Repository navigation
chore(deps): refresh Go, pnpm, and build tooling - #7
Merged
Merged
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. |
clawsweeper
Bot
added
merge-risk: 🚨 compatibility
|
Codex review: needs changes before merge. Reviewed August 31, 2026, 7:41 AM ET / 11:41 UTC. ClawSweeper reviewWhat this changesUpdates the Go toolchain and networking modules, pnpm metadata, Docker build image, and setup-go workflow action versions. Merge readinessKeep this owner-authored maintenance PR open: its Go and Docker validation is well evidenced, but the introduced pnpm lockfile contains two YAML documents and must be corrected before merge. Priority: P2 Review scores
Verification
How this fits togetherblucli is a Go command-line client for BluOS players. Its package-manager helpers invoke the Go build and test commands, while GitHub Actions and Docker use the declared toolchain to produce and validate binaries. flowchart LR
Dev[Developer pnpm helpers] --> Lock[pnpm lockfile]
Lock --> Build[Go build and test]
Mod[Go module toolchain] --> Build
CI[GitHub Actions] --> Build
Docker[Docker build] --> Build
Build --> CLI[blu command-line client]
Before merge
Findings
Agent review detailsSecurityNone. Review metrics
Merge-risk optionsMaintainer options:
Copy recommended automerge instructionTechnical reviewBest possible solution: Regenerate and commit one canonical pnpm lockfile for pnpm 12.1.0, then retain the validated Go 1.26.6, Docker, and action updates. Do we have a high-confidence way to reproduce the issue? Yes—source reproducible: pnpm-lock.yaml contains two YAML documents, with the old lockfile beginning after the introduced separator at line 101. The review environment could not run Corepack because its cache location is read-only, but the malformed committed structure is directly observable. Is this the best way to solve the issue? No—the tooling upgrade is appropriate, but its lockfile must be regenerated as one document so pnpm's frozen-lockfile workflow remains usable. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found, but no applicable review policy affected this item. Codex review notes: model internal, reasoning high; reviewed against 677008ba4c22. LabelsLabel changes:
Label justifications:
EvidenceAcceptance criteria:
What I checked:
Likely related people:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refresh the Go runtime dependencies and build tooling while preserving Go 1.25 source compatibility and macOS 12 support. No CLI behavior or application dependencies are added.
Dependency changes
go get -u ./...andgo mod tidyregenerated the Go dependency files. DNS 1.1.73 replaces its old tools.go with a tool directive, so tidy removes the now-unused explicit go-cmp, x/mod, x/tools, and x/sync requirements.go mod why -mconfirms this project does not need go-cmp, x/mod, or x/tools. zeroconf and its backoff module remain at their latest versions for the module paths they use.pnpm regenerated its lockfile, including its own platform executables under package-manager dependencies. The application still has no npm dependencies. The pnpm 12 and setup-go 7 majors are included after reviewing their migration notes: this repository uses neither hosted Git package dependencies nor workspace peer cycles/configuration, and setup-go retains the go-version-file input on GitHub-hosted runners. checkout v7, golangci-lint-action v9, GoReleaser action v7, and Alpine 3.24 already track their current stable release lines.
References: pnpm 12.0 migration notes, pnpm 12.1, setup-go 7, DNS 1.1.73.
Verification
All completed successfully:
Go 1.25 source compatibility also passed explicitly:
The pnpm test helper also passed. Linux/amd64 and Windows/amd64 binaries cross-compiled with Go 1.26.6. Lint reports the existing gofumpt extra-rules deprecation warning but no findings. Codex autoreview completed scoped-clean with no accepted/actionable findings at its default P0 threshold.
Live CLI proof
A temporary Python HTTPServer on loopback served synthetic BluOS XML. This exercised the actually-built Go 1.26.6 executable through a real HTTP connection, XML parsing, and JSON output. The fixture returned:
The config file contained only
{}. Actual commands and output:The server recorded exactly
['/Status'], proving the dry-run did not send a volume request. A separate read-only LAN discovery attempt found no physical players:The Docker image was built and run locally:
CI reasoning and maintainer decision
Default-branch CI was green before this update: CI and Docker. Both are build/test workflows. The separate release workflow is tag-triggered; there are no scheduled monitoring workflows. No jobs, assertions, or tests were weakened or removed, and no release was triggered.
All branch and PR checks passed on the first attempt. Branch: CI and Docker. PR: CI and Docker. Linux, macOS, Windows, race, tidy, lint, and vulnerability checks are green. The default branch remains unchanged and green.
NEEDS-PETER: Go 1.27 requires macOS 13, dropping the macOS 12 compatibility provided by the current toolchain. This PR takes the supported Go 1.26.6 line instead. Recommendation: retain macOS 12 for this maintenance update and make the minimum-OS change explicit in a later release. See the Go 1.27 platform notes.
This PR is for orchestrator review; it must not be merged by the worker.