action-allowlist-review: bump opentofu/setup-opentofu from 2.0.1 to 2.0.2 in /.github/actions/for-dependabot-triggered-reviews

[dependabot]

Bumps opentofu/setup-opentofu from 2.0.1 to 2.0.2.

Release notes

Sourced from opentofu/setup-opentofu's releases.

v2.0.2

What's Changed

• feat: verify download against published SHA256SUMS by default by @​somaz94 in opentofu/setup-opentofu#121

New Contributors

• @​somaz94 made their first contribution in opentofu/setup-opentofu#121

Full Changelog: opentofu/setup-opentofu@v2...v2.0.2

Commits

• a1320f8 release docs and bump to 2.0.2 (#127)
• d3dc77d feat: verify download against published SHA256SUMS by default (#121)
• 5600721 chore(deps): Bump semver from 7.8.1 to 7.8.3 (#123)
• 7051243 chore(deps): Bump actions/checkout from 6.0.2 to 6.0.3 (#124)
• 50e079f chore(deps): Bump actions/checkout from 6 to 6.0.2
• 0c73a96 chore(deps): Bump semver from 7.8.0 to 7.8.1 (#119)
• 7526f4b chore(deps): Bump semver from 7.7.4 to 7.8.0
• a630d3b chore(deps-dev): Bump jest from 30.3.0 to 30.4.2
• 7e2b876 chore(deps): Bump @​actions/core from 3.0.0 to 3.0.1
• See full diff in compare view

[potiuk]

@dependabot rebase

[potiuk]

Approving on the basis of our internal verify-action-build tooling confirming the download is verified.

The verify CI here is a false positive. opentofu/setup-opentofu's lib/setup-tofu.js downloads via tc.downloadTool() and then validates the artifact — await fileSHA256(pathToCLIZip) checked against the release's SHA256SUMS, rejecting on mismatch. The createHash('sha256') body lives in the sibling lib/util.js, so the in-file evidence is only the fileSHA256(...) call name, which the scanner didn't yet recognize.

Fix is #1001. Running the patched tool against this PR:

✓ lib/setup-tofu.js: 1 JS download(s), verification present in file
Exit code: 0

Since our tooling now confirms the artifact is checksum-verified, merging this v2.0.1 → v2.0.2 bump. Admin-merging to bypass the stale verify check; it'll pass normally once #1001 lands.