chore(deps): update actions/setup-node action to v7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	major	v5.0.0 → v7.0.0

---

Release Notes

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in #​1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in #​1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in #​1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in #​1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in #​1536
• docs: Update restore-only cache documentation by @​priya-kinthali in #​1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in #​1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1569

New Contributors

• @​chiranjib-swain made their first contribution in #​1536
• @​deiga made their first contribution in #​1548
• @​jasongin made their first contribution in #​1569

Full Changelog: actions/setup-node@v6...v7.0.0

v7

Compare Source

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

Compare Source

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in #​1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in #​1533

New Contributors

• @​Copilot made their first contribution in #​1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

Compare Source

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in #​1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

• Fix npm audit issues by @​gowridurgad in #​1491
• Replace uuid with crypto.randomUUID() by @​trivikr in #​1378
• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in #​1498

Bug fixes:

• Remove hardcoded bearer for mirror-url @​marco-ippolito in #​1467
• Scope test lockfiles by package manager and update cache tests by @​gowridurgad in #​1495

New Contributors

• @​susnux made their first contribution in #​1283

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

Compare Source

What's Changed

Documentation

• Documentation update related to absence of Lockfile by @​mahabaleshwars in #​1454
• Correct mirror option typos by @​MikeMcC399 in #​1442
• Readme update on checkout version v6 by @​deining in #​1446
• Readme typo fixes @​munyari in #​1226
• Advanced document update on checkout version v6 by @​aparnajyothi-y in #​1468

Dependency updates:

• Upgrade @​actions/cache to v5.0.1 by @​salmanmkc in #​1449

New Contributors

• @​mahabaleshwars made their first contribution in #​1454
• @​MikeMcC399 made their first contribution in #​1442
• @​deining made their first contribution in #​1446
• @​munyari made their first contribution in #​1226

Full Changelog: actions/setup-node@v6...v6.2.0

v6.1.0

Compare Source

What's Changed

Enhancement:

• Remove always-auth configuration handling by @​priyagupta108 in #​1436

Dependency updates:

• Upgrade @​actions/cache from 4.0.3 to 4.1.0 by @​dependabot[bot] in #​1384
• Upgrade actions/checkout from 5 to 6 by @​dependabot[bot] in #​1439
• Upgrade js-yaml from 3.14.1 to 3.14.2 by @​dependabot[bot] in #​1435

Documentation update:

• Add example for restore-only cache in documentation by @​aparnajyothi-y in #​1419

Full Changelog: actions/setup-node@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Breaking Changes

• Limit automatic caching to npm, update workflows and documentation by @​priyagupta108 in #​1374

Dependency Upgrades

• Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @​dependabot[bot] in #​1336
• Upgrade prettier from 2.8.8 to 3.6.2 by @​dependabot[bot] in #​1334
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @​dependabot[bot] in #​1362

Full Changelog: actions/setup-node@v5...v6.0.0

v6

Compare Source

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[chapplehub]

検証結果: 問題なし（マージ済み）

actions/setup-node v5.0.0 → v7.0.0 のメジャーアップデートについて、リリースノートの照合・実 CI ログでの動作実証・上流の既知不具合調査を行いました。

1. 変更範囲

ci.yml ×2、playwright.yml ×2 の計 4 箇所。それ以外の差分なし。

2. v5 → v7 の破壊的変更と本リポジトリへの影響

変更	ver	影響	根拠
自動キャッシュを npm 限定に（#1374）	v6.0.0	なし	4 箇所すべて cache: pnpm を明示指定済み
always-auth 設定処理の削除（#1436）	v6.1.0	なし	.github/ 内に該当設定なし
devEngines.runtime を engines.node より優先（#1283）	v6.3.0	なし	node-version-file: package.json 時のみの挙動。本リポジトリは .nvmrc 単一ソース（ADR-20260728-44b）
ダミー NODE_AUTH_TOKEN export の削除（#1558）	v7.0.0	なし	registry-url / NODE_AUTH_TOKEN を未使用
ESM への移行（#1574）	v7.0.0	なし	ランタイムは v5.0.0 時点で既に node24（v7 も同一）。runs-on: ubuntu-latest の GitHub ホストランナー

補足: v6.0.0 の「自動キャッシュを npm 限定に」は、v5 で pnpm 利用時に発生していた #1357（v5 fails immediately when using pnpm）への対処であり、pnpm ユーザーにとっては修正側の変更。cache: pnpm を明示している本リポジトリは元々この問題を踏んでいない。

3. 実 CI ログによる動作実証

static / e2e (shard 5/6) の両方で同一 SHA（820762786026740c76f36085b0efc47a31fe5020）の v7.0.0 が動作:

Node version file is not JSON file → Resolved .nvmrc as 22.23.2
[command]/home/runner/setup-pnpm/.../pnpm store path --silent
Cache hit for: node-cache-Linux-x64-pnpm-c43a1dc8...
Cache restored successfully (~234 MB)

• .nvmrc（22.23.2）の解決 OK
• pnpm/action-setup → setup-node の順序前提が維持され、pnpm store path によるキャッシュパス解決も OK
• キャッシュキー形式が v5 と不変（node-cache-<OS>-<arch>-pnpm-<lockハッシュ>）。v5 時代に develop で作られたキャッシュにそのままヒットしており、マージ後にキャッシュが失効して全ジョブが再ダウンロードする副作用はない
• Post Run actions/setup-node@v7.0.0 に ##[warning] / ##[error] なし。v7 で追加された「log cache write denied」（@actions/cache 5.1.0 由来）の警告も発生していない

4. 上流の既知不具合

v7.0.0 リリース（2026-07-14）から 2 週間以上経過しているが、v7 起因の新規 open issue はゼロ（最新の open issue は 2026-05-20 の #1553）。既存の #1428（pnpm cache could prune store before caching）は v5 時代から存在する挙動で、本 PR による新規リスクではない。

5. CI 結果

全 11 チェック pass（changes / changes (e2e) / static / test / e2e shard 1〜6 / e2e report）。

---

以上より、破壊的変更のいずれも本リポジトリの構成には該当せず、実挙動・キャッシュ効率とも v5 から劣化なしと確認。