[Bunton33]

What does this change?

Workflow actions. All six pinned actions move to their current major in one PR. This supersedes Dependabot's #35–#39. It also covers the upload-pages-artifact bump that Dependabot couldn't open (its five-open-PR limit):

Action	From	To
actions/checkout	v4.4.0	v7.0.1
actions/setup-python	v5.6.0	v7.0.0
actions/setup-node	v4.4.0	v7.1.0
actions/upload-artifact	v4.6.2	v7.0.2
actions/upload-pages-artifact	v3.0.1	v5.0.0
actions/deploy-pages	v4.0.5	v5.0.1

• The majors are mainly the Node 24 runtime. Every input we use still exists at the pinned SHAs: python-version, node-version, cache, cache-dependency-path, path, name, retention-days and outputs.page_url.
• upload-pages-artifact v4+ skips dotfiles. None are deployed.
• Each SHA was verified against its tag. The SHAs for Bump actions/setup-python from 5.6.0 to 7.0.0 #35–Bump actions/deploy-pages from 4.0.5 to 5.0.1 #39 match Dependabot's.

Dependabot now groups all action bumps into one PR, so future updates merge and deploy together.

Validator retry. Each network request is retried once after 5s when the failure may be transient (connection error, timeout, 5xx). A 4xx is not retried. #40 was the nightly failing on a single failed load of AIR-1's classic installer page: no deploy happened there, and the next two nightlies passed. The registry job gets timeout-minutes: 20, so a total upstream outage fails fast.

For reviewers

• Deploy actions: upload-pages-artifact and deploy-pages only run in pages.yml, on main. The github-pages environment only accepts main, so this PR's CI can't exercise them. Their first run is the deploy after merge. If it fails, the current site stays live.
• upload-artifact only runs when a UI test fails, so green CI doesn't exercise it either.
• setup-python: I kept it at v7.0.0, the version Dependabot proposed. v7.1.0, which only adds features, came out three days ago; the grouped Dependabot update will pick it up.
• Review: two independent reviewers checked the SHAs, the inputs used across each major jump, and the retry behavior. They found no defects. Their two test gaps are covered: a HEAD never reads a body, and relative manifests resolve against the redirected URL.

Fixes #40. Once merged, Dependabot closes #35–#39 as superseded.

Checklist

• Playwright tests pass locally (cd tests && npx playwright test): no site files changed; CI runs them
• Any new runtime file/dir is added to the cp list in .github/workflows/pages.yml: none added
• No new build step, framework, or runtime CDN dependency
• If devices.json changed: unchanged. python scripts/validate_registry.py passes (full and --offline), and 79 + 14 Python unit tests pass

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f8f38c9c-b1de-4b39-9b2f-2f8f811322a1

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}