Use cached Go 1.27 from nixpkgs

[jeremy]

Why

PR #283 moves HEY to Go 1.27, but its locked nixpkgs snapshot only carries 1.27rc3. The temporary override therefore compiles Go 1.27.0 from source in every fresh Nix store.

nixpkgs-unstable now carries stable Go 1.27.0 in its binary cache, so the workaround can come out.

What changed

• regenerate flake.lock at nixpkgs c8f90650c15282fa8656a041bfbbd2403997a9a7
• select go_1_27 directly for both the package and development shell
• update Nix maintenance guidance and preserve the historical non-vendor hash fixtures

Verification

• GitHub x86_64 Linux Nix build: 1m40s, passed
• fresh Docker/Nix build on aarch64-linux: 53.53s, passed
• build fetched /nix/store/...-go-1.27.0 from cache.nixos.org; no Go source derivation was built
• Nix evaluation: go_1_27.version == 1.27.0
• focused Bats: 25/25
• shellcheck, bash -n, git diff --check, and lint lockstep: passed

The red test/race and default-CodeQL checks are inherited from the stale #283 base: its date-sensitive calendar test has already been fixed on current main, while default CodeQL still selects Go 1.26.6 for a Go 1.27 module. The repo's configured CodeQL job passes. #283 needs to sync with main; this PR's Nix-specific checks are green.

Dependency

This PR is based on go-1.27 and is the second layer of the stack after #283. It intentionally contains only the nixpkgs/toolchain-cache delta.

Stack order

The intended order is #304 → #283 → #296. #304 is independently based on main and should land first; #283 can then sync from main. This PR remains based on go-1.27 and intentionally contains only the Go 1.27 nixpkgs/toolchain-cache delta. No branch history was rewritten to document that dependency.

[Copilot]

Pull request overview

Updates the Nix toolchain to use cached Go 1.27.0 directly from the refreshed nixpkgs snapshot.

Changes:

• Refreshes flake.lock.
• Removes the temporary source-build override.
• Preserves vendor-hash regression coverage and updates guidance.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
flake.lock	Pins the newer nixpkgs revision.
nix/go.nix	Selects go_1_27 directly.
RELEASING.md	Documents toolchain lock maintenance.
scripts/extract-nix-vendor-hash.sh	Updates historical classifier context.
tests/e2e/extract_nix_vendor_hash.bats	Retains non-vendor mismatch coverage.
tests/e2e/update_nix_flake.bats	Retains source-hash regression coverage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jeremy]

Rebased onto the rebased go-1.27 (#283 at 8c5c8b8) and pushed to codex/go127-nixpkgs (d4ca2c2). One conflict, in flake.lock: main had moved its nixpkgs pin to a9e6d84 (a snapshot whose go_1_27 is still 1.27rc3, so #283's source-tarball override would have kicked in); this PR's pin c8f9065 carries Go 1.27.0 and was kept, which is what lets nix/go.nix drop the override. nix flake update nixpkgs would be worth a run before merge to pick up a lock at or past 1.27.1, but there is no nix on this machine to do it here.

The red Tests and Race Detection checks were TestDayViewRulesFallFromEveryHourWithoutCuttingIntoAnEvent running against the wall clock on the day it was pinned to; main has given it a fixture clock, and the rebase picks that up. The failing Analyze (go) is GitHub's default-setup CodeQL run (event dynamic), which builds with the runner image's own Go under GOTOOLCHAIN=local and refused a 1.27.0 go.mod in August; it is not a required check, nothing in the repo steers it, and it clears once the runner image ships Go 1.27.

Locally on Go 1.27.0: make check passes and the bats suite passes everything but the macOS-only stat -c failures in install_ssh_key.bats, including the two vendorHash-classifier tests this PR rewords.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T23:22:25.672769Z	d4ca2c2	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.