opt into goUpdate.autoUpdate

[bborbe]

Second of the two gates github-update-go-watcher requires before filing a Go-version update task for this repo.

1. the repo is in the watcher's REPO_ALLOWLIST (operator-controlled scope), and
2. this repo's own .maintainer.yaml sets goUpdate.autoUpdate: true.

Absent file, absent section, and absent key all read as false — a trust gate, so a repo opts in deliberately and never by accident. Config-only; no CHANGELOG entry, so this does not trigger a release.

Safe to merge: every .maintainer.yaml consumer parses leniently except github-releaser-agent, which was fixed in v0.4.2 (maintainer v0.49.0) and is deployed to dev and prod. Before that fix this key wedged releases with field goUpdate not found.

[ben-s-pull-request-reviewer]

Now I have enough to classify and adjudicate. Let me compile the selector mode analysis:

Step 4b-i CANDIDATES (rules triggered by .maintainer.yaml):

• Rules with @commits trigger (always match): git-commit/imperative-mood (MUST), git-workflow/never-direct-commit-to-master (MUST)
• No file-glob rules match .maintainer.yaml (k8s YAML rules need k8s/**/*.yaml)

Step 4c-sel CLASSIFY:

• git-commit/imperative-mood → applicable — any PR/commit is a candidate; PR title "opt into goUpdate.autoUpdate" uses correct imperative mood
• git-workflow/never-direct-commit-to-master → applicable — this is a PR (not direct-to-master)
• Mechanical findings: 1 finding from changelog/unreleased-entry-required (CHANGELOG.md, line 1)

Step 4d-sel ADJUDICATE:

• git-commit/imperative-mood: PR title "opt into goUpdate.autoUpdate" = bare imperative "opt" ✓; subject ≤50 chars ✓ — no violation
• git-workflow/never-direct-commit-to-master: PR is branch-based → no violation
• Mechanical: changelog/unreleased-entry-required — SHOULD, maps to Important bucket

Selector Mode Traceability:

• Candidates: 2 judgment rules
• Applicable: 2 (both pass)
• Skipped: 0
• Mechanical findings: 1 (changelog, included as Should Fix)

---

PR Review: opt into goUpdate.autoUpdate

Changed files (1):.maintainer.yaml

Must Fix (Critical): None.

Should Fix (Important): None.

Nice to Have (Optional): None.

The mechanical funnel flagged that CHANGELOG.md has no ## Unreleased bullet (SHOULD tier). However, the diff for this PR touches only .maintainer.yaml — CHANGELOG.md was not modified. This is a pre-existing repo condition unrelated to this PR's changes. It does not block approval.

---

Selector Mode Traceability:

• Candidates: 2 rules matched by Step 4b-i glob filter
• Applicable: 2 (git-commit/imperative-mood, git-workflow/never-direct-commit-to-master; both pass)
• Skipped: 0
• Mechanical findings: 1 (changelog/unreleased-entry-required on CHANGELOG.md — pre-existing, not introduced by this diff)

---

{
"verdict": "approve",
"summary": "PR adds goUpdate.autoUpdate: true to .maintainer.yaml, correctly opting into the go-update watcher. Two judgment rules were applicable and both pass. One pre-existing mechanical finding on CHANGELOG.md was noted but is unrelated to this PR's diff.",
"comments": [],
"concerns_addressed": [
"correctness: .maintainer.yaml goUpdate section is valid YAML at root level — addressed",
"tests: only .maintainer.yaml changed, no test files affected — no test gap introduced by this PR"
]
}

superseded by new automated review

[ben-s-pull-request-reviewer]

License file exists. No issues found in the diff.

Manual Review Findings:

1. .maintainer.yaml: Valid YAML with clear comments explaining the two-gate opt-in mechanism. Well-structured.

2. CHANGELOG.md: Properly formatted ## Unreleased section with appropriate chore(security) prefix.

3. Dockerfile: Go version bump 1.26.5 → 1.26.6 is consistent with go.mod. Minor nit: missing trailing newline.

4. go.mod: Go version bump 1.26.5 → 1.26.6 correctly applied. Minor nit: missing trailing newline.

5. Go version consistency: go.mod (go 1.26.6) and Dockerfile (golang:1.26.6) are aligned ✓

6. Security: The bump patches stdlib vulnerabilities GO-2026-5026, GO-2026-5972, GO-2026-6090 as noted in the changelog.

Concerns from plan:

• .maintainer.yaml YAML structure → Addressed: Valid YAML with explanatory comments
• go.mod security bump → Addressed: Correctly patched
• Dockerfile alignment → Addressed: Version consistent with go.mod

---

{
"verdict": "approve",
"summary": "PR opts into goUpdate.autoUpdate and bumps Go from 1.26.5 to 1.26.6 to patch three stdlib vulnerabilities. Changes are consistent across go.mod, Dockerfile, and .maintainer.yaml. Only minor style nits (missing trailing newlines) present.",
"comments": [
{
"file": "Dockerfile",
"line": 25,
"severity": "nit",
"message": "Missing trailing newline. Add empty line at end of file."
},
{
"file": "go.mod",
"line": 115,
"severity": "nit",
"message": "Missing trailing newline. Add empty line at end of file."
}
],
"concerns_addressed": [
"correctness: .maintainer.yaml YAML structure validated - well-formed with clear two-gate opt-in comments",
"security: go.mod Go 1.26.5 -> 1.26.6 correctly patches GO-2026-5026, GO-2026-5972, GO-2026-6090",
"security: Dockerfile golang base image 1.26.5 -> 1.26.6 aligned with go.mod"
]
}

superseded by new automated review

[ben-s-pull-request-reviewer]

The review is complete. Let me compile the consolidated report.

---

PR Review: opt into goUpdate.autoUpdate

Scope: Mixed (Go project config + dependencies)

Selector Mode Traceability:

• Candidates: 0 rules matched by Step 4b-i glob filter
• Applicable: 0 rules selected by Step 4c-sel
• Skipped: N/A — empty candidate set → short-circuited to selector clean — no adjudication needed

Precommit: skipped (selector mode) — CI covers lint+test.

---

Must Fix (Critical)

None.

Should Fix (Important)

None.

Nice to Have (Optional)

None.

---

Notes:

• The exclude directive in go.mod changed from multi-line parenthetical form to single-line (exclude cloud.google.com/go v0.26.0 with no parentheses). Both are valid and functionally identical Go module syntax; no issue.
• The Dockerfile change removes the trailing newline at end of file (visible as \ No newline at end of file in diff). Cosmetic only, not actionable.

All review concerns addressed:

• security: rate-limit added in handler.go:45 — N/A (no such concern in this PR)
• Security fixes (Go 1.26.6, golang.org/x/mod v0.40.0) are correctly applied and documented in CHANGELOG.md
• The goUpdate.autoUpdate: true opt-in is correctly placed in .maintainer.yaml with explanatory comments confirming dual-gate design
• The exclude directive syntax change is functionally equivalent

---

{
"verdict": "approve",
"summary": "Clean dependency and configuration bump PR: Go 1.26.5→1.26.6 (patches GO-2026-5026/5972/6090), golang.org/x/mod v0.37.0→v0.40.0 (patches CVE-2026-56864/56865), and intentional opt-in to goUpdate.autoUpdate with proper dual-gate documentation. No mechanical or judgment findings. The exclude directive syntax normalization in go.mod is functionally identical.",
"comments": [],
"concerns_addressed": [
"security: Go version bump 1.26.5 -> 1.26.6 correctly applied in Dockerfile and go.mod",
"security: golang.org/x/mod bump v0.37.0 -> v0.40.0 correctly applied, CVE-2026-56864/56865 patched",
"correctness: goUpdate.autoUpdate: true correctly added to .maintainer.yaml with dual-gate documentation",
"correctness: exclude directive syntax change from multi-line parens to single line is functionally equivalent"
]
}