build(deps): unblock the two glitching Dependabot PRs (#1021, #1022)

[BigSimmo]

Summary

Two open Dependabot dependency-update PRs were failing the required CI aggregate. This unblocks both from main.

• chore(deps): bump the github-actions group across 1 directory with 2 updates #1021 — github-actions group (actions/checkout → v7.0.1, anthropics/claude-code-action → v1.0.179). The bump was red because check:github-actions rejects any action SHA not in the reviewed-pin allowlist, and both new commit SHAs were unreviewed. This adds them to the allowlist in scripts/github-action-pins.mjs (keeping the prior SHAs, matching the existing multi-version pattern). Once Dependabot rebases chore(deps): bump the github-actions group across 1 directory with 2 updates #1021 onto this, its pin check passes.
• chore(deps-dev): bump eslint from 9.39.5 to 10.7.0 #1022 — eslint 9 → 10. ESLint 10 crashes npm run lint outright: eslint-config-next@16.2.10 bundles an eslint-plugin-react that still calls the removed context.getFilename() API (TypeError: ... getFilename is not a function). The lint toolchain isn't ESLint-10-ready, so this holds the ESLint major in .github/dependabot.yml, mirroring the existing TypeScript-major hold. Dependabot will close chore(deps-dev): bump eslint from 9.39.5 to 10.7.0 #1022 on its next run.

No application code changes; no package.json/lockfile changes. This does not touch retrieval/ranking/ingestion/answer surfaces — RAG impact: no retrieval behaviour change — dependency/CI config only.

Verification

• npm run verify:cheap — all static gates pass (incl. check:github-actions, check:ci-scope, check:pr-policy), lint + typecheck clean, 3028/3032 unit tests pass.
• node scripts/check-github-action-pins.mjs → "GitHub Actions pin check passed."
• tests/github-action-pins.test.ts → 6/6 pass.
• Verification not run: browser/UI, release, and provider-backed gates — not applicable (no UI, clinical, or provider surface touched).

One pre-existing unrelated failure: tests/pdf-extraction-budget.test.ts (Python OCR subprocess — "python exploded"). Confirmed to fail identically on a clean tree with these changes stashed; it's the sandbox missing the Python OCR stack (per AGENTS.md), not a regression from this PR.

Risk and rollout

• Risk: Low. Allowlist additions only widen the set of reviewed action SHAs (both resolved by Dependabot from tagged releases v7.0.1 / v1.0.179); the Dependabot ignore only stops proposing an ESLint major that already cannot build.
• Rollback: revert this commit — restores the prior allowlist and drops the ESLint hold.
• Provider or production effects: None.

Clinical Governance Preflight

Not applicable — no ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output is touched.

Notes

• chore(deps): bump the github-actions group across 1 directory with 2 updates #1021 needs a Dependabot rebase after this merges for its pin check to go green (automatic on base change).
• chore(deps-dev): bump @testing-library/jest-dom from 6.9.1 to 7.0.0 #1023 (@testing-library/jest-dom 7.0.0) is already green and is intentionally left untouched.
• Remove the ESLint hold once eslint-config-next supports ESLint 10.

---

Generated by Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

@BigSimmo, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 1 minute

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 26bb2f58-4c35-49bd-8db2-2494156524ed

📥 Commits

Reviewing files that changed from the base of the PR and between e02ba3d and 5edff4a.

📒 Files selected for processing (2)

• .github/dependabot.yml
• scripts/github-action-pins.mjs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/new-dependencies-github-glitch-1gw69x

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.