[lukisch]

The old Dependabot PRs #4, #5 and #6 fail version-specific metadata assertions on their older base. Current master already contains the metadata correction from #7. This Draft applies all three intended action upgrades together on current master: checkout v7, setup-python v7 and github-script v9.

Existing metadata assertions, concurrency, permissions, timeouts and native Windows/Linux/macOS test and smoke jobs are unchanged. No product version change.

Validation: full local Windows Python 3.12 suite before and after: 257 passed; Ruff and git diff --check passed. Native CI verification pending. The auto-assign pull_request_target run uses the base workflow, so it cannot prove the changed github-script v9 runtime; label-sync is not dispatched. Linux/macOS smoke jobs use offscreen Qt and mocked subprocess/model calls; they do not establish desktop/device acceptance.

Author model: gpt-6.1-sol (Codex). Independent review pending. Draft only; merges disabled.

[github-actions]

Welcome! 👋 Thanks for your first pull request in this repository.

A maintainer will review it soon. Please make sure:

• Your changes are tested
• Documentation is updated if needed
• The PR description explains what and why

Thanks for contributing!

[ellmos-multi-bot]

Independent MULTI-BOT review (Codex / gpt-6.1-sol, separate authoring and review instances).

Exact head: 8794e755f8c769789d5b780a9a536d4773c888ff. Read the full three-file diff and complete changed workflows in an isolated checkout, plus CONTRIBUTING.md and the commit message.

Merge blocker: CONTRIBUTING.md requires every contributed commit to carry a DCO Signed-off-by trailer. The sole PR commit 8794e755f8c769789d5b780a9a536d4773c888ff contains only a Generated-with trailer and has no sign-off. The author must add their own sign-off and update this PR; the bot cannot attest on the author's behalf. Keep this PR in Draft until that requirement is satisfied, then revalidate the resulting head and its CI.

Within the workflow change scope, no additional blocking code finding: the diff changes only github-script v7 to v9, checkout v4 to v7, and setup-python v5 to v7. Permissions, events, concurrency, timeouts, assertions and test/smoke commands are unchanged. The github-script body is byte-for-byte identical after YAML dedenting to the previously inspected ticket-master script; it does not redeclare the new injected getOctokit parameter or import ESM packages with require.

Exact-head native CI run 38563583992 completed successfully with all five jobs: lint, Windows Python 3.11, Windows Python 3.12, Linux platform smoke, and macOS platform smoke. Read the run head and individual job/step results. All ten current head checks are successful. This review did not rerun the full unchanged local test suite; the PR author's 257-test local result is historical author evidence. The pull_request_target assign check uses the base workflow and does not demonstrate execution of the new github-script v9. Label sync was not dispatched, since that would alter repository labels. Offscreen platform tests do not establish physical desktop/device acceptance.

No source changes, Ready transition or merge performed. The current full-profile merge capability does not waive the project's DCO requirement.

Session: 01a15add-8cac-78a2-b863-e0c70abf69f3.