[welteki]

Why do you need this?

Keep the build toolchain and dependencies current for k3sup's SSH provisioning and registry download paths.

• I have raised an issue to propose this change (required)

Description

Use Go 1.27 in the module and Go 1.27.x in both build and publish workflows.

Update Arkade, go-containerregistry, x/crypto, x/term and their transitive dependencies, and regenerate the vendor tree.

How Has This Been Tested?

Validated on Linux amd64 with Go 1.27.3:

• make all: passes formatting checks, all unit tests, make dist, and checksum generation. The cmd package reports 7.0% statement coverage.
• go mod verify: all modules verified.
• go vet ./...: passes.
• All six release targets compile: Linux amd64, arm64, armv7; Darwin amd64, arm64; Windows amd64.
• file bin/k3sup*: expected ELF, Mach-O, and PE32+ binary formats. go version -m bin/k3sup-armhf confirms GOARM=7.
• sha256sum -c bin/*.sha256: all six checksums pass.
• Native CLI smoke checks: k3sup version, install --help, join --help, and get pro --help pass.

Cross-compiled binaries were not executed. Live SSH provisioning and registry downloads were not exercised. There are no Dockerfiles or Docker release platforms in this repository.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I've read the CONTRIBUTION guide
• I have signed-off my commits with git commit -s
• I have added tests to cover my changes.
• All new and existing tests passed.

[reviewfn]

AI Pull Request Overview

Disclaimer: This review was generated by automated AI and may contain errors. Do not trust its outputs without human verification.

Summary

• Raises the module's minimum Go version from 1.26.0 to 1.27.0.
• Aligns build and publish workflows on the Go 1.27.x toolchain.
• Refreshes Arkade, container registry, SSH, terminal, and transitive dependencies.
• Regenerates dependency checksums and the vendored module tree.
• Commit metadata policy: new commits must not attribute authorship or assistance to AI; both scoped commits comply.
• No blocking correctness, security, compatibility, or release-workflow issues were identified.

Approval rating (1-10)

9/10. The toolchain and dependency refresh is coherent across module metadata, workflows, checksums, and generated vendored dependencies.

Summary per file

Summary per file

File path	Summary
.github/workflows/build.yaml	Updates CI builds to use Go 1.27.x.
.github/workflows/publish.yaml	Updates release builds to use Go 1.27.x.
go.mod	Raises the Go minimum and refreshes direct and transitive dependencies.
go.sum	Updates checksums for the selected dependency versions.

Overall Assessment

The change is internally consistent and appropriately scoped. Build and publish automation use the same Go release required by the module, while module checksums and generated dependency metadata track the selected versions. No actionable defect was found in the final PR state.

Detailed Review

Detailed Review

No findings.

AI agent details.

Agent processing time: 57.223s
Environment preparation time: 3.364s
Total time from webhook: 1m6.129s