Raise the GitHub Actions majors and enable Dependabot

[hacker-cb]

Every action here was two or three majors behind, because nothing was watching.

Action	Was	Now
actions/checkout	v4	v7
docker/build-push-action	v5	v7
docker/login-action	v3	v4
docker/setup-buildx-action	v3	v4

Versions resolved from the registry rather than recalled, pinned to the floating
major so patches arrive without a commit.

What each major actually breaks

Three of these sit on the publishing path, so this was checked rather than assumed:

• checkout v7 blocks checking out a fork PR under pull_request_target and
  workflow_run. Neither trigger exists here. v6 moved credentials to a separate
  file; nothing here reads them.
• build-push-action v7 dropped DOCKER_BUILD_NO_SUMMARY and
  DOCKER_BUILD_EXPORT_RETENTION_DAYS, neither of which was set — but v6 turned
  on build-record upload by default, and reading v7's notes for removals missed
  a feature that arrived a major earlier. On a public repository that publishes an
  archive of the full build log and metadata per leg per push, downloadable by
  anyone. DOCKER_BUILD_RECORD_UPLOAD: false turns it off; the summary stays,
  since it reports what was built without opening the log and costs no storage.
• setup-buildx-action v4 removed deprecated inputs and outputs; the calls here
  pass none.
• All four default to Node 24 and need runner v2.327.1+. Satisfied by
  construction now that everything is GitHub-hosted — it would have been a real
  constraint against the self-hosted runners the previous PR retired.

Dependabot

github-actions only, weekly, grouped into one PR, 7-day cooldown.

The comment in that file is explicit about what the setup does not buy, because
the first draft claimed protection it cannot give: with floating majors, patches
and minors arrive with no PR at all, so the cooldown delays only the major
bump that already gets human review. Re-pointing an existing @vN tag — the
tj-actions/changed-files shape — is neither delayed nor detected. Pinning by
commit SHA is what closes that, at the cost of a commit per patch; the file now
states which trade was taken instead of implying the question does not exist.

Also named there, so nobody has to re-derive it: FROM python:3.11-slim-bookworm
in images/platformio/Dockerfile (the docker ecosystem would cover it — a
separate decision), the linter images pinned inside run: blocks (no ecosystem
sees a docker run argument), and the framework versions, which are chosen
against Espressif's compatibility matrix rather than against "newest".

One consequence worth stating: a bump here edits a workflow file that sits in its
own paths: filter, so every Dependabot PR triggers a full rebuild and merging it
republishes latest with a new digest for unchanged image contents. At a few
majors a year that is acceptable — and it is why the updates are grouped.

README examples

All three image READMEs still documented actions/checkout@v4 and
actions/upload-artifact@v4 in their CI examples, three majors stale. Nothing in
this repository could catch that: Dependabot reads workflow files, lint.yml lints
workflow files, and these are Markdown. Raised to v7, with the rule recorded in
CLAUDE.md.

Verification

• ./scripts/lint.sh green
• Release notes read for every intermediate major, not just the target
• DOCKER_BUILD_RECORD_UPLOAD confirmed against build-push-action's own README —
  default true, and the v5→v7 path crosses it

Reviewed by

codex-review (xhigh) — no findings. The code-review workflow (high) — ten
defects, six confirmed, all applied. The two that mattered are above: the
build-record artifacts and a Dependabot comment that promised a guarantee the
configuration does not provide.

[Copilot]

🟢 Ready to approve

The action major bumps and Dependabot configuration are consistent across workflows and documentation, and the build-record artifact upload default is explicitly disabled for this public repository.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR updates this repository’s GitHub Actions dependencies to current major versions and introduces Dependabot configuration to keep action majors from drifting again. It aligns the workflows and documentation examples with the new action majors and explicitly disables build-record artifact uploads introduced by newer docker/build-push-action defaults (important for a public repo).

Changes:

• Bump GitHub Actions used in workflows to newer majors (actions/checkout@v7, docker/build-push-action@v7, docker/login-action@v4, docker/setup-buildx-action@v4) and add DOCKER_BUILD_RECORD_UPLOAD: false in build workflows.
• Add .github/dependabot.yml to track github-actions updates on a weekly cadence, grouped into a single PR, with a cooldown.
• Update image README CI snippets to match the new major versions (checkout@v7, upload-artifact@v7), and record the “floating major + Dependabot” rule in CLAUDE.md.

File summaries

File	Description
images/platformio/README.md	Updates GitHub Actions example to checkout@v7 and upload-artifact@v7.
images/esp-matter/README.md	Updates GitHub Actions example to checkout@v7 and upload-artifact@v7.
images/esp-idf/README.md	Updates GitHub Actions example to checkout@v7 and upload-artifact@v7.
CLAUDE.md	Documents the repo convention for floating major pins and Dependabot-driven major bumps.
.github/workflows/runner-smoke.yml	Bumps actions/checkout to v7.
.github/workflows/platformio.yml	Bumps Docker/checkout actions and disables build-record upload via DOCKER_BUILD_RECORD_UPLOAD: false.
.github/workflows/lint.yml	Bumps actions/checkout to v7.
.github/workflows/esp-idf.yml	Bumps Docker/checkout actions and disables build-record upload via DOCKER_BUILD_RECORD_UPLOAD: false (applies to esp-idf + esp-matter jobs).
.github/dependabot.yml	Adds Dependabot config for grouped weekly github-actions major bumps with cooldown.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 0
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.