build: refresh Go patch toolchain and Docker frontend

[steipete]

Use the Go 1.27.1 patch release for normal builds and the Docker image, while retaining the existing Go 1.27.0 source minimum. The CI test matrix now runs both compiler versions with automatic toolchain switching disabled, so the minimum-version check cannot silently upgrade itself. Also update the stable Dockerfile frontend from 1.26 to 1.27 and align the README and changelog.

The dependency audit found the runtime Go modules, Node 26.8.1, npm 12.0.2, Playwright 1.62.1, Chrome cookie helper, and Action major versions already current. No application behavior or dependency API changes are included.

Validation:

• Full Go test suite with Go 1.27.0 and Go 1.27.1: both passed; aggregate coverage 80.3% (75% required).
• Built CLI on both toolchains: help, Foodora preset/config persistence, and Deliveroo history against a synthetic loopback HTTP server passed.
• golangci-lint 2.13.2: 0 issues; go mod tidy -diff and git diff --check clean.
• Independent P0–P2 review: no actionable findings.
• Exact-head CI: both Go versions and lint passed.
• Exact-head Docker CI: image build and CLI/Node/npm/browser-directory smoke passed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 4, 2026, 6:51 AM ET / 10:51 UTC.

ClawSweeper review

What this changes

Updates the preferred Go toolchain and Docker build image to Go 1.27.1 while CI explicitly tests both Go 1.27.0 and 1.27.1.

Merge readiness

✅ Ready for maintainer review

This is a focused, validated build-maintenance PR with no actionable correctness or security finding; as an owner-authored PR, it remains open for normal maintainer judgment rather than automated cleanup.

Priority: P3
Reviewed head: e49bb910357bfadd00a3bc022be471aa1bcde8a3

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	A small, coherent build update with aligned documentation and successful exact-head validation.
Proof confidence	🌊 off-meta tidepool	Not applicable: This owner-authored PR is exempt from the external-contributor proof gate; its body and exact-head checks additionally report successful dual-toolchain CLI and Docker smoke validation.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This owner-authored PR is exempt from the external-contributor proof gate; its body and exact-head checks additionally report successful dual-toolchain CLI and Docker smoke validation.
Evidence reviewed	5 items	Explicit source minimum and preferred compiler: The module keeps Go 1.27.0 as its language-version minimum and adds a Go 1.27.1 preferred toolchain directive. CI exercises both claimed compiler versions: The introduced test job matrix selects Go 1.27.0 and 1.27.1 and disables automatic toolchain switching, so the minimum compiler is tested directly. Container build uses the preferred patch release: The Docker build argument now defaults to Go 1.27.1, matching the module's preferred toolchain.
Findings	None	None.
Security	None	None.

How this fits together

The repository builds a Go command-line client and packages it into a Docker image. The changed module metadata, CI workflow, and Docker build arguments determine which compiler validates and produces that CLI.

flowchart LR
  A[Go module metadata] --> B[Preferred Go toolchain]
  C[CI workflow] --> D[Go 1.27.0 and 1.27.1 test matrix]
  B --> E[Docker build stage]
  D --> F[CLI test and coverage results]
  E --> G[Container image]
  G --> H[Docker smoke checks]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Compiler coverage	2 Go versions tested	The CI matrix verifies both the documented Go 1.27.0 minimum and the Go 1.27.1 preferred build path.
Changed surface	5 files, 13 added, 3 removed	The patch is limited to build metadata, CI, Docker configuration, and corresponding documentation.

Technical review

Best possible solution:

Merge the narrow toolchain update after the usual owner review, retaining the dual-version CI check as the compatibility guard.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a build-maintenance change, and the exact PR head has successful CI for both compiler versions plus Docker smoke checks.

Is this the best way to solve the issue?

Yes: retaining Go 1.27.0 as the module minimum while selecting Go 1.27.1 for normal and container builds is a narrow, documented compatibility approach.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 38b362d99567.

Labels

Label changes:

• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦞 diamond lobster, so this older rating label is no longer current.
• remove merge-risk: 🚨 automation: Current PR review selected no merge-risk labels.

Label justifications:

• P3: This is a low-risk build-toolchain maintenance update with successful exact-head CI and Docker checks.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This owner-authored PR is exempt from the external-contributor proof gate; its body and exact-head checks additionally report successful dual-toolchain CLI and Docker smoke validation.

Evidence

What I checked:

• Explicit source minimum and preferred compiler: The module keeps Go 1.27.0 as its language-version minimum and adds a Go 1.27.1 preferred toolchain directive. (go.mod:3, e49bb910357b)
• CI exercises both claimed compiler versions: The introduced test job matrix selects Go 1.27.0 and 1.27.1 and disables automatic toolchain switching, so the minimum compiler is tested directly. (.github/workflows/ci.yml:13, e49bb910357b)
• Container build uses the preferred patch release: The Docker build argument now defaults to Go 1.27.1, matching the module's preferred toolchain. (Dockerfile:3, e49bb910357b)
• Exact-head validation completed: The supplied PR context records successful Docker, lint, and both Go-version test checks on this exact head, including Docker image smoke coverage. (e49bb910357b)
• Build-area history: The CI workflow's toolchain history shows Peter Steinberger authored the preceding dependency/toolchain refreshes as well as this focused update. (.github/workflows/ci.yml:13, 38b362d99567)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-04T10:47:07.971Z sha e49bb91 :: blocked before merge. :: none