chore: update dependencies and build tools to current releases

[darksworm]

Summary

• Update Go libraries and pinned CI actions to current releases to keep the app and release tools maintained.
• Use Go 1.27 for builds, Alpine 3.24 for containers, and NixOS 26.05 inputs with a fresh vendor hash. The updated libraries require at least Go 1.26.

Validation

• Unit tests, Staticcheck, formatting, module checks, and a static binary build pass.
• Mock e2e tests pass at parallelism 4 with two TLS tests excluded. Those tests fail because their certificate fixtures expired on September 26, 2026. Higher parallelism also produced timing failures.
• Nix builds and its tests pass when Git is supplied as a test input. The default build still fails because the test environment lacks Git.
• Existing checks still report unreachable code in cmd/app/input_handlers.go:784 and unsafe branch-name interpolation in the Nix workflow.
• Container builds could not run because Docker is not running. Live Argo CD tests were not run.

Existing local changes to CLAUDE.md are not included.

💘 Generated with Crush

Summary by CodeRabbit

• Chores
  • Updated the Go toolchain and supporting build, test, packaging, and publishing tools.
  • Updated the Docker runtime base image and Nix package environment.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d9bab11e-b81e-460b-bb95-9d86ea629a02

📥 Commits

Reviewing files that changed from the base of the PR and between b809695 and 3c6fedb.

📒 Files selected for processing (1)

• e2e/tls_cert_test.go

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

Walkthrough

This PR updates the Go toolchain and module dependencies, moves container images to newer Go and Alpine versions, and updates pinned actions and tool versions across CI, publishing, and release workflows. TLS end-to-end tests now generate temporary certificates instead of loading checked-in certificates.

Changes

Build and automation updates

Layer / File(s)	Summary
Go build inputs go.mod, flake.nix, Dockerfile	The Go module requirement changes to 1.26.0, and several direct and indirect dependencies are updated. The Nix package and development shell, and the Docker builder image, use Go 1.27. The Nix input and vendor hash also change.
CI and release workflow updates .github/workflows/*	Pinned GitHub Actions are updated across test, prerelease, release, GoReleaser, AUR publishing, and Nix vendor-hash workflows. Workflow Go targets change to 1.27 where configured.
Container runtime images Dockerfile, Dockerfile.runtime, Dockerfile.v2	The runtime Alpine base images change from 3.20 to 3.24.
TLS test certificates e2e/tls_cert_test.go	TLS end-to-end tests generate temporary CA, server, and client certificates. Existing tests use the generated certificates for untrusted server, trusted server, and client-authentication cases.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 3c6fe

The TLS tests generate valid certificates for their runs; no confirmed issue from this review prevents merging after normal checks.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 83.33% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 1 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Tests	✅ Passed	The pull request adds focused TLS end-to-end coverage for the changed certificate-fixture behavior. Each TLS test now creates temporary CA, server, and client certificates that remain valid during the…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the primary changes: dependency, CI action, Go toolchain, container, and build-tool updates.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[darksworm]

@coderabbitai check the latest commit please

[coderabbitai]

@darksworm I’ll review the latest commit in #288.

⚠️ Action not completed

Already reviewed the last commit. Use @coderabbitai full review to rerun a review of the entire changeset.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.