chore(deps): update actions/setup-python action to v7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-python	action	major	v6 → v7

---

Release Notes

actions/setup-python (actions/setup-python)

v7.0.0

Compare Source

v7

Compare Source

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 6am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[randomparity]

Review Summary

Reviewed the v6 → v7 bump against the two things that actually break a major Actions bump: removed inputs and a changed runs.using runtime.

Findings

No P1–P3 findings. Nothing fixed, no commit added.

#	Severity	Finding	Resolution
1	P4	zizmor reports 8 unpinned-uses (High) — all actions ride mutable major tags instead of SHA pins	Not fixed: pre-existing and repo-wide (applies equally to checkout@v6), out of scope for a version bump. zizmor is not wired into CI.
2	P4	No pip caching — pip install -r requirements-dev.txt runs cold in 5 jobs per CI run (pytest + 4 molecule matrix legs)	Not fixed: cache: pip + cache-dependency-path: requirements-dev.txt would help, but adding it is scope creep on a Renovate bump.

Compatibility check

Risk	Check	Result
Removed input	v7.0.0 removed the pip-install input (actions/setup-python#1336)	Not used — all three call sites pass only python-version: "3.13"
Runtime change	action.yml at v7 declares runs.using: node24	All jobs are runs-on: ubuntu-latest; no self-hosted runners. Supported.

Remaining v7.0.0 changes (ESM migration, stderr annotations reclassified as warnings, manifest fetch retry, @actions/cache 6.2.0) are behavioral only and touch no input this repo sets.

Verification

Run locally on the PR branch, using the commands CI itself runs:

• Tests: pass — pytest 29 passed
• Lint: clean — ansible-lint playbooks/ roles/ 0 failures / 0 warnings across 147 files (production profile passed); actionlint clean
• Format: clean — yamllint -c .yamllint.yml . clean

GitHub CI: 6/6 checks SUCCESS. mergeable: MERGEABLE, mergeStateStatus: CLEAN.

Commit

None — no changes were required.