​priyagupta108 with @​Copilot made their first contribution in actions/setup-go#744
• @​jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

• Add go-download-base-url input for custom Go distributions by @​gdams in actions/setup-go#721

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in actions/setup-go#727

Documentation update

• Rearrange README.md, add advanced-usage.md by @​priyagupta108 in actions/setup-go#724
• Fix Microsoft build of Go link by @​gdams in actions/setup-go#734

New Contributors

• @​gdams made their first contribution in actions/setup-go#721

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

• Update default Go module caching to use go.mod by @​priyagupta108 in actions/setup-go#705
• Fix golang download url to go.dev by @​178inaba in actions/setup-go#469

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

... (truncated)

Commits

• b7ad1da chore(deps): bump @​actions/cache to 6.2.0 (#771)
• 0778a10 Migrate to ESM and upgrade dependencies (#763)
• See full diff in compare view

[bgentry]

🤖 Codex review: Approved after dependency security and compatibility review.

Upgrade

• actions/setup-go: v6 → v7; reviewed head 50ada7eff0804454eeb282d9c14665210be3a669.
• Resolved v7 artifact: b7ad1dad31e06c5925ef5d2fc7ad053ef454303e (v7.0.0).

Security review

• Compared exact upstream archives, action source, action.yml, lockfiles, and committed main/post bundles. Verified upgraded Actions toolkit tarballs against registry and lockfile SHA-512 integrity and checked canonical source/publishing metadata. The ESM/toolkit migration preserves Node24 entrypoints and adds no unexpected credential read or network destination.
• The workflow changes only three version references, retains contents: read, hosted Ubuntu, static go.work input, and checkout persist-credentials: false. No runtime install hook is introduced.
• Reviewed cache-policy changes and Azure SDK's new embedded CRC64 WASM; npm/bundle bytes agree, and static imports expose no networking. No blocking supply-chain finding.

Compatibility verification

• Local YAML parse, exact three-reference diff/permissions/input checks, and git diff --check — passed on this head.
• All eight same-head Java workflow jobs passed, including quality/package archives, Java 21/25 SQLite, and Postgres 14–18. Job-step metadata confirms upgraded main and post actions ran successfully. Required Go CI checks also passed. Hosted CI directly exercises the runner surface that local macOS cannot reproduce.

Residual risk

• Bundled Undici/brace-expansion advisory matches remain; reviewed source has no applicable WebSocket/cookie/Blob/retry-proxy or untrusted-glob path. New fast-xml-parser GHSA-8r6m-32jq-jx6q applies to the bundled parser, whose input here comes from trusted cache/Azure HTTPS responses; no repository-controlled XML path was found.
• Generated bundles/WASM retain upstream build trust; no independent reproducible build or attestation-signature verification was performed. The mutable major tag must continue to resolve to the reviewed commit. This is routine maintenance, not a claim that all bundled advisories are fixed.