Skip to content

Commit aa2e5de

Browse files
maniSbindraCopilot
maniSbindra
and
Copilot
committed
ci: pin Taskfile tool versions on Linux and Windows (phase 1 of #277)
Refs #277. Replaces `latest` with concrete semver in 9 Taskfile *_VERSION maps (27 of 30 tools pinned; pwsh, actionlint, and markdownlint-cli2 deliberately left at latest — see deferred list). Pinned values match those proposed in closed PR #281. Also tightens `.taskfiles/scripts/install_terraform.sh` to handle HashiCorp's apt packaging: the repo sometimes publishes the bare upstream version (`terraform=1.15.4`) and sometimes a Debian revision (`terraform=1.15.4-1`). The script now tries the bare form first and falls back to the `-1` form so a single pinned semver in the Taskfile resolves either way. This is the only script change in this PR; it is included because Terraform is a high-value supply-chain target and leaving it unpinned would substantially weaken the change. Coverage after this commit - 27 of 30 CI-reachable install paths are pinned. Every `task …` install target invoked by .github/workflows/ resolves to a fixed version except for actionlint and markdownlint-cli2 (see deferred list). - Linux and Windows developer machines: pinned for 27 tools. - macOS developers using the repo's devcontainer: pinned for 27 tools (devcontainer is Linux-based). - macOS developers running tasks natively on the host: still use `_install:brew`, which today maps to formula names like `bicep@0.43.8` that Homebrew does not publish. Native-macOS setup is therefore expected to fail until phase 2 of #277 replaces the brew path; the devcontainer is the supported macOS workflow in the meantime. Explicitly out of scope (deferred to follow-ups). None introduces a new silent supply-chain regression in CI: - actionlint kept at `latest` because install_actionlint.sh prepends a `v` prefix that upstream download-actionlint.bash rejects — wrapper bug must be fixed first (FU-2) - markdownlint-cli2 kept at `latest` because the internal:command:version precondition (`grep -F` against `markdownlint-cli2 --help`) fails at the pinned value and needs version-check normalization first (FU-1) - pwsh kept at `latest` because setup_pwsh.sh `die`s on any non-`latest` value; pinning pwsh requires the script rewrite tracked alongside SHA verification (FU-3) - _internal.Taskfile.yml v-prefix normalization (FU-1) - installer-script v-prefix stripping (FU-2) - setup_pwsh.sh direct-download with SHA verification (FU-3) - _install:winget `ignore_error: true` pre-existing soft-fail - Native-macOS supply-chain hardening / phase 2 of #277 - Renovate automation (FU-7) - Top-of-map docblock convention (FU-8) - Devcontainer feature pinning (FU-9) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 24145e5 commit aa2e5de

10 files changed

Lines changed: 35 additions & 30 deletions

‎.taskfiles/azure.Taskfile.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ version: "3"
66
vars:
77
AZURE_VERSION:
88
map:
9-
az: latest
10-
azd: latest
11-
bicep: latest
9+
az: 2.86.0
10+
azd: 1.25.2
11+
bicep: 0.43.8
1212
AZURE_INSTALLER_SHA:
1313
map:
1414
azd: 0340065907dee7ca71cd68ed132033cabb38cbce # 2025-03-27 Azure/azure-dev cli/installer/install-azd.sh

‎.taskfiles/github.Taskfile.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ vars:
77
GITHUB_VERSION:
88
map:
99
actionlint: latest
10-
act: latest
11-
pinact: latest
12-
ghalint: latest
13-
gh: latest
10+
act: 0.2.88
11+
pinact: 4.0.0
12+
ghalint: 1.5.6
13+
gh: 2.92.0
1414
GITHUB_INSTALLER_SHA:
1515
map:
1616
actionlint: 62c50a97a146fe36a8951a2a365158c4a4795ba8 # v1.7.11 rhysd/actionlint scripts/download-actionlint.bash

‎.taskfiles/golang.Taskfile.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,17 @@ version: "3"
66
vars:
77
GO_VERSION:
88
map:
9-
dlv: latest
10-
gopls: latest
11-
deadcode: latest
12-
golangciLint: latest
13-
gotestsum: latest
14-
govulncheck: latest
15-
goimports: latest
16-
gofumpt: latest
17-
goTestCoverage: latest
18-
gocoverCobertura: latest
19-
goreleaser: latest
9+
dlv: v1.26.3
10+
gopls: v0.22.0
11+
deadcode: v0.45.0
12+
golangciLint: 2.12.2
13+
gotestsum: v1.13.0
14+
govulncheck: v1.3.0
15+
goimports: v0.45.0
16+
gofumpt: v0.10.0
17+
goTestCoverage: v2.18.8
18+
gocoverCobertura: v1.5.0
19+
goreleaser: 2.16.0
2020
GO_INSTALLER_SHA:
2121
map:
2222
golangciLint: 35b2189782a6a059489289257e6523550167cb64 # 2026-05-01 golangci/golangci-lint install.sh

‎.taskfiles/javascript.Taskfile.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ version: "3"
66
vars:
77
JAVASCRIPT_VERSION:
88
map:
9-
prettier: latest
9+
prettier: 3.8.3
1010

1111
tasks:
1212
# * Install Prettier

‎.taskfiles/markdown.Taskfile.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ vars:
77
MARKDOWN_VERSION:
88
map:
99
markdownlintCli2: latest
10-
markdownTableFormatter: latest
10+
markdownTableFormatter: 1.7.0
1111

1212
tasks:
1313
# * Install markdownlint-cli2

‎.taskfiles/runtime.Taskfile.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ version: "3"
66
vars:
77
RUNTIME_VERSION:
88
map:
9-
uv: latest
10-
fnm: latest
9+
uv: 0.11.16
10+
fnm: 1.39.0
1111
pwsh: latest
12-
golang: latest
12+
golang: 1.26.3
1313
RUNTIME_INSTALLER_SHA:
1414
map:
1515
fnm: bfb186034978b1ddaf87501eb1633bdc42a5c0a6 # 2026-03-09 Schniz/fnm .ci/install.sh

‎.taskfiles/scripts/install_terraform.sh‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,8 +84,13 @@ log "Installing ${TOOL_NAME}"
8484
if [[ "${VERSION}" == "latest" ]]; then
8585
apt-get install -y terraform || die "Failed to install ${TOOL_NAME}"
8686
else
87-
# Try to install specific version (format: terraform=version)
88-
apt-get install -y "terraform=${VERSION}" || die "Failed to install ${TOOL_NAME} version ${VERSION}"
87+
# HashiCorp apt packages sometimes carry a Debian revision suffix
88+
# (e.g. terraform=1.15.4-1). Try the bare version first, then fall
89+
# back to the -1 suffix so a pinned semver like 1.15.4 resolves
90+
# regardless of which form the apt repo currently publishes.
91+
apt-get install -y "terraform=${VERSION}" \
92+
|| apt-get install -y "terraform=${VERSION}-1" \
93+
|| die "Failed to install ${TOOL_NAME} version ${VERSION} (tried ${VERSION} and ${VERSION}-1)"
8994
fi
9095

9196
log "✓ Successfully installed ${TOOL_NAME}"

‎.taskfiles/shell.Taskfile.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ version: "3"
66
vars:
77
SHELL_VERSION:
88
map:
9-
shellcheck: latest
10-
shfmt: latest
9+
shellcheck: 0.11.0
10+
shfmt: 3.13.1
1111

1212
tasks:
1313
# * Install shellcheck

‎.taskfiles/terraform.Taskfile.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ version: "3"
66
vars:
77
TERRAFORM_VERSION:
88
map:
9-
terraform: latest
10-
opentofu: latest
9+
terraform: 1.15.4
10+
opentofu: 1.12.1
1111
TERRAFORM_INSTALLER_SHA:
1212
map:
1313
opentofu: c4f7de951e69f7c11b04e2e97b72b1e4e447e5bc # 2024-12-26 opentofu/get.opentofu.org static/install-opentofu.sh

‎.taskfiles/yaml.Taskfile.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ version: "3"
66
vars:
77
YAML_VERSION:
88
map:
9-
yamllint: latest
9+
yamllint: 1.38.0
1010

1111
tasks:
1212
# * Install YAMLlint

0 commit comments

Comments
 (0)