ci: pin Taskfile tool versions on Linux and Windows (phase 1 of #277)#282
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR is part of issue #277 and aims to improve CI/dev reproducibility and supply-chain safety by replacing latest tool installs in Taskfiles with explicit, pinned versions (Linux + Windows first, with some macOS paths intentionally deferred).
Changes:
- Replaced
latestwith concrete versions across 9 Taskfile*_VERSIONmaps (covering 29 tools). - Ensured Task targets invoked by GitHub Actions resolve to fixed tool versions (per PR description).
- Left
pwshaslatestintentionally due to current installer-script constraints.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .taskfiles/yaml.Taskfile.yml | Pins yamllint to a specific version. |
| .taskfiles/terraform.Taskfile.yml | Pins Terraform/OpenTofu versions in the Taskfile map. |
| .taskfiles/shell.Taskfile.yml | Pins shellcheck and shfmt versions. |
| .taskfiles/runtime.Taskfile.yml | Pins runtime tooling versions (uv, fnm, golang), keeps pwsh at latest. |
| .taskfiles/markdown.Taskfile.yml | Pins markdown tool versions used for lint/formatting. |
| .taskfiles/javascript.Taskfile.yml | Pins prettier version used for lint/formatting. |
| .taskfiles/golang.Taskfile.yml | Pins Go toolchain-related utilities (linters/tools) to specific versions. |
| .taskfiles/github.Taskfile.yml | Pins GitHub workflow/action tooling versions. |
| .taskfiles/azure.Taskfile.yml | Pins Azure tooling versions (az, azd, bicep). |
maniSbindra
force-pushed
the
ci/pin-taskfile-tool-versions-277-v2
branch
from
1e0efac to
853dbd9
Compare
Refs #277. Replaces `latest` with concrete semver in 9 Taskfile *_VERSION maps (27 of 30 tools pinned; pwsh, actionlint, and markdownlint-cli2 deliberately left at latest — see deferred list). Pinned values match those proposed in closed PR #281. Also tightens `.taskfiles/scripts/install_terraform.sh` to handle HashiCorp's apt packaging: the repo sometimes publishes the bare upstream version (`terraform=1.15.4`) and sometimes a Debian revision (`terraform=1.15.4-1`). The script now tries the bare form first and falls back to the `-1` form so a single pinned semver in the Taskfile resolves either way. This is the only script change in this PR; it is included because Terraform is a high-value supply-chain target and leaving it unpinned would substantially weaken the change. Coverage after this commit - 27 of 30 CI-reachable install paths are pinned. Every `task …` install target invoked by .github/workflows/ resolves to a fixed version except for actionlint and markdownlint-cli2 (see deferred list). - Linux and Windows developer machines: pinned for 27 tools. - macOS developers using the repo's devcontainer: pinned for 27 tools (devcontainer is Linux-based). - macOS developers running tasks natively on the host: still use `_install:brew`, which today maps to formula names like `bicep@0.43.8` that Homebrew does not publish. Native-macOS setup is therefore expected to fail until phase 2 of #277 replaces the brew path; the devcontainer is the supported macOS workflow in the meantime. Explicitly out of scope (deferred to follow-ups). None introduces a new silent supply-chain regression in CI: - actionlint kept at `latest` because install_actionlint.sh prepends a `v` prefix that upstream download-actionlint.bash rejects — wrapper bug must be fixed first (FU-2) - markdownlint-cli2 kept at `latest` because the internal:command:version precondition (`grep -F` against `markdownlint-cli2 --help`) fails at the pinned value and needs version-check normalization first (FU-1) - pwsh kept at `latest` because setup_pwsh.sh `die`s on any non-`latest` value; pinning pwsh requires the script rewrite tracked alongside SHA verification (FU-3) - _internal.Taskfile.yml v-prefix normalization (FU-1) - installer-script v-prefix stripping (FU-2) - setup_pwsh.sh direct-download with SHA verification (FU-3) - _install:winget `ignore_error: true` pre-existing soft-fail - Native-macOS supply-chain hardening / phase 2 of #277 - Renovate automation (FU-7) - Top-of-map docblock convention (FU-8) - Devcontainer feature pinning (FU-9) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
maniSbindra
force-pushed
the
ci/pin-taskfile-tool-versions-277-v2
branch
from
853dbd9 to
aa2e5de
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pins tool versions in 9
.taskfiles/*.Taskfile.ymlfiles away fromlatest, addressing phase 1 of #277 (supply-chain hardening on Linux and Windows install paths).This is a deliberately narrow re-scope of #281 (closed unmerged with 18 reviewer comments). Only the
*_VERSION: map:scalar values change, plus one small, narrowly-scoped fix toinstall_terraform.shso the Terraform pin actually resolves against the HashiCorp apt repo (see below).What changed
27 of 30 tools pinned to concrete semver across 9 maps. Values match those proposed in #281. Three tools intentionally left at
latestand tracked as follow-ups (see below).GO_VERSION(golang.Taskfile.yml)dlv,gopls,deadcode,golangciLint,gotestsum,govulncheck,goimports,gofumpt,goTestCoverage,gocoverCobertura,goreleaserAZURE_VERSION(azure.Taskfile.yml)az,azd,bicepGITHUB_VERSION(github.Taskfile.yml)act,pinact,ghalint,ghJAVASCRIPT_VERSION(javascript.Taskfile.yml)prettierMARKDOWN_VERSION(markdown.Taskfile.yml)markdownTableFormatterRUNTIME_VERSION(runtime.Taskfile.yml)uv,fnm,golangSHELL_VERSION(shell.Taskfile.yml)shellcheck,shfmtTERRAFORM_VERSION(terraform.Taskfile.yml)terraform,opentofuYAML_VERSION(yaml.Taskfile.yml)yamllintOne script change:
install_terraform.shHashiCorp's apt repo sometimes publishes Terraform with a bare version (
terraform=1.15.4) and sometimes with a Debian revision suffix (terraform=1.15.4-1). The script now tries the bare form first and falls back to<version>-1on failure, so a single pinned semver in the Taskfile resolves either way.This is the only installer-script change in this PR. Terraform is a high-value supply-chain target, so the small script tweak was preferred over either leaving Terraform unpinned or pushing apt-packaging knowledge into the YAML.
Why this PR is small
#281 bundled value pinning, installer-script normalization,
_internal.Taskfile.ymlv-prefix handling, and a fullsetup_pwsh.shrewrite into one PR. Eighteen unaddressed reviewer comments later it was closed. This PR keeps only the value-pinning portion (plus the one Terraform-script fix above) so each remaining concern can be reviewed on its own merits in a focused follow-up.Coverage after merge
.github/workflows/(task runtime:setup:uv,task go:tools:test,task az:install:bicep,task tf:install:terraform,task go:install:govulncheck,task go:install:goreleaser, etc.) resolves to a fixed version, exceptactionlintandmarkdownlint-cli2(see deferred list)._install:brew, which maps formulas likebicep@0.43.8that Homebrew does not publish. Native-macOS setup is expected to fail until phase 2 of ci: pin all tool versions in Taskfiles to specific releases instead of latest #277. The devcontainer is the supported macOS workflow today.Deliberately left at
latest(each tracked as a follow-up)pwshsetup_pwsh.shdies on any non-latestvalue. Pinning requires the script rewrite (FU-3). CI uses runner-preinstalledpwsh, so this only affects dev machines.actionlintinstall_actionlint.shprependsvto numeric inputs, but upstreamdownload-actionlint.bashrequires bareX.Y.Z. Wrapper bug must be fixed first (FU-2).markdownlint-cli2internal:command:versionprecondition (grep -Fagainstmarkdownlint-cli2 --help) doesn't match at the pinned value — needs version-check normalization first (FU-1).Other deferred follow-ups
None introduce a new silent supply-chain regression in CI — they are either dev-machine-only, loud failures rather than silent
latestfallback, or pre-existing behavior unchanged by this commit._internal.Taskfile.ymlversion normalization (stripv, try both forms)v-prefix stripping ininstall_actionlint.sh,install_gh.sh,install_opentofu.shsetup_pwsh.shdirect-download rewrite with SHA256 verification_install:brewwith tagged-release downloaders)_install:wingetignore_error: true: pre-existing soft-fail policy. A rejectedwinget --version Xonwindows-2025could fall through to a pre-installed tool. Should be tightened in its own focused follow-up.renovate.json+ inline# renovate:comments).devcontainer/devcontainer.json)What reviewers should focus on
vprefix)?install_terraform.shtry-then-fallback acceptable, or shouldterraform=<ver>-1be the canonical form / split into a separate Taskfile var?latestexceptions adequately justified in the deferred table?This PR intentionally does not address: any other installer script,
_internal.Taskfile.yml,setup_pwsh.sh, devcontainer, Renovate, or docblocks. Comments about those are welcome but will be acted on in the linked follow-ups, not here.Refs #277.
Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com