build(deps): update CrawlKit and Release Drafter

[vincentkoc]

Update CrawlKit from 0.16.6 to 0.16.7 and both pinned Release Drafter actions from 7.7.0 to 7.9.0. This consolidates #264, #265 and #266 into Vincent Koc’s dependency PR and retains the Go 1.27.0 minimum and all indirect dependency versions.

Both updates satisfy the two-day cooldown. CrawlKit 0.16.7 has been available from the public Go module proxy since 2026-10-01T07:50:56Z. Comparing the 0.16.6 and 0.16.7 module ZIPs showed only the changelog and snapshot sidecar implementation/tests changed; Slacrawl does not import that package. Its GitHub Release remains absent after a signing failure, but Go consumers use the published module ZIP and checksum rather than signed CLI assets. Release Drafter 7.9.0 was published on October 2; both action paths exist and the workflow’s triggers and permissions are preserved.

Independent Codex review found no actionable P0–P2 findings. All components of make check passed on AWS using Go 1.27.1, Node 26.10.0 and GoReleaser 2.18.2: module verification/tidy, formatting, vet, vulnerability and dead-code checks, workflow lint, full race suite, CLI/import/export smoke, and Darwin/Linux amd64/arm64 snapshot packaging. The initial smoke attempt rejected an untracked Crabbox bootstrap script; moving that task artifact outside the checkout restored clean build metadata, and smoke plus snapshot passed at the same exact commit. All required hosted checks passed at 3502654ac695fb1ffc27317b2e0101099d375038: https://github.com/openclaw/slacrawl/actions/runs/37578788913.

Co-authored-by: Vincent Koc vincentkoc@ieee.org

Landing hold: all required checks are green, but the normal squash merge is blocked by the base-branch approval policy. The branch requires an approving review and code-owner review for these dependency/workflow paths. No administrator override or ruleset change was used.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 7, 2026, 5:47 PM ET / 21:47 UTC (Revision 18).

ClawSweeper review

What this changes

Updates Slacrawl’s shared CrawlKit library to 0.16.7 and both pinned Release Drafter actions to 7.9.0, refreshes module checksums, and adds release-note context.

Merge readiness

✅ Ready for maintainer review

This remains a useful, focused dependency update that is absent from current main and v0.10.2. No actionable correctness or security defect was found; normal approval requirements govern landing.

Priority: P3
Reviewed head: 3502654ac695fb1ffc27317b2e0101099d375038

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, compatible dependency update with verified upstream identities and exact-head hosted validation.
Proof confidence	🌊 off-meta tidepool	Not applicable: The MEMBER-authored dependency PR is exempt from ordinary contributor proof; its body reports exact-head CLI/import/export smoke and packaging validation, supplemented by verified hosted success. The upstream runtime patch affects an unimported package, so no stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The MEMBER-authored dependency PR is exempt from ordinary contributor proof; its body reports exact-head CLI/import/export smoke and packaging validation, supplemented by verified hosted success. The upstream runtime patch affects an unimported package, so no stored-data contract changes.
Evidence reviewed	10 items	Pinned introduced changes: The complete introduced diff contains only one direct dependency version update, its two checksums, two full-SHA action updates, and a changelog entry. The Go minimum, preferred toolchain, indirect versions, workflow events, and permissions remain unchanged. Still necessary on main: Current main retains CrawlKit 0.16.6 and Release Drafter 7.7.0. The supplied latest-release identity places v0.10.2 at this same main revision; the release API independently confirms v0.10.2 is latest. Dependency boundary: Source imports CrawlKit store, configuration, progress, mirror, control, release-check, and TUI packages, establishing an actual dependency contract. No Go source imports CrawlKit snapshot, where the upstream patch changes runtime behavior.
Findings	None	None.
Security	None	None.

How this fits together

Slacrawl uses CrawlKit for shared archive, configuration, and CLI services. Release Drafter separately reads repository configuration and pull-request metadata to apply labels and prepare draft release notes.

flowchart TD
  A[Slack archive operations] --> B[CrawlKit library]
  B --> C[Slacrawl archive and CLI]
  D[Pull request metadata] --> E[Release Drafter actions]
  F[Repository configuration] --> E
  E --> G[Labels and draft release notes]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Root-cause cluster

Relationship: canonical
Canonical: #261
Summary: This is the retained candidate consolidating three closed dependency-update branches.

Members:

• superseded: build(deps): bump github.com/openclaw/crawlkit from 0.16.6 to 0.16.7 #264 - Its CrawlKit version update is included here; it closed unmerged.
• superseded: build(deps): bump release-drafter/release-drafter/autolabeler from 7.7.0 to 7.9.0 #265 - Its autolabeler pin update is included here; it closed unmerged.
• superseded: build(deps): bump release-drafter/release-drafter from 7.7.0 to 7.9.0 #266 - Its release-drafter pin update is included here; it closed unmerged.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Land the consolidated, SHA-pinned updates while retaining the existing toolchain, dependency graph, and workflow permission boundaries.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates dependencies rather than reporting broken behavior; pinned source and upstream compatibility checks establish its scope.

Is this the best way to solve the issue?

Yes: consolidating the duplicate updates into one small PR preserves existing configuration and immutable action pins without introducing a competing implementation.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 04cfc53efaa3.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is a bounded dependency-maintenance update with no demonstrated urgent user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The MEMBER-authored dependency PR is exempt from ordinary contributor proof; its body reports exact-head CLI/import/export smoke and packaging validation, supplemented by verified hosted success. The upstream runtime patch affects an unimported package, so no stored-data contract changes.

Evidence

What I checked:

• Pinned introduced changes: The complete introduced diff contains only one direct dependency version update, its two checksums, two full-SHA action updates, and a changelog entry. The Go minimum, preferred toolchain, indirect versions, workflow events, and permissions remain unchanged. (go.mod:12, 3502654ac695)
• Still necessary on main: Current main retains CrawlKit 0.16.6 and Release Drafter 7.7.0. The supplied latest-release identity places v0.10.2 at this same main revision; the release API independently confirms v0.10.2 is latest. (go.mod:12, 04cfc53efaa3)
• Dependency boundary: Source imports CrawlKit store, configuration, progress, mirror, control, release-check, and TUI packages, establishing an actual dependency contract. No Go source imports CrawlKit snapshot, where the upstream patch changes runtime behavior. (internal/store/store.go:13, 3502654ac695)
• Upstream patch scope: GitHub’s version comparison identifies only CHANGELOG.md, snapshot/sidecar.go, and snapshot/sidecar_case_test.go as changed between 0.16.6 and 0.16.7. The sidecar case-renaming fix does not change Slacrawl’s imported packages or stored-data contracts. (snapshot/sidecar.go, 33d2d16c9b97)
• Action provenance and cooldown: The v7.9.0 release targets the exact pinned commit and was published on 2026-10-02T03:02:48Z. Both action manifests exist and use Node 24 with bundled entrypoints. Its two-day cooldown has elapsed. (autolabeler/action.yml, 72967cdc98dd)
• Existing labeling compatibility: The upstream schema still accepts single-label rules and defaults sync-labels to false. Its runner removes labels only when that option is enabled; Slacrawl’s unchanged configuration leaves it disabled. (packages/autolabeler/src/config/config.schema.ts, 72967cdc98dd)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (17 earlier review cycles; latest 8 shown)

• reviewed 2026-10-03T12:19:39.373Z sha 9482eef :: blocked before merge. :: none
• reviewed 2026-10-03T20:25:43.993Z sha 9482eef :: blocked before merge. :: none
• reviewed 2026-10-04T04:35:21.154Z sha 9482eef :: blocked before merge. :: none
• reviewed 2026-10-04T22:44:46.364Z sha 9482eef :: blocked before merge. :: none
• reviewed 2026-10-06T04:34:45.588Z sha 9482eef :: blocked before merge. :: none
• reviewed 2026-10-07T06:08:32.228Z sha 3502654 :: needs maintainer review before merge. :: none
• reviewed 2026-10-07T12:43:07.997Z sha 3502654 :: needs maintainer review before merge. :: none
• reviewed 2026-10-07T18:36:59.997Z sha 3502654 :: needs maintainer review before merge. :: none

[vincentkoc]

Hold evidence:

• github.com/openclaw/crawlkit@v0.16.7 resolves publicly to 33d2d16c9b97fb9c4e245cafd4bf92502588d13a with proxy timestamp 2026-10-01T07:50:56Z.
• Exact head 8f9ec83b22a95c13bdfeb9fba350139f1b0b6363 has all hosted checks green.
• ClawSweeper found no correctness or security defect; its remaining blocker is Slacrawl’s documented two-day dependency cooldown.
• Earliest policy-compliant landing: 2026-10-03T07:50:56Z.

This PR remains draft until that time.

[vincentkoc]

@clawsweeper re-review

Head 9482eef0c31ad6e07954dfbfe3d6535dcded7d21 resolves the stale-base conflict and preserves only the Crawlkit v0.16.6 to v0.16.7 go.mod/go.sum update. The PR body now records exact module, checksum, source, local validation, cooldown, and the still-absent official GitHub Release.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/37092198867
• Updated: 2026-10-03T03:08:53.671Z

[steipete]

Approved: exact-head CI green and reviewed.