[joshavant]

The dependency CI matrix still downloaded modules and built with Go 1.27.0, whose verifier accepts the compromised eMudhra keys. Use the released Go 1.27.3 compiler for that job and document the patched minimum for supported source builds. Preserve the module’s language baseline, ordinary test job, module verification, tidy checks, vulnerability scan and advisory artifacts.

Validation in the isolated Linux arm64 guest: actual Go 1.27.3 with GOTOOLCHAIN=local; both modules verify and remain unchanged after go mod tidy -diff; all package race tests and the CLI build pass. Workflow parsing, actionlint and git diff --check pass. Independent P0–P2 review found no actionable findings.

The selected compiler’s incident-chain rejection is qualified separately. Published binaries, other platforms, installed runtimes, OS trust and GitHub Actions’ embedded runtimes remain separate delivery and qualification obligations. No release or deployment is included.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR uses Go 1.27.3 for dependency validation and documents it as the supported source-build minimum.

Example: A pull request runs the dependency-validation workflow.

• Before: Separate jobs use Go 1.27.0 and Go 1.27.3 with automatic toolchain switching disabled.
• After: One job asserts Go 1.27.3 and runs module verification, tidy checks, and vulnerability scanning.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, justified CI maintenance change with passing head checks and no actionable findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: The supplied maintainer-authored designation exempts this PR from the ordinary contributor proof gate; the body reports isolated compiler validation and head CI passes, without independently proving incident-chain rejection.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Dependency CI continues to execute an older compiler despite the repository's patched preferred toolchain.
Reason: The supplied maintainer-authored designation establishes direction for retiring minimum-compiler validation, and the diff preserves the other dependency safeguards.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: main still runs dependency validation with Go 1.27.0, and this focused change removes that lane while preserving the remaining checks; no actionable patch defect was found.

Priority: P2
Reviewed head: 6b2d220b71d15b296a810a08e2774469e4d80b7e

Before merge

None.

Findings

None.

Agent review details

How this fits together

GitHub Actions consumes the repository's application and tools modules, selects the validation compiler, and produces dependency-check results and retained advisory artifacts.

flowchart TD
  A[Repository modules] --> B[Dependency CI job]
  B --> C[Assert Go 1.27.3]
  C --> D[Verify and tidy both modules]
  D --> E[Vulnerability scanner]
  E --> F[Advisory artifacts]

Loading

Technical review

Best possible solution:

Land the focused compiler-selection change with its explicit source-support documentation.

Do we have a high-confidence way to reproduce the issue?

Current main explicitly runs dependency validation with Go 1.27.0 and GOTOOLCHAIN=local; certificate-chain acceptance itself was not independently reproduced.

Is this the best way to solve the issue?

Selecting the already preferred patched compiler removes the outdated validation lane without adding another owner or changing application behavior.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against cdaaf70f897b.

Provenance checked

• Separate minimum-compiler validation and documented source support changes intended behavior with a stated reason (ee3a8c2: fix(archive): guard imports and encrypted backup publication #38 required actual minimum-compiler build and test evidence separately from preferred builds.)
• Preferred compiler and advisory-artifact handling keeps the original intent (cdaaf70: fix(security): build with patched Go 1.27.3 toolchain #67 selected patched Go 1.27.3 while retaining the language minimum; this PR preserves the patched selection and scanner evidence.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Verified introduced change: The pinned diff removes the minimum-compiler matrix lane, selects Go 1.27.3 explicitly, and preserves verification, tidy checks, scanning, and advisory retention. (.github/workflows/ci.yml:87, 6b2d220b71d1)
• Current main retains the old lane: The default branch remains at the supplied release revision, where dependency CI explicitly selects Go 1.27.0 and Go 1.27.3 under GOTOOLCHAIN=local. (.github/workflows/ci.yml:93, cdaaf70f897b)
• Intentional support-policy change: The maintainer-authored direction explicitly replaces the earlier minimum-compiler support policy with a patched source-build minimum; README distinguishes that minimum from the retained language baseline. (README.md:38, 6b2d220b71d1)
• Original minimum-compiler rationale: fix(archive): guard imports and encrypted backup publication #38 deliberately introduced separate actual-minimum compiler validation; build(deps): patch Go toolchain and clarify backup recovery #58 retained it while extending checks to the tools module. (.github/workflows/ci.yml:91, ee3a8c2f8714)
• Earlier security update covers a different scope: fix(security): build with patched Go 1.27.3 toolchain #67 selected Go 1.27.3 for preferred builds but explicitly preserved the Go 1.27.0 minimum; it does not supersede this CI follow-up. (.github/workflows/ci.yml:93, cdaaf70f897b)
• Head checks and discussion: Checks on the reviewed head report eleven successes and two skipped dispatch checks; both discussion comments are bot status messages, with no additional approval or behavior artifacts. (6b2d220b71d1)

Likely related people:

• Peter Steinberger: Raw commit 15c2cca adds .github/workflows/ci.yml:104 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 15c2cca0909a; files: .github/workflows/ci.yml)
• Vincent Koc: Raw commit ee3a8c2 adds .github/workflows/ci.yml:96 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: ee3a8c2f8714; files: .github/workflows/ci.yml)
• Doug Simpson: Raw commit 33c985d adds .github/workflows/ci.yml:118 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 33c985de4662; files: .github/workflows/ci.yml)

Labels

Label changes:

• add P2: This is focused dependency-CI hardening rather than a demonstrated outage in the shipped application.
• add merge-risk: 🚨 compatibility: Supported source builds move from Go 1.27.0 to Go 1.27.3; the maintainer-authored direction explicitly accepts this change and documents the retained language baseline.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: This is focused dependency-CI hardening rather than a demonstrated outage in the shipped application.
• merge-risk: 🚨 compatibility: Supported source builds move from Go 1.27.0 to Go 1.27.3; the maintainer-authored direction explicitly accepts this change and documents the retained language baseline.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 6:53 PM ET / 22:53 UTC.