[jbeckwith-oai]

Summary

• Replace the fail-open dependency bootstrap with a non-mutating go mod tidy -diff preflight followed by fail-closed go mod download and go mod verify.
• Remove the three redundant CI bootstrap steps while preserving the shared setup action and the hourly SDK updater's intentional dependency updates.
• Add focused regression coverage for manifest drift, dependency-resolution errors, checksum-verification errors, and unchanged go.mod/go.sum.

Why

The previous go mod tidy -e || true rewrote committed dependency metadata during ordinary bootstrap and suppressed dependency-resolution failures. Checking the tidy diff before downloading is necessary because go mod download can update go.sum even when GOFLAGS=-mod=readonly is set.

Verification

• go test -race ./scripts
• go test ./internal/... ./scripts with the minimum supported Go 1.25.0
• go build ./...
• Offline bootstrap with GOPROXY=off GOSUMDB=off on Go 1.25.0 and Go 1.25.13
• Full ./scripts/test -skip '^TestFilesCreateCLICancelClosesStalledFIFO$' against an isolated mock server, including Windows cross-compilation
• The excluded FIFO test also fails unchanged on a pristine archive of the base commit; the integration run otherwise passed 524 structurally valid requests.
• git diff --exit-code -- go.mod go.sum

[Copilot]

Pull request overview

This PR tightens Go dependency bootstrapping by switching from a fail-open go mod tidy -e || true approach to a fail-closed sequence that detects go.mod/go.sum drift before downloading, then verifies module integrity. It also deduplicates CI by relying on the shared setup-go composite action to run bootstrap, and adds regression tests around the new bootstrap behavior.

Changes:

• Update scripts/bootstrap to run go mod tidy -diff, then go mod download, then go mod verify under set -euo pipefail.
• Remove redundant ./scripts/bootstrap steps from CI jobs since .github/actions/setup-go already runs it.
• Add tests covering fail-closed behavior and ensuring manifest drift is rejected without mutating go.mod/go.sum.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
scripts/bootstrap_test.go	Adds regression tests for fail-closed bootstrap and non-mutating manifest drift detection.
scripts/bootstrap	Replaces fail-open tidy with tidy-diff preflight + download + verify under stricter shell settings.
.github/workflows/ci.yml	Removes redundant bootstrap steps now covered by the shared setup-go action.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

scripts/bootstrap_test.go:20

• PR description says regression coverage was added for the "unchanged go.mod/go.sum" case, but the current tests don’t actually assert that a successful ./scripts/bootstrap run leaves go.mod/go.sum unchanged. TestBootstrapFailsClosed stubs go (so it can’t detect mutation), and TestBootstrapRejectsManifestDriftWithoutMutation only checks non-mutation on the failure path.

Consider adding a success-path fixture that writes a minimal tidy module (and sum), runs scripts/bootstrap with real go, and then asserts go.mod and go.sum are byte-for-byte identical after the run (plus GOPROXY=off/GOSUMDB=off to keep it hermetic).

func TestBootstrapFailsClosed(t *testing.T) {
	tests := []struct {
		name        string
		failure     string
		wantCalls   []string
		wantSuccess bool
	}{

[HAYDEN-OAI]

Reviewed exact head a8c1680. Fresh and offline dependency bootstraps fail closed and preserve go.mod/go.sum; adversarial module-cache checks, verified GoReleaser provenance, privileged-release ordering, and Windows cross-platform builds passed.