chore: upgrade dependencies (2026-07-23)

[pan93412]

• chore: upgrade Nix lockfile
• chore: upgrade Go modules
• chore: upgrade Actions workflows

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Chores
  • Updated release, container publishing, and automated testing infrastructure.
  • Refreshed foundational components supporting application stability and compatibility.
  • Improved the reliability of build, validation, and deployment processes.

[coderabbitai]

📝 Walkthrough

Walkthrough

Updated direct and indirect Go dependencies in go.mod. Refreshed pinned GitHub Actions used by release builds, Docker metadata generation, registry authentication, and multi-architecture manifest creation. Updated checkout, Nix installation, and FlakeHub cache action pins in the lint and unit test workflows. Workflow logic, job definitions, commands, and tag computation remain unchanged.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: upgrading dependencies and tooling.

---

_{Comment @coderabbitai help to get the list of available commands.}

[opencodezebra]

LGTM ✅ — routine dependency upgrade with no logic changes; all version bumps are consistent and correctly pinned.
Reviewed at 3cd1b5f (round 1)

What This PR Does

Bumps all project dependencies: GitHub Actions workflows (checkout v6→v7, buildx v4.2, login v4.4, build-push v7.3, metadata v6.2, determinate-nix v3.21.8, flakehub-cache v3.21.8), the Nix flake lock (nixpkgs to a July 2026 rev), and Go modules (fiber v3.4.0, minio-go v7.2.1, fasthttp v1.72.0, otel v1.44.0, golang.org/x/* bumps, go-ini path migration).

How It Works

• Actions: SHA-pinned references updated with matching version comments across both release.yml and tests.yml.
• Nix: flake.lock points to a newer nixpkgs tarball via FlakeHub.
• Go: go.mod bumps direct deps (fiber, minio-go, x/sync) and go.sum reflects the full transitive closure including the go-ini/ini → gopkg.in/ini.v1 canonical path migration and rogpeppe/go-internal removal (no longer needed indirectly).

Findings

ID	Severity	Finding	Location
F1	🟢	actions/checkout v6→v7 major bump — SHA pinned, both workflows consistent, no custom parameters affected	.github/workflows/release.yml, .github/workflows/tests.yml
F2	🟢	go-ini/ini → gopkg.in/ini.v1 path migration correct — same upstream, no API break	go.mod
F3	🟢	All shared Docker actions use identical SHAs across every job in release.yml	.github/workflows/release.yml
F4	🟢	gofiber v3.2→v3.4 and minio-go v7.1→v7.2 are minor bumps; no source changes needed	go.mod

What's Good (🟢)

• All Actions references are SHA-pinned with matching version comments — supply-chain best practice.
• Consistent versions across both workflow files — no drift.
• go.sum additions/removals exactly match go.mod changes (clean go mod tidy).
• rogpeppe/go-internal removal is safe — no direct usage remains.

Baseline Check

• Main already has: SHA-pinned Actions, Nix dev environment, Go module setup.
• Net-new value: brings all dependencies current (security patches, bug fixes, performance improvements in transitive deps).
• CI will confirm build + lint + unit tests pass with the updated dependency set.

Review Metadata

• Reviewers: rev-claude-g (approve)
• Consensus: approve
• Absent reviewers: none

---

🔴×0 🟡×0 🟢×4 · 💬 Comment @opencodezebra <question> for a follow-up · 🔁 Push new commits or comment @opencodezebra review <fix notes> to re-run the council

[Copilot]

✅ Ready to approve

The changes are routine dependency/workflow pin updates with no functional code changes and the referenced versions appear consistent with the updated pins.

Note: this review does not count toward required approvals for merging.

Pull request overview

Updates Stratus’s build/test/release toolchain inputs by bumping Go module dependencies, refreshing the Nix flake lock, and updating pinned GitHub Actions versions to keep CI and releases current.

Changes:

• Bumped Go dependencies (Fiber v3, MinIO v7, golang.org/x/*, OpenTelemetry, etc.) and refreshed go.sum.
• Updated flake.lock to a newer nixpkgs revision from FlakeHub.
• Updated GitHub Actions workflow pins (checkout, Docker actions, DeterminateSystems Nix/cache actions).

File summaries

File	Description
go.mod	Bumps direct/indirect Go module versions used by the registry and tooling.
go.sum	Refreshes module checksums to match updated Go module graph.
flake.lock	Updates pinned Nixpkgs input for consistent Nix dev/CI environments.
.github/workflows/tests.yml	Updates pinned action SHAs for CI lint/test jobs.
.github/workflows/release.yml	Updates pinned action SHAs for build and release workflows.

Review details

• Files reviewed: 3/5 changed files
• Comments generated: 0
• Review effort level: Low

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[opencodezebra]

Council verdict: LGTM — see the council comment above.