chore(deps): aggregate core dependabot updates

[burtenshaw]

Aggregates non-env Dependabot updates for maintainers.\n\nIncluded source PRs:\n- #995 chore(deps): bump actions/setup-python from 6 to 7\n\nTouched files:\n- .github/workflows/deploy-hf-env.yml\n- .github/workflows/manage-hf-collection.yml\n- .github/workflows/package-ci.yml\n- .github/workflows/publish-pypi.yml\n- .github/workflows/publish-testpypi.yml\n- .github/workflows/test.yml\n\nValidation:\n- git diff --check hf/main...HEAD\n\nNo local unit/integration suite was run because this aggregate only changes GitHub Actions workflow pins and does not touch src/ or runtime dependency files.

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Scope: PR #996 — chore(deps): bump actions/setup-python from 6 to 7 (single dependabot commit ff5d83f). The change is limited to 6 CI workflow files under .github/workflows/ (each actions/setup-python@v6 → @v7, +1/-1). No Python, client, server, models, RFCs, or docs are touched.

Automated Checks

• Lint: PASS (for this PR). lint.sh lints Python under src//tests//envs/, and this PR changes zero Python files. The hook does report formatting drift, but exclusively in ~20 pre-existing envs/*.py files this PR does not touch (e.g. envs/opencode_env/*, envs/chat_env/*, envs/coding_tools_env/*). Not attributable to this change.
• Debug code: CLEAN (for this PR). check-debug.sh surfaces only pre-existing print/console.print/TODO items in src/; none are introduced here.

Open RFCs Context

Scanned rfcs/: 000 project-phases (In Review), 001 abstractions (In Review), 002 env-spec (In Review, + pending amendment), 003 mcp-support (In Review), 004 rubrics (proposal), 005 agentic-harnesses (In Review), 010 echo-env-token-world-model (Draft). None concern CI tooling or GitHub Action versions, so none are affected by this change.

Tier 1: Fixes Required

None. The bump is mechanically sound:

• actions/setup-python@v7 is a valid published release. Per its release notes, v7 is an internal ESM migration with no changes to inputs, outputs, or behavior. The only removed input is pip-install, which none of these workflows use. The Node 24 / runner ≥ v2.327.1 requirement was already introduced in v6 (already in use here), so v7 adds no new runner requirement.
• All 6 workflows are consistently updated — no leftover @v6 remains anywhere in .github/.
• Every call site only passes python-version (3.11 / 3.12); none rely on removed or changed inputs (pip-install, cache, check-latest, allow-prereleases). YAML structure/indentation is preserved.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. A CI action version bump does not touch the Gymnasium-style API, rewards-in-environment, client/server separation, the MCP agent boundary, or container isolation.

RFC Conflicts

None identified. No open or draft RFC covers CI or GitHub Action versioning.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

Low-risk dependency maintenance with no code-level or alignment concerns. (Separately: repo-wide lint.sh currently fails on pre-existing envs/*.py formatting drift unrelated to this PR — worth a dedicated cleanup, but out of scope here.)

  

_{Sent by Cursor Automation: Pre-review}

[burtenshaw]

Closing this aggregate because the only included non-env Dependabot update (#995) was merged directly into main while this automation was running, leaving no remaining non-env Dependabot work to aggregate.