Update dirs to v7 and fix NativeLink CI build reporting

[renovate]

Trusted PR builds failed dependency analysis or finished with a BEP artifact-upload HTTP 401, and multiple Bazel invocations in one job reused a single attribution ticket. This change refreshes the dirs 7 lockfile, keeps read-only CI artifacts local while still publishing build events, and requests a fresh verified GitHub Actions ticket for each Bazel build/test/run invocation.

The workflow actor and PR author remain distinct. CI author attribution uses the GitHub App installation and does not require each author to authorize a profile. Tickets are masked and inserted before program arguments; failed token exchange does not prevent the build. Fork jobs using the public read-only cache skip BES and ticket exchange.

Validation:

• Bazel dependency regeneration and bazel mod deps --lockfile_mode=error passed.
• Four wrapper regressions cover fresh tickets per invocation, command/program argument placement, cache-only jobs, and failure handling. Setup-action mode checks cover trusted PR, main-branch, and fork configurations.
• NativeLink Bazel 8, Bazel 9, and Redis tester CI passed at 1ed98b7e345ba44f3a3248104e390ad9dbf1e4ec.
• Redis rerun 34267296970 produced three successful builds with verified actor MarcusSorealheis, PR author renovate[bot], and PR Update dirs to v7 and fix NativeLink CI build reporting #2741. The deployed account API returns all three under the NativeLink repository filter; the user confirmed profiles in the UI.
• Staging read-only smoke invocation b6cadc7e-3dcf-41a5-9578-4406f42305b2 succeeded without upload 401. Temporary credentials/configuration were removed. Hooks passed with the local Nix runner label corrected in a temporary configuration; no hook commands were omitted.

To test:

1. Run python3 -m unittest discover -s .github/actions/setup-nativelink-cloud -p '*test*.py'.
2. Run Bazel Native on a trusted PR. Verify each Redis tester invocation has a different invocation ID, completes dependency analysis, and has no profile-upload HTTP 401.
3. Open the verified staging build. Confirm the PR author and workflow actor are shown separately. Select TraceMachina/nativelink in the dashboard repository filter and confirm the three rerun builds remain visible.
4. In a fork job, verify cache-only operation remains usable and no BES/ticket credentials are requested.

Read-mode profiles/test logs remain on the runner and are not cloud artifacts. Backend ingestion, compact MongoDB documents, repository UI, and user-connection disablement are tracked in cloud-platform #1446.

---

This PR contains the following updates:

Package	Type	Update	Change
dirs	dev-dependencies	major	6.0.0 → 7.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

This change is 

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nativelink	Ready	Preview	Sep 9, 2026 3:29am UTC
nativelink-aidm	Ready	Preview	Sep 9, 2026 3:29am UTC

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.