[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker.io/golang (source)	stage	minor	1.26.5-alpine3.24 → 1.27.1-alpine3.24

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[artidezi-etke-cc]

Approved: no adaptation is required under the configured project policy.

Approve unchanged: the PR only updates the agru builder from Go 1.26.5 to 1.27.1 on the same Alpine series, and integrates directly with the recorded target. Upstream compatibility evidence, successful source CI and focused local registry/version checks support acceptance. Release version pinning and publication ordering are intact; full agru behavior, host nsenter execution and SSH authentication are outside the smoke-test coverage.

Agent-assessed risk: Low. The compiler update affects the shipped agru binary, but leaves Ansible, collections, Python libraries and SSH configuration unchanged, with successful multiplatform source CI and no identified upstream compatibility blocker.

Evidence (9 items)

• Local check: git merge-base ea6ae92bb876fc5e276d90e26f144999a75d3815 refs/artidezi/inputs/source-pr; git diff ea6ae92bb876fc5e276d90e26f144999a75d3815...refs/artidezi/inputs/source-pr -- Dockerfile — Merge base equals the recorded target. The sole PR change is the first FROM tag, 1.26.5-alpine3.24 to 1.27.1-alpine3.24; the target-to-source diff also contains only this change, so there is no integration divergence.
• Release notes: source — Go 1 compatibility is maintained. Documented port changes concern Darwin and big-endian ppc64, not the three Linux release targets. Runtime and library changes affect compiled agru, not the final-stage Python/Ansible runtime.
• Release notes: source — Go 1.27.1 is a stable release dated September 1, 2026 with compiler, runtime and library fixes; no relevant build blocker was identified.
• Documentation: source — The pinned agru release declares Go 1.26, which the proposed 1.27 builder satisfies; no agru or module dependency update is included.
• Documentation: source — The build recipe uses CGO_ENABLED=0 and go build with static linking flags and timetzdata,goolm tags, so agru does not gain a dependency on the builder musl runtime.
• Local check: docker buildx imagetools inspect docker.io/golang:1.27.1-alpine3.24; docker buildx imagetools inspect docker.io/golang:1.27.1-alpine3.24 --raw | python3 (extract manifest platforms) — Succeeded. Index digest sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 includes linux/amd64, linux/arm64/v8 and linux/arm/v7. This checks registry availability, not runtime behavior.
• Local check: bin/resolve-ansible-version.sh — Succeeded against unchanged final base alpine:3.24.1 and returned 14.0.0-r0. This verifies current local-platform Alpine resolution, not future package availability or installation on every platform.
• Evidence: Dockerfile; bin/smoke-test.sh; .github/workflows/check.yml; supplied source CI snapshot — Final Alpine 3.24.1, agru v0.2.1, ansible, openssh, git, make, just and py3-dnspython/passlib/regex are unchanged. Source snapshot reports two successful Build and smoke-test checks; the workflow builds amd64/arm64/arm-v7 and runs smoke tests on the runner platform. Smoke covers CLI startup, Python imports, password_hash task, nsenter documentation loading and effective accept-new SSH configuration. It does not exercise agru operations, actual host nsenter connection, unknown/changed host-key connections or authentication. Local full builds/smoke tests were not rerun to duplicate green CI.
• Evidence: .github/workflows/workflow.yml; bin/resolve-ansible-version.sh; bin/compute-next-tag.sh — Release resolves the exact Alpine ansible revision and passes it as ANSIBLE_VERSION to both the smoke-tested local build and the three-platform publication build. Tags use that package version plus a release counter, and Dockerfile changes warrant a new counter. Publication precedes Git tagging, runs are serialized and main-gated. A successful PR build does not verify registry credentials, future package availability or actual publication; no images or tags were published here.

Assessed source d64d53a2620221883478dbd23af40d50d9c46945.