[bryan-minimal]

Why now

It unblocks the croc security fix (#750, GHSA-x89h). croc 11.5.2 (the fix release) and 11.5.3 both declare go 1.27.0 in go.mod, and our build uses GOTOOLCHAIN=local, so #750's minimal build fails on both arches:

go: go.mod requires go >= 1.27.0 (running go 1.26.8; GOTOOLCHAIN=local)

A no-op re-run can't fix that. Patching croc's go.mod down would mean guessing whether it uses 1.27 APIs, and letting it download a toolchain would break offline builds. Bumping Go is the honest path.

Checksums

From go.dev's official release manifest (https://go.dev/dl/?mode=json):

go1.27.1.linux-amd64.tar.gz   63d339f0...90168445   70,553,950 bytes
go1.27.1.src.tar.gz           4e408aba...2ab238b1   35,109,201 bytes

No hex0 re-root needed (a minor bump, so checked)

Go's rule, from src/cmd/dist/build.go:480 at go1.27.1: Go 1.N bootstraps from Go 1.M, "where M is N-2 rounded down to an even number". For 1.27 that's 1.24, enforced by notgo124.go. The arm64 leg's bedrock root is go1.24.9 (the hex0 ladder), so its Source block is untouched. The diff is 3 lines: version plus the two checksums.

Blast radius

50 packages build with go and will rebuild:
act, age, bun, caddy, chezmoi, cloud-sql-proxy, cloudflared, cosign, crane, croc, dive, duf, esbuild, fq, fzf, gh, git-lfs, gitleaks, glow, go-swagger, golangci-lint, goose, govulncheck, grpcurl, grype, helm, jqfmt, k9s, kubectl, lazydocker, lazygit, mermaid-ascii, minimal-sshd, mkcert, nats-cli, nats-server, otel-collector, podman-remote, pulumi, restic, scrt, skopeo, sops, spire, syft, tailscale, terraform, trivy, vhs, yq.

A Go minor release can surface new vet or compile errors in dependents, so minimal build on this PR is the real verification.

After this merges

I'll update #750 (croc) from main, and its build should go green.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Updates
  • Updated the packaged Go version to 1.27.1.
• Bug Fixes
  • Fixed Trivy builds to work with the updated Go toolchain’s JSON behavior.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: 0565852a-c761-48ee-9bde-5c8242363046

📥 Commits

Reviewing files that changed from the base of the PR and between 660b385 and 28375f1.

📒 Files selected for processing (2)

• packages/go/build.ncl
• packages/trivy/build.sh

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/go/build.ncl

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

---

📝 Walkthrough

Walkthrough

The Go recipe updates to version 1.27.1 and its matching source archive digest. The Trivy build adds a Go 1.27 JSON compatibility patch, applies it, and checks for remaining Go 1.26-only patterns.

Changes

Go 1.27 build updates

Layer / File(s)	Summary
Update Go version and source archive digest packages/go/build.ncl	The recipe changes from version 1.27.0 to 1.27.1 and updates the source archive SHA-256 digest. The source URL template remains unchanged.
Apply and verify the Trivy JSON patch packages/trivy/go127-json-skipfunc.patch, packages/trivy/build.ncl, packages/trivy/build.sh	The patch replaces two json.SkipFunc returns with errors.ErrUnsupported and changes the Rego input tag from inline to embed. The Trivy build applies the patch and fails if non-test Go files still contain either Go 1.26-only pattern. The previous json.SkipFunc rewrite bridge is removed.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 28375

The Go update and Trivy compatibility patch have no established merge-blocking issue. Complete the intended minimal build before merging.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: updating Go from 1.26.8 to 1.27.1. It also states the main purpose of the update by referencing the croc security fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[bryan-minimal]

First build on 1.27.1: 49 of 50 Go packages built fine. The exception was trivy (v0.74.0), on both arches: pkg/x/json/json.go:109:16: undefined: json.SkipFunc. Go 1.27's encoding/json/v2 dropped SkipFunc (the fall-back sentinel is now errors.ErrUnsupported). Upstream fixed it on main in aquasecurity/trivy@dc3c56eed5, but it isn't released, so I've added that one hunk (+3/−1, verified to apply cleanly to v0.74.0) as a named patch on trivy, with a landed-check. Drop it at the next trivy release. Rebuilding now.

[bryan-minimal]

/build