chore(deps): refresh eligible parser and artifact action pins

[steipete]

Refresh the remaining eligible dependency pins after the previous sweep: modernc.org/cc/v4 moves from v4.29.2 to v4.29.6, and the automation guide now uses the verified SHA for actions/upload-artifact v7.0.1 instead of v4. The parser is a transitive test dependency of SQLite's libc; application behavior is unchanged. Regenerated go.sum and added one Unreleased entry.

The three-day cooldown holds CrawlKit v0.16.2, golden's September 13 pseudo-version, and cc/v4 v4.29.7. SQLite still requires libc v1.75.6, which also prevents ccgo/v4 v4.35.2 (requires libc v1.75.7). Charm's v2 stack requires a coordinated view/input/color migration and live terminal coverage, so it remains outside this dependency refresh. Go 1.27.1, Node 26.8.2, GoReleaser 2.18.1, sqlc 1.31.1, govulncheck 1.8.0, deadcode 0.50.0, Docker images, and executable workflow action pins are already current. The shared release-workflow v1 alias resolves to v1.8.2.

Validation on head d6aee98315ab227333c0fb951dbe1dcac6b3215b:

• Local frozen install: GOWORK=off GOFLAGS=-mod=readonly go mod download and go mod verify passed; module files remain tidy.
• Local Go 1.27.1 build passed. Binary build metadata reports this exact commit and vcs.modified=false.
• Exact-head CI passed: full Go tests with the existing 85% coverage gate on Linux and macOS, vet, govulncheck, deadcode, formatting/tidiness, release-script tests, all six snapshot targets, Windows portability/build smoke, and the Node 26.8.2 docs tests/build.
• Docker build and running-image smoke, all four CodeQL analyses, and secret scanning passed.
• Live built-CLI proof passed against a loopback HTTP fixture in an isolated runtime: init; sync fixture/deps --numbers 101 --include-comments (1 issue, 1 comment); keyword search SQLite returned issue fix(store): order hydration observations durably #101, “SQLite dependency proof”; thread reads, status JSON, version, and TUI help all succeeded. Only synthetic data and a dummy fixture credential were used.
• Independent autoreview: scoped-clean, no accepted/actionable P0–P2 findings.

No tests were removed or weakened. No release, tag, application version bump, or manual deployment. No open Dependabot PR is superseded.

Supplemental local validation: smoke, release-script tests, and all documentation tests/build passed. The full local coverage run hit Go’s 10-minute package limit in CLI/store without assertion failures; the two cases interrupted by the package timer passed isolated rechecks (1.36s and 8.98s). Full-suite and coverage-gate evidence is the green Linux/macOS CI above.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review in progress

ClawSweeper is reviewing this revision. This supersedes any previous blocked status.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 13, 2026, 11:47 AM ET / 15:47 UTC.

ClawSweeper review

What this changes

Updates an indirect C-parser dependency to v4.29.6, pins the automation guide’s artifact-upload example to v7.0.1, and records the refresh in the changelog.

Merge readiness

⛔ Blocked before merge - 2 items remain

The refresh remains distinct from main and v0.9.6. No actionable patch defect was found, but the promised real CLI validation has not yet been recorded.

Priority: P3
Reviewed head: d6aee98315ab227333c0fb951dbe1dcac6b3215b

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch is focused and has no identified correctness defect, but real behavior evidence remains thin.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: The module refresh is claimed to preserve Gitcrawl’s SQLite archive behavior, but the promised built-CLI archive run has no recorded entrypoint, environment, or observed result yet; module verification and CI are supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The module refresh is claimed to preserve Gitcrawl’s SQLite archive behavior, but the promised built-CLI archive run has no recorded entrypoint, environment, or observed result yet; module verification and CI are supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	6 items	Verified introduced scope: The pinned base-to-head diff contains only CHANGELOG.md, docs/automation.md, go.mod, and go.sum; SQLite and libc versions remain unchanged. The working tree was clean. Main and release still use earlier pins: Current main retains upload-artifact@v4 and lacks the explicit cc/v4 v4.29.6 requirement; v0.9.6 records cc/v4 v4.29.2. No merged replacement was established. Upstream action identity and input compatibility: GitHub resolves v7.0.1 to the exact documented SHA. Its action.yml retains name/path inputs and defaults to archive uploads; it runs on Node 24. This dependency contract applies directly to the changed executable example.
Findings	None	None.
Security	None	None.

How this fits together

Gitcrawl stores searchable GitHub archives in SQLite; this refresh changes dependency selection in its Go module graph. The separate documentation example uploads generated triage reports as GitHub Actions artifacts.

flowchart LR
  A[Go module pins] --> B[SQLite dependency graph]
  B --> C[Gitcrawl archive CLI]
  C --> D[JSON triage reports]
  D --> E[Documented artifact upload]
  E --> F[GitHub Actions artifact]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: The module refresh is claimed to preserve Gitcrawl’s SQLite archive behavior, but the promised built-CLI archive run has no recorded entrypoint, environment, or observed result yet; module verification and CI are supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Complete next step (P2) - Add the promised after-change built-CLI archive proof to the PR body. Terminal output or redacted logs count; screenshots or recordings are welcome when useful. Remove private endpoints, credentials, and other private data. Updating the body should trigger review automatically; otherwise ask a maintainer to comment @clawsweeper re-review.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep the refresh narrowly scoped and substantiate the unchanged archive behavior with the promised built-CLI validation.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR refreshes dependency pins rather than reporting broken existing behavior.

Is this the best way to solve the issue?

Yes: the small module override and immutable action pin fit the stated maintenance goal without changing SQLite/libc versions or application code.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 223f23dd3b75.

Labels

Label changes:

• add P3: This is a bounded dependency and documentation refresh with no demonstrated urgent user-facing failure.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The module refresh is claimed to preserve Gitcrawl’s SQLite archive behavior, but the promised built-CLI archive run has no recorded entrypoint, environment, or observed result yet; module verification and CI are supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P3: This is a bounded dependency and documentation refresh with no demonstrated urgent user-facing failure.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The module refresh is claimed to preserve Gitcrawl’s SQLite archive behavior, but the promised built-CLI archive run has no recorded entrypoint, environment, or observed result yet; module verification and CI are supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Verified introduced scope: The pinned base-to-head diff contains only CHANGELOG.md, docs/automation.md, go.mod, and go.sum; SQLite and libc versions remain unchanged. The working tree was clean. (go.mod:49, d6aee98315ab)
• Main and release still use earlier pins: Current main retains upload-artifact@v4 and lacks the explicit cc/v4 v4.29.6 requirement; v0.9.6 records cc/v4 v4.29.2. No merged replacement was established. (go.sum:96, b72d4ae715d6)
• Upstream action identity and input compatibility: GitHub resolves v7.0.1 to the exact documented SHA. Its action.yml retains name/path inputs and defaults to archive uploads; it runs on Node 24. This dependency contract applies directly to the changed executable example. (action.yml, 043fb46d1a93)
• Action release provenance: The upstream v7.0.1 release was published on 2026-04-10, comfortably outside the target repository’s three-day dependency cooldown. (043fb46d1a93)
• Captured proof remains pending: The complete supplied body and matching live body report successful module download/verification, but explicitly leave make check and built-CLI synthetic archive proof in progress. The two discussion comments contain review-status messages, with no runtime transcript. Captured context sourceRevision: 66dc60fc1d148e0533549eada020ea04b4c84f0dbca3fe10e7bd46f5e90fd0df. (d6aee98315ab)
• Prior dependency-maintenance routing: Main history includes a prior dependency refresh by Peter Steinberger; GitHub commit metadata maps that author to steipete. Some deeper local history reads failed because historical objects could not be fetched, so no source-line introduction claim is made. (go.mod, c76c06dffea3)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Record the promised built-CLI archive validation with commands, environment, and observed results using the updated module graph.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.