chore(deps): refresh Go patch and build tooling

[steipete]

Refresh the preferred Go toolchain from 1.26.6 to 1.26.8 and align the Docker builder. Keep the Go 1.25.0 source minimum and macOS 12 compatibility; Go 1.27 would raise the macOS floor. Update the Dockerfile frontend to 1.27 and pnpm to 12.2.1 with its regenerated lockfile.

pnpm 12.3.1 was evaluated but deferred: the existing pnpm 11.24.0 launcher attempts to run its native executable through Node. Version 12.2.1 works through that launcher and passes frozen installation and the repository helpers. Go library dependencies, Action major versions, and Alpine 3.24 are already current.

Validation:

• Full tests with Go 1.25.0 and Go 1.26.8; race tests with Go 1.26.8.
• golangci-lint 2.13.2: zero issues; govulncheck 1.7.0: no vulnerabilities; clean module tidy.
• pnpm 12.2.1 frozen installation, build, and test helpers.
• Built binaries from both Go versions exercised against a synthetic loopback BluOS HTTP server: version/help, XML-to-JSON status, dry-run suppression, volume query encoding, and HTTP error handling.
• Independent P0–P2 review of the full candidate, including the lockfile.

No release or application behavior changes.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 4, 2026, 6:23 AM ET / 10:23 UTC.

ClawSweeper review

What this changes

The PR updates the preferred Go toolchain to 1.26.8, aligns the Docker builder and frontend, and refreshes pnpm to 12.2.1 with its lockfile.

Merge readiness

⛔ Blocked before merge - 3 items remain

Keep open for explicit owner review: the introduced update is internally consistent and has no actionable correctness or security finding, but this owner-authored PR is not eligible for automated cleanup.

Priority: P3
Reviewed head: ffbcb5f8cd17a40c6385e6fb3d96bcc8b44df978
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A coherent, narrowly scoped tooling update with internally consistent selectors and reported validation.
Proof confidence	🌊 off-meta tidepool	Not applicable: This owner-authored PR is exempt from the external-contributor proof gate; its body reports real Go builds and synthetic loopback BluOS checks, but no attached runtime trace is needed for this configuration-only review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This owner-authored PR is exempt from the external-contributor proof gate; its body reports real Go builds and synthetic loopback BluOS checks, but no attached runtime trace is needed for this configuration-only review.
Evidence reviewed	5 items	Aligned Go build selection: The Go toolchain directive is 1.26.8 while the language version remains 1.25.0, and the Docker build argument uses the same 1.26.8 compiler version. CI and release consume go.mod: Both CI and release workflows select Go through go-version-file: go.mod, so the revised toolchain directive is the shared build source of truth. pnpm metadata is lockfile-consistent: package.json requests pnpm 12.2.1 and the lockfile records the same package-manager version with platform-specific integrity entries.
Findings	None	None.
Security	None	None.

How this fits together

blucli is a Go command-line client for BluOS devices. Build metadata selects the Go compiler, package helper, and container environment that produce the CLI binary in CI and releases.

flowchart LR
  A[Source code] --> B[Go toolchain selection]
  C[Package helper] --> D[Build helpers]
  B --> D
  D --> E[Docker build]
  D --> F[CLI binary]
  E --> G[Container image]

Loading

Decision needed

Question	Recommendation
Should this owner-authored Go 1.26.8 and pnpm 12.2.1 build-tooling refresh merge after the queued macOS test completes successfully?	Approve after macOS CI: Merge once the queued macOS test succeeds, since the pinned build selectors and package lock are consistent.

Why: Repository policy keeps owner-authored work open for explicit maintainer handling, and the supplied check state still has the macOS job queued.

Before merge

• Resolve merge risk (P1) - The macOS test check is still queued in the supplied PR state, leaving one platform result pending for a toolchain update that preserves a macOS compatibility claim.
• Complete next step (P2) - Obtain explicit owner approval after the queued macOS test completes successfully.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency update scope	5 files affected; 43 added, 42 removed	The patch is limited to synchronized build selectors, changelog text, and the regenerated pnpm metadata.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Land the aligned version refresh after explicit owner approval and successful completion of the queued macOS test.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Land the aligned version refresh after explicit owner approval and successful completion of the queued macOS test.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR changes build and package tooling rather than addressing a runtime bug report.

Is this the best way to solve the issue?

Yes: updating the shared Go directive, Docker argument, pnpm declaration, and regenerated lockfile keeps all declared build entrypoints aligned without changing source compatibility.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against f6722d81355a.

Labels

Label changes:

• add P3: This is a small, low-risk build-tooling maintenance update with no claimed application behavior change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This owner-authored PR is exempt from the external-contributor proof gate; its body reports real Go builds and synthetic loopback BluOS checks, but no attached runtime trace is needed for this configuration-only review.

Label justifications:

• P3: This is a small, low-risk build-tooling maintenance update with no claimed application behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This owner-authored PR is exempt from the external-contributor proof gate; its body reports real Go builds and synthetic loopback BluOS checks, but no attached runtime trace is needed for this configuration-only review.

Evidence

What I checked:

• Aligned Go build selection: The Go toolchain directive is 1.26.8 while the language version remains 1.25.0, and the Docker build argument uses the same 1.26.8 compiler version. (go.mod:5, ffbcb5f8cd17)
• CI and release consume go.mod: Both CI and release workflows select Go through go-version-file: go.mod, so the revised toolchain directive is the shared build source of truth. (.github/workflows/ci.yml:21, ffbcb5f8cd17)
• pnpm metadata is lockfile-consistent: package.json requests pnpm 12.2.1 and the lockfile records the same package-manager version with platform-specific integrity entries. (pnpm-lock.yaml:10, ffbcb5f8cd17)
• Bounded continuation of build-tooling history: The immediate main-parent commit refreshed the same Go, pnpm, and Docker tooling; the introduced delta is five version-metadata files and passes Git's whitespace check. (Dockerfile:3, f6722d81355a)
• Unreleased PR revision: The PR head is an unmerged commit and the changelog places this work under 0.1.6 (Unreleased). (CHANGELOG.md:3, ffbcb5f8cd17)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.