chore(deps): refresh Go toolchain and archive dependencies

[steipete]

Refresh the archive's dependency stack and preferred build toolchain with compatible releases:

• SQLite v1.58.0 (SQLite 3.53.4), golang.org/x/crypto v0.56.0, and go-runewidth v0.0.29.
• Go 1.27.1 via the module's toolchain directive and a matching pinned Docker image. The supported Go minimum remains 1.27.0.
• actions/deploy-pages v5.0.1 and TruffleHog v3.97.4, with installation docs and the Unreleased changelog updated.

Keep modernc.org/libc at v1.75.6: SQLite explicitly requires its exact pinned libc version. SQLite's new Linux OFD locking stays opt-in; this change does not enable it or change the archive schema.

Validation completed locally: module checksum verification, focused store/cache-import and CLI tests, docs-site build, and a built CLI integration run against a fresh synthetic archive. The integration run imports and searches a guild message and DM, reopens the archive, confirms a repeat import preserves exactly two rows/two events, returns TUI/status JSON, passes SQLite integrity_check, and rejects SQL writes by default. Independent P0–P2 review found no actionable findings in the full change, including go.sum.

The committed-head archive-upgrade smoke also passes: a binary using the baseline dependency files created an archive with SQLite v1.57.0; the updated binary reopened, searched, and re-imported it while preserving both messages and events. The pinned Docker image builds, and its CLI returns version and metadata successfully. Go 1.27.0 still builds the CLI with GOTOOLCHAIN=local.

All checks pass at final head 1ba1ef56d229dfc4bead82cf70a02719cce6fdaa:

• Full CI: lint/analyzers, tests with coverage floor and race detector, dependency verification and vulnerability scan, six-platform snapshot builds, and gitleaks.
• CodeQL.
• Docker build.
• PR secret scan and push secret scan.

No release or deployment has been performed.

Built CLI behavior evidence (synthetic fixtures)

The candidate executable was built with Go 1.27.1 and recorded clean VCS revision 163a699a5923b4dc5840cf7ee5c5c100bf65252f. Two fixtures were used: a fresh archive and an archive populated by a binary built with the baseline dependency files (SQLite v1.57.0). Each command reopened the archive in a separate CLI process. The scanner-reference follow-up changes no application source or dependency bytes.

Operation	Observed result in both archives
Import synthetic guild and DM cache	2 messages, including 1 guild message and 1 DM
FTS search for Sapphire	Message 333333333333333346, content Sapphire guild fixture café 日本語 🦞
DM search for Emerald	Message 333333333333333347 in local guild @me, content Emerald private fixture
SQL counts before repeat import	messages=2, events=2
Re-import unchanged cache	files_scanned=0, files_unchanged=1
SQL counts after repeat import	messages=2, events=2
PRAGMA integrity_check	ok
Default DELETE FROM messages	Exit 1, read-only SQL rejection
JSON TUI and status	Valid persistent archive results

The Go 1.27.0 minimum build also succeeded with GOTOOLCHAIN=local. The built Docker image returned dev for version and crawlkit.control.v1 metadata. All data above is synthetic; no Discord credentials or personal cache data were used.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 4, 2026, 5:52 AM ET / 09:52 UTC.

ClawSweeper review

What this changes

Refreshes the preferred Go toolchain, SQLite/crypto/terminal dependencies, Docker image, related documentation and changelog, plus Pages and secret-scanning workflow actions.

Merge readiness

⛔ Blocked before merge - 5 items remain

Keep open: the dependency refresh is focused and its module/Docker CI checks have passed, but the upgraded secret-scanning action remains a mutable tag and the claimed fresh-archive integration run has no inspectable real-behavior evidence.

Priority: P2
Reviewed head: 163a699a5923b4dc5840cf7ee5c5c100bf65252f

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch is focused and several relevant automated checks passed, but immutable workflow provenance and inspectable real behavior proof remain merge blockers.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: The changed production owners are go.mod and Dockerfile, which select the toolchain and dependency graph used to build the archive CLI. The PR body describes a fresh synthetic-archive import/reopen/search run, but supplies no terminal transcript, redacted log, recording, or linked artifact showing that after-fix result under Go 1.27.1. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The changed production owners are go.mod and Dockerfile, which select the toolchain and dependency graph used to build the archive CLI. The PR body describes a fresh synthetic-archive import/reopen/search run, but supplies no terminal transcript, redacted log, recording, or linked artifact showing that after-fix result under Go 1.27.1. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	5 items	Introduced module and container update: The PR sets the preferred Go toolchain to 1.27.1, retains the 1.27.0 language minimum, updates the SQLite/crypto/terminal modules, and uses the matching Go container image. Build paths consume the manifest: CI reads go.mod through setup-go for lint, tests, dependency verification, and release checks; the Dockerfile downloads the module graph before building the CLI. Completed automated checks: The supplied PR check state records successful dependency verification, Docker build, secret scans, dispatch, and CodeQL on this head; lint, release-check, and test were still running.
Findings	1 actionable finding	[P2] Pin the upgraded secret scanner to an immutable commit
Security	Needs attention	Mutable action ref in secret-scanning workflow: The v3.97.4 tag is not immutable, so a future tag movement can alter code executed by the repository security scan after this PR is reviewed.

How this fits together

Discrawl's Go module manifest selects dependency versions and the preferred compiler for CI and source builds; Docker consumes the same manifest to build the archive CLI. Separate GitHub workflows deploy documentation and scan repository changes for verified secrets.

flowchart LR
  A[Dependency and toolchain update] --> B[Go module manifest]
  B --> C[CI toolchain selection]
  B --> D[Container build]
  D --> E[Discrawl archive CLI]
  A --> F[Workflow action updates]
  F --> G[Docs deployment and secret scanning]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: The changed production owners are go.mod and Dockerfile, which select the toolchain and dependency graph used to build the archive CLI. The PR body describes a fresh synthetic-archive import/reopen/search run, but supplies no terminal transcript, redacted log, recording, or linked artifact showing that after-fix result under Go 1.27.1. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Pin the upgraded secret scanner to an immutable commit (P2) - This introduced tag can be moved after review, causing the repository security workflow to execute code outside this diff. Replace it with the verified full commit SHA for v3.97.4 and retain the version comment.
• Resolve security concern: Mutable action ref in secret-scanning workflow - The v3.97.4 tag is not immutable, so a future tag movement can alter code executed by the repository security scan after this PR is reviewed.
• Resolve merge risk (P1) - The new TruffleHog action tag can later resolve to unreviewed workflow code; pinning the intended release to its immutable commit removes that supply-chain uncertainty.
• Complete next step (P2) - Replace the mutable TruffleHog tag with its verified v3.97.4 commit SHA and add redacted real-behavior evidence for the fresh archive import/reopen/search run under Go 1.27.1.

Findings

• [P2] Pin the upgraded secret scanner to an immutable commit — .github/workflows/secret-scan.yml:62
• [medium] Mutable action ref in secret-scanning workflow — .github/workflows/secret-scan.yml:62

Agent review details

Security

Needs attention: The dependency update changes a security workflow to a mutable third-party action reference.

Review metrics

Metric	Value	Why it matters
Maintenance surface	8 files; +18/-15; 4 Go module versions and 2 workflow actions updated	The small diff changes both the archive build graph and CI execution dependencies, so immutable action resolution and runtime evidence matter before merge.

Merge-risk options

Maintainer options:

1. Pin the secret scanner (recommended)
   Replace the mutable TruffleHog tag with the verified commit SHA for v3.97.4 so future scans execute the reviewed action revision.
2. Accept the mutable-reference risk
   Maintain the tag-based reference only if maintainers explicitly accept that future workflow executions may resolve code outside this PR's reviewed revision.

Technical review

Best possible solution:

Pin the intended TruffleHog release to its verified commit SHA and retain the version annotation, then attach a redacted terminal trace of the fresh archive import/reopen/search behavior under the selected toolchain.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-maintenance PR rather than a report of broken product behavior; the completed dependency and Docker checks exercise the changed build inputs.

Is this the best way to solve the issue?

No: the refresh is a narrow maintenance approach, but it should use an immutable secret-scanner revision and provide inspectable after-fix runtime evidence before merge.

Full review comments:

• [P2] Pin the upgraded secret scanner to an immutable commit — .github/workflows/secret-scan.yml:62
  This introduced tag can be moved after review, causing the repository security workflow to execute code outside this diff. Replace it with the verified full commit SHA for v3.97.4 and retain the version comment.
  Confidence: 0.96

Overall correctness: patch is incorrect
Overall confidence: 0.96

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 0853d40e0525.

Labels

Label changes:

• add P2: This focused maintenance PR changes the repository's secret-scanning workflow dependency and needs a normal-priority supply-chain correction before merge.
• add merge-risk: 🚨 security-boundary: The introduced mutable TruffleHog reference may execute a different third-party action revision in the repository security workflow.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The changed production owners are go.mod and Dockerfile, which select the toolchain and dependency graph used to build the archive CLI. The PR body describes a fresh synthetic-archive import/reopen/search run, but supplies no terminal transcript, redacted log, recording, or linked artifact showing that after-fix result under Go 1.27.1. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This focused maintenance PR changes the repository's secret-scanning workflow dependency and needs a normal-priority supply-chain correction before merge.
• merge-risk: 🚨 security-boundary: The introduced mutable TruffleHog reference may execute a different third-party action revision in the repository security workflow.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The changed production owners are go.mod and Dockerfile, which select the toolchain and dependency graph used to build the archive CLI. The PR body describes a fresh synthetic-archive import/reopen/search run, but supplies no terminal transcript, redacted log, recording, or linked artifact showing that after-fix result under Go 1.27.1. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

• [medium] Mutable action ref in secret-scanning workflow — .github/workflows/secret-scan.yml:62
  The v3.97.4 tag is not immutable, so a future tag movement can alter code executed by the repository security scan after this PR is reviewed.
  Confidence: 0.96

What I checked:

• Introduced module and container update: The PR sets the preferred Go toolchain to 1.27.1, retains the 1.27.0 language minimum, updates the SQLite/crypto/terminal modules, and uses the matching Go container image. (go.mod:3, 163a699a5923)
• Build paths consume the manifest: CI reads go.mod through setup-go for lint, tests, dependency verification, and release checks; the Dockerfile downloads the module graph before building the CLI. (.github/workflows/ci.yml:27, 163a699a5923)
• Completed automated checks: The supplied PR check state records successful dependency verification, Docker build, secret scans, dispatch, and CodeQL on this head; lint, release-check, and test were still running. (163a699a5923)
• Mutable secret-scanner reference: The introduced workflow change resolves TruffleHog through the mutable v3.97.4 tag rather than an immutable commit, so a later tag change could run code not reviewed in this PR. (.github/workflows/secret-scan.yml:62, 163a699a5923)
• Relevant maintenance history: Recent merged main history includes the prior Go dependency/tooling refresh commit 4c29bb7 and the Go floor update ef2eb5b by the same area contributor. (go.mod:3, 4c29bb75ef7f)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Replace the mutable TruffleHog reference with the verified immutable commit SHA for v3.97.4.
• Post a redacted terminal trace of the built CLI importing, reopening, and searching the fresh synthetic archive under the selected toolchain; update the PR body to trigger a fresh review, or ask a maintainer to comment @clawsweeper re-review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.