build: move Go floor to 1.26.6

[steipete]

Summary

• move the repository Go floor and release assertions from 1.26.5 to 1.26.6
• pin the Docker builder to the fresh 1.26.6-alpine manifest digest
• clear GO-2026-5026, GO-2026-5972, GO-2026-6090, and GO-2026-6218

Proof

• GOTOOLCHAIN=go1.26.6 go build ./...
• GOTOOLCHAIN=go1.26.6 go test ./...
• GOTOOLCHAIN=go1.26.6 ./scripts/test-release-local.sh
• GOTOOLCHAIN=go1.26.6 ./scripts/test-release-assets.sh
• built cmd/gog with Go 1.26.6 and verified --version reports v0.36.0
• autoreview clean with no accepted or actionable findings

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs changes before merge. Reviewed August 14, 2026, 4:18 AM ET / 08:18 UTC.

ClawSweeper review

What this changes

The PR raises the Go floor to 1.26.6 across the module, Docker builder, local release preparation, and release-test fixtures.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep open: the Go 1.26.6 release download is still checked against the prior version’s Darwin archive hashes, so official macOS release builds will fail integrity verification.

Priority: P1
Reviewed head: 42ca6a386033b8228373ac5fadb2d723f46bac70

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and mostly consistent, but the missing release checksum update blocks safe merge.
Proof confidence	🌊 off-meta tidepool	Not applicable: This collaborator-authored maintenance PR is not subject to the external-contributor real-behavior-proof gate; its stated command coverage did not exercise the missing live archive checksum mapping.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This collaborator-authored maintenance PR is not subject to the external-contributor real-behavior-proof gate; its stated command coverage did not exercise the missing live archive checksum mapping.
Evidence reviewed	4 items	New archive name uses stale integrity pins: The changed release path downloads go1.26.6, but its arm64 and amd64 expected SHA-256 values remain unchanged and are passed to the archive verifier; the new Go archives therefore cannot satisfy the prior-version pins. Current pin provenance: Blame attributes the existing checksum mapping to the current release baseline, confirming the untouched hashes predate this toolchain bump. Released baseline: The current release baseline commit containing the 1.26.5 release configuration is shipped as v0.36.0; this PR is not already present on main or in that release.
Findings	1 actionable finding	[P1] Update the Go 1.26.6 Darwin archive checksums
Security	None	None.

How this fits together

gogcli’s local release path downloads a pinned Go archive for macOS, verifies its checksum, then uses it to build release artifacts. The module and Dockerfile separately define the toolchain used for ordinary builds and container builds.

flowchart LR
  A[Go version floor] --> B[Module and Docker builds]
  A --> C[Local release preparation]
  C --> D[Download Go archive]
  D --> E[Checksum verification]
  E --> F[macOS release artifacts]

Loading

Before merge

• Update the Go 1.26.6 Darwin archive checksums (P1) - This changes the downloaded archive to go1.26.6, but go_archive_expected still contains the prior arm64 and amd64 hashes and is passed to download_pinned_release_archive. Both official macOS release paths will reject the new archive before building; replace the two pins with the official 1.26.6 checksums and cover the mapping.
• Resolve merge risk (P1) - Merging as-is makes the official macOS release path fail closed when it verifies either downloaded Go 1.26.6 archive against the stale SHA-256 pin.
• Complete next step (P2) - A narrow, mechanical release-script correction can repair the blocking checksum mismatch without a product decision.

Findings

• [P1] Update the Go 1.26.6 Darwin archive checksums — scripts/release-local:298

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Version propagation	5 files changed; 12 additions, 12 deletions	The version is propagated through build, release, and test surfaces, but the adjacent release integrity mapping was omitted.

Merge-risk options

Maintainer options:

1. Update the Go archive pins before merge (recommended)
   Replace both Darwin archive SHA-256 values with the official Go 1.26.6 checksums and validate the release preparation path without weakening checksum enforcement.
2. Pause the version bump
   Defer the Go-floor update if the official 1.26.6 archive checksums cannot be independently verified for both supported macOS architectures.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Update both Darwin Go 1.26.6 archive SHA-256 pins, retain checksum verification, and run the release-script regression checks.

Technical review

Best possible solution:

Update both Darwin Go 1.26.6 archive SHA-256 pins from the official Go release checksums, preserve fail-closed verification, and add a focused assertion that keeps archive names and checksum pins synchronized.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: invoking the official release preparation path downloads a Go 1.26.6 Darwin archive and validates it with the unchanged pre-bump SHA-256 value on either supported host architecture.

Is this the best way to solve the issue?

No: the synchronized version edits are appropriate, but the release checksum mapping must be updated alongside the archive filename to keep the existing fail-closed release path usable.

Full review comments:

• [P1] Update the Go 1.26.6 Darwin archive checksums — scripts/release-local:298
  This changes the downloaded archive to go1.26.6, but go_archive_expected still contains the prior arm64 and amd64 hashes and is passed to download_pinned_release_archive. Both official macOS release paths will reject the new archive before building; replace the two pins with the official 1.26.6 checksums and cover the mapping.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a4c96debef00.

Labels

Label changes:

• add P1: The patch would block official macOS release production on both supported host architectures.
• add merge-risk: 🚨 compatibility: Raising the required Go toolchain changes the supported build environment for existing contributors and release operators.
• add merge-risk: 🚨 availability: The stale checksum pins cause the release workflow to stop before producing macOS artifacts.
• add merge-risk: 🚨 automation: The affected checksum validation runs in scripted release automation and is not corrected by the current test-fixture updates.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This collaborator-authored maintenance PR is not subject to the external-contributor real-behavior-proof gate; its stated command coverage did not exercise the missing live archive checksum mapping.

Label justifications:

• P1: The patch would block official macOS release production on both supported host architectures.
• merge-risk: 🚨 compatibility: Raising the required Go toolchain changes the supported build environment for existing contributors and release operators.
• merge-risk: 🚨 availability: The stale checksum pins cause the release workflow to stop before producing macOS artifacts.
• merge-risk: 🚨 automation: The affected checksum validation runs in scripted release automation and is not corrected by the current test-fixture updates.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This collaborator-authored maintenance PR is not subject to the external-contributor real-behavior-proof gate; its stated command coverage did not exercise the missing live archive checksum mapping.

Evidence

Acceptance criteria:

• [P1] GOTOOLCHAIN=go1.26.6 ./scripts/test-release-local.sh.
• [P1] GOTOOLCHAIN=go1.26.6 ./scripts/test-release-assets.sh.
• [P1] GOTOOLCHAIN=go1.26.6 go test ./...
• [P1] make ci.

What I checked:

• New archive name uses stale integrity pins: The changed release path downloads go1.26.6, but its arm64 and amd64 expected SHA-256 values remain unchanged and are passed to the archive verifier; the new Go archives therefore cannot satisfy the prior-version pins. (scripts/release-local:298, 42ca6a386033)
• Current pin provenance: Blame attributes the existing checksum mapping to the current release baseline, confirming the untouched hashes predate this toolchain bump. (scripts/release-local:260, eaa5d6316890)
• Released baseline: The current release baseline commit containing the 1.26.5 release configuration is shipped as v0.36.0; this PR is not already present on main or in that release. (scripts/release-local:298, eaa5d6316890)
• Diff scope: The PR updates the version assertions consistently in five files, but does not modify the checksum mapping in the release script. (scripts/release-local:298, 42ca6a386033)

Likely related people:

• steipete: Introduced the current release baseline and its Go archive checksum mapping, and authored this follow-up Go-floor update. (role: current release-tooling contributor; confidence: high; commits: eaa5d6316890, 42ca6a386033; files: scripts/release-local, Dockerfile, go.mod)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Update both official Go 1.26.6 Darwin SHA-256 pins.
• Run the release-script regression checks against the repaired mapping.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.