build(deps): refresh Go and GitHub Actions dependencies - #158
Conversation
clawsweeper
Bot
added
rating: 🐚 platinum hermit
|
Codex review: needs maintainer review before merge. Reviewed August 1, 2026, 11:59 PM ET / August 2, 2026, 03:59 UTC. ClawSweeper reviewWhat this changesRefreshes Go modules, the Alpine runtime image, and CodeQL/stale GitHub Actions versions while retaining the existing workflow policy settings. Merge readinessThis focused dependency refresh has strong real behavior proof and no discrete correctness defect, but it changes write-capable stale-item automation and brings in a dependency flagged by Socket for likely obfuscated code. As a collaborator-authored PR, it should remain open for an explicit maintainer supply-chain and automation-risk decision. Priority: P3 Review scores
Verification
How this fits togetherDiscrawl’s release container packages the Go CLI, while GitHub Actions run code scanning and periodically label or close inactive repository items. This PR updates the dependencies and action runtimes used by those build, security, and maintenance paths without changing their declared policy inputs. flowchart LR
A[Go module graph] --> B[CLI build and SQLite archive]
C[Docker build arguments] --> D[Runtime container]
E[Stale schedule] --> F[Write-capable cleanup action]
G[CodeQL schedule] --> H[Security analysis]
B --> D
F --> I[Issue and PR labels or closures]
H --> J[Code scanning results]
Decision needed
Why: The patch and real behavior proof support the intended update, but accepting a flagged dependency and a third-party action capable of labeling or closing repository items requires repository security and automation-risk judgment. Before merge
Findings
Agent review detailsSecurityNeeds attention: The diff changes a write-capable GitHub Action and resolves a dependency flagged by Socket for likely obfuscated code, so a maintainer must explicitly assess those supply-chain risks. Review metrics
Root-cause clusterRelationship: Members:
Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything. Merge-risk optionsMaintainer options:
Technical reviewBest possible solution: Merge the combined refresh only after a maintainer reviews and records a disposition for the Socket alert and accepts the write-capable stale-action upgrade supported by the recorded branch dispatch. Do we have a high-confidence way to reproduce the issue? Not applicable: this PR is dependency and workflow maintenance rather than a reported runtime defect. The contributor nevertheless supplied real branch-run evidence for the updated binary, container, and stale workflow. Is this the best way to solve the issue? Unclear: the combined refresh is mechanically narrow and validated, but merging the flagged AGENTS.md: not found in the target repository. Codex review notes: model internal, reasoning high; reviewed against 8141387a4f95. LabelsLabel changes:
Label justifications:
EvidenceSecurity concerns:
What I checked:
Likely related people:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (1 earlier review cycle)
|
|
Live proof for the Before dispatch, the live queue had zero open issues and every open PR was at most two days old, below all 14/27/30-day mutation thresholds. I then manually dispatched the branch's Stale workflow at Run: https://github.com/openclaw/discrawl/actions/runs/30730981192 All three v11 steps completed successfully: No queue item was eligible for a label or closure. This provides the missing live behavior proof for the write-capable major action update without altering repository policy. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
clawsweeper
Bot
added
proof: sufficient
|
Landed as Verification before landing:
Local Docker was unavailable; the exact-head Docker CI run supplied the container proof. |
1 participant
Summary
This supersedes #155, #156, and #157. In particular, #156 targets CodeQL Action v4.37.3, but v4.37.4 was released before this sweep.
Dependency changes
Go 1.26.5 was checked against the official Go downloads feed and remains current. Alpine's official latest-stable feed reports v3.24 (currently 3.24.1).
Validation
Passed module verification/tidiness, gofumpt, golangci-lint, go vet, staticcheck, gosec, govulncheck, dead-code analysis, 85.1% coverage, the race suite, CLI smoke checks, and a six-platform GoReleaser snapshot.
Live proof used the real built binary with isolated XDG config/data/cache/state roots:
The status run initialized and queried a fresh SQLite archive through the updated Crawlkit/modernc stack.
The branch-specific
actions/stale@v11workflow completed all three policy passes successfully: https://github.com/openclaw/discrawl/actions/runs/30730981192. No live queue item met a mutation threshold.The fresh-head Docker job built the Alpine 3.24 image with
--pull, then ran the real container's--version,--help, and bundledgit --versionsmokes successfully: https://github.com/openclaw/discrawl/actions/runs/30731424236/job/91452409273.AutoReview ran separately before each commit and returned no accepted/actionable findings.