ci: let Dependabot scan the tend-setup and build-js composite actions

[prql-bot]

For the github-actions ecosystem, Dependabot's directory: "/" only covers .github/workflows/. Composite actions under .github/actions/ are scanned only if they are listed explicitly — which is why four of them already are. Two are not: .github/actions/tend-setup and .github/actions/build-js. Their uses: refs have never been scanned.

That gap has already cost one update. Dependabot's #5891 (chore: bump go-task/setup-task from 1 to 2, merged 2026-05-14) touched exactly three files — build-web.yaml, test-php.yaml, test-prqlc-c.yaml — all of them under /. .github/actions/tend-setup/action.yaml uses the same action and was left on @v1, where it has sat for nearly three months while v2.0.0, v2.1.0 and v2.2.0 shipped. Every one of the eight tend-* workflows runs through that action, so it is the most-executed uses: ref in the repo and the one that had no watcher.

This PR adds both directories to the list (sorted, so ls .github/actions/ is a checkable invariant, with a comment recording why / isn't enough) and applies the one bump the gap swallowed.

On the v1 → v2 bump specifically: the only breaking change in v2.0.0 is the runtime moving from Node 20 to Node 24. The input surface at v2 is a superset of v1 — version, repo-token and max-retries are all still there, with checksum added in v2.2.0 — so the existing repo-token / version: 3.52.0 block needs no change. The three workflow files bumped by #5891 have been running @v2 with the identical version: 3.52.0 input since May, which is the strongest available evidence that the bump is a no-op here.

build-js's three refs (baptiste0928/cargo-install@v3, actions/setup-node@v7, Swatinem/rust-cache@v2) are all at their current majors, so listing it changes nothing today — it just stops the same silent drift from starting there.

The cost, stated plainly: directories: fans a shared-action bump out into one PR per listed directory, not one PR overall — actions/upload-artifact 5→7 landed as five separate PRs (#5889, #5892, #5893, #5894, #5895). Going from five listed directories to seven raises that ceiling, and both baptiste0928/cargo-install and Swatinem/rust-cache are now referenced from several listed directories, so a major bump on either fans out the same way. That seems clearly worth paying against three months of an unwatched stale ref, and the fan-out is a pre-existing property of this config rather than something this change introduces — but it's a maintainer's call, and if it turns noisy a groups: block on this ecosystem entry is the lever.

How this surfaced, and scope notes

Found during the daily review-runs sweep (31369430836). The symptom was half-surfaced a run earlier: the 08-09 tend-weekly session (31306003041) noticed the @v1/@v2 split while doing its setup-task version-pin task and correctly left it alone as out of scope — "the major-version drift may be unintentional". It reported the drift but not the cause; the cause is this config gap.

The commented-out macOS job in tests.yaml also references go-task/setup-task@v1 (around line 297), but it is inside a fully commented-out block, so it's dead text — left untouched rather than adding diff noise.

No overlap with the other open PR touching this file: #6144 modifies the final run: block of tend-setup/action.yaml, this touches the first uses:. Different hunks.

[prql-bot]

Diff is correct. Verified independently:

• The new list is exactly ls .github/actions/ (six entries, sorted), and both newly-listed actions are live — build-js is consumed by release.yaml, tend-setup by all eight tend-* workflows.
• go-task/setup-task@v2 with repo-token + version: 3.52.0 is already running in build-web.yaml, test-php.yaml and test-prqlc-c.yaml since #5891, so the input block genuinely needs no change.
• build-js's three refs are at current majors (setup-node@v7 matches the #6080 bump), so listing it is a no-op today, as the description says.
• No conflict with #6144 — that PR only appends to the final run: block; this one touches line 15.

One trade-off the description doesn't state, worth a maintainer's eye before merge: directories: fans a shared-action bump out into one PR per listed directory, not one PR overall. actions/upload-artifact 5→7 landed as five separate PRs across the five directories listed at the time — #5889, #5892, #5893, #5894, #5895. Going from five listed directories to seven raises that ceiling accordingly, and baptiste0928/cargo-install and Swatinem/rust-cache are now each referenced from several listed directories, so a major bump on either would fan out the same way.

That cost is clearly worth paying — the alternative is what this PR is fixing, tend-setup sitting on a stale ref for three months with no watcher — and the fan-out is a pre-existing property of the config rather than something this change introduces. Flagging it only because "two more Dependabot PRs per shared-action major bump" is the kind of thing that's better decided now than discovered later. If it becomes noisy, a groups: block on this ecosystem entry is the lever to reach for.

Self-authored, so no approval from me — this needs a human.