chore: batch dependabot updates 2026-07-09

[MDzaja]

Batch dependabot updates — 2026-07-09

Branch: chore/batch-dependabot-2026-07-09 (2 commits, based on origin/main @ d7c538ecc)

PR title: chore(deps): batch dependabot updates 2026-07-09

Summary

Batches the open dependabot github-actions updates into a single PR by cherry-picking each dependabot commit.

Action	From	To
actions/cache	v5.0.5	v6.1.0 (major)
actions/checkout	df4cb1c0…	9c091bb2…
actions/setup-go	v6.4.0	v6.5.0
actions/setup-java	v5.2.0	v5.4.0
actions/setup-python	v6.2.0	v6.3.0
ruby/setup-ruby	v1.308.0	v1.316.0
denoland/setup-deno	667a34cd…	22d081ff…

Touches: setup-toolchain/action.yml + 6 workflows (deploy-pages, e2e_pr_tests, pr_checks, prepare-release, release, sdk_publish).

Closes

Closes #3
Closes #36

Excluded

#8 (pip-prod group, 14 updates) is excluded — do not merge as-is, two independent blockers:

1. Breaks the Python version contract: it raises the urllib3 floor to >=2.7.0, which requires Python ≥ 3.10, while all Python packages declare requires-python >= 3.9. poetry lock fails to solve (urllib3 is forbidden).
2. Fights the client generator: the 4 bumped pyproject.toml files are generated; hack/python-client/postprocess.sh force-pins the urllib3 floor back to 2.1.0 on every yarn generate:api-client, so the next regeneration reverts the bump and the "generated clients out of date" CI gate fails.

Suggested follow-up for #8: bump the floors in the generator templates/postprocess (and decide whether to drop py3.9 first), and add a dependabot ignore/exclusion for generated client manifests so it stops proposing un-mergeable bumps there.

Conflict resolutions during cherry-pick

• default_image_publish.yaml and translate.yaml (from chore(deps): Bump the github-actions group across 1 directory with 8 updates #36): kept deleted — these workflows were intentionally removed on main by the monorepo-cruft cleanup (chore: remove monorepo-migration cruft, pin CI poetry to 2.3.2, and properly deprecate daytona_sdk #46); bumps to deleted files are moot.
• e2e_pr_tests.yaml merged cleanly into the rewritten parallel-e2e version of the file.

Validation

• actionlint clean on all changed workflow files (composite-action false positives and the known blacksmith-* runner-label warning aside).
• All YAML parses.
• Every action resolves to a single consistent SHA across the repo (no split pins).
• poetry lock solves with zero lock drift after excluding chore(deps): Bump the pip-prod group across 5 directories with 14 updates #8.
• No Go/Node/Python dependency changes remain in the batch → no build-level validation required.

Risk notes

• actions/cache v5 → v6 is a major bump; used in pr_checks.yaml + setup-toolchain/action.yml. Cache actions have historically been drop-in across majors, but the first CI run on this PR is the real verification — watch the cache save/restore steps.

---

Summary by cubic

Batch updates GitHub Actions across workflows to keep CI current and pins consistent. Major bumps to actions/checkout v7 and actions/cache v6; closes #3 and #36.

• Dependencies

  • Major: actions/checkout v7.0.0, actions/cache v6.1.0
  • Others: actions/setup-go v6.5.0, actions/setup-java v5.4.0, actions/setup-python v6.3.0, ruby/setup-ruby v1.316.0, actions/upload-pages-artifact v5.0.0, actions/deploy-pages v5.0.0, denoland/setup-deno v2.0.5, golangci/golangci-lint-action v9.3.0, apache/skywalking-eyes/header updated

• Migration

  • No app code changes. First CI run may warm caches; watch actions/cache restore/save steps.

^{Written for commit 8483368. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 7 files

_{Re-trigger cubic}