From aa2e5de600b05cc765c85cf3e638f14e7cb36747 Mon Sep 17 00:00:00 2001 From: manisbindra Date: Fri, 29 May 2026 11:23:56 +0530 Subject: [PATCH] ci: pin Taskfile tool versions on Linux and Windows (phase 1 of #277) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Refs #277. Replaces `latest` with concrete semver in 9 Taskfile *_VERSION maps (27 of 30 tools pinned; pwsh, actionlint, and markdownlint-cli2 deliberately left at latest — see deferred list). Pinned values match those proposed in closed PR #281. Also tightens `.taskfiles/scripts/install_terraform.sh` to handle HashiCorp's apt packaging: the repo sometimes publishes the bare upstream version (`terraform=1.15.4`) and sometimes a Debian revision (`terraform=1.15.4-1`). The script now tries the bare form first and falls back to the `-1` form so a single pinned semver in the Taskfile resolves either way. This is the only script change in this PR; it is included because Terraform is a high-value supply-chain target and leaving it unpinned would substantially weaken the change. Coverage after this commit - 27 of 30 CI-reachable install paths are pinned. Every `task …` install target invoked by .github/workflows/ resolves to a fixed version except for actionlint and markdownlint-cli2 (see deferred list). - Linux and Windows developer machines: pinned for 27 tools. - macOS developers using the repo's devcontainer: pinned for 27 tools (devcontainer is Linux-based). - macOS developers running tasks natively on the host: still use `_install:brew`, which today maps to formula names like `bicep@0.43.8` that Homebrew does not publish. Native-macOS setup is therefore expected to fail until phase 2 of #277 replaces the brew path; the devcontainer is the supported macOS workflow in the meantime. Explicitly out of scope (deferred to follow-ups). None introduces a new silent supply-chain regression in CI: - actionlint kept at `latest` because install_actionlint.sh prepends a `v` prefix that upstream download-actionlint.bash rejects — wrapper bug must be fixed first (FU-2) - markdownlint-cli2 kept at `latest` because the internal:command:version precondition (`grep -F` against `markdownlint-cli2 --help`) fails at the pinned value and needs version-check normalization first (FU-1) - pwsh kept at `latest` because setup_pwsh.sh `die`s on any non-`latest` value; pinning pwsh requires the script rewrite tracked alongside SHA verification (FU-3) - _internal.Taskfile.yml v-prefix normalization (FU-1) - installer-script v-prefix stripping (FU-2) - setup_pwsh.sh direct-download with SHA verification (FU-3) - _install:winget `ignore_error: true` pre-existing soft-fail - Native-macOS supply-chain hardening / phase 2 of #277 - Renovate automation (FU-7) - Top-of-map docblock convention (FU-8) - Devcontainer feature pinning (FU-9) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .taskfiles/azure.Taskfile.yml | 6 +++--- .taskfiles/github.Taskfile.yml | 8 ++++---- .taskfiles/golang.Taskfile.yml | 22 +++++++++++----------- .taskfiles/javascript.Taskfile.yml | 2 +- .taskfiles/markdown.Taskfile.yml | 2 +- .taskfiles/runtime.Taskfile.yml | 6 +++--- .taskfiles/scripts/install_terraform.sh | 9 +++++++-- .taskfiles/shell.Taskfile.yml | 4 ++-- .taskfiles/terraform.Taskfile.yml | 4 ++-- .taskfiles/yaml.Taskfile.yml | 2 +- 10 files changed, 35 insertions(+), 30 deletions(-) diff --git a/.taskfiles/azure.Taskfile.yml b/.taskfiles/azure.Taskfile.yml index ed14395..246c1a6 100644 --- a/.taskfiles/azure.Taskfile.yml +++ b/.taskfiles/azure.Taskfile.yml @@ -6,9 +6,9 @@ version: "3" vars: AZURE_VERSION: map: - az: latest - azd: latest - bicep: latest + az: 2.86.0 + azd: 1.25.2 + bicep: 0.43.8 AZURE_INSTALLER_SHA: map: azd: 0340065907dee7ca71cd68ed132033cabb38cbce # 2025-03-27 Azure/azure-dev cli/installer/install-azd.sh diff --git a/.taskfiles/github.Taskfile.yml b/.taskfiles/github.Taskfile.yml index 26eaa11..91c26e5 100644 --- a/.taskfiles/github.Taskfile.yml +++ b/.taskfiles/github.Taskfile.yml @@ -7,10 +7,10 @@ vars: GITHUB_VERSION: map: actionlint: latest - act: latest - pinact: latest - ghalint: latest - gh: latest + act: 0.2.88 + pinact: 4.0.0 + ghalint: 1.5.6 + gh: 2.92.0 GITHUB_INSTALLER_SHA: map: actionlint: 62c50a97a146fe36a8951a2a365158c4a4795ba8 # v1.7.11 rhysd/actionlint scripts/download-actionlint.bash diff --git a/.taskfiles/golang.Taskfile.yml b/.taskfiles/golang.Taskfile.yml index a0cb612..df5e415 100644 --- a/.taskfiles/golang.Taskfile.yml +++ b/.taskfiles/golang.Taskfile.yml @@ -6,17 +6,17 @@ version: "3" vars: GO_VERSION: map: - dlv: latest - gopls: latest - deadcode: latest - golangciLint: latest - gotestsum: latest - govulncheck: latest - goimports: latest - gofumpt: latest - goTestCoverage: latest - gocoverCobertura: latest - goreleaser: latest + dlv: v1.26.3 + gopls: v0.22.0 + deadcode: v0.45.0 + golangciLint: 2.12.2 + gotestsum: v1.13.0 + govulncheck: v1.3.0 + goimports: v0.45.0 + gofumpt: v0.10.0 + goTestCoverage: v2.18.8 + gocoverCobertura: v1.5.0 + goreleaser: 2.16.0 GO_INSTALLER_SHA: map: golangciLint: 35b2189782a6a059489289257e6523550167cb64 # 2026-05-01 golangci/golangci-lint install.sh diff --git a/.taskfiles/javascript.Taskfile.yml b/.taskfiles/javascript.Taskfile.yml index 8576fec..8cda646 100644 --- a/.taskfiles/javascript.Taskfile.yml +++ b/.taskfiles/javascript.Taskfile.yml @@ -6,7 +6,7 @@ version: "3" vars: JAVASCRIPT_VERSION: map: - prettier: latest + prettier: 3.8.3 tasks: # * Install Prettier diff --git a/.taskfiles/markdown.Taskfile.yml b/.taskfiles/markdown.Taskfile.yml index c1499f4..5f44f47 100644 --- a/.taskfiles/markdown.Taskfile.yml +++ b/.taskfiles/markdown.Taskfile.yml @@ -7,7 +7,7 @@ vars: MARKDOWN_VERSION: map: markdownlintCli2: latest - markdownTableFormatter: latest + markdownTableFormatter: 1.7.0 tasks: # * Install markdownlint-cli2 diff --git a/.taskfiles/runtime.Taskfile.yml b/.taskfiles/runtime.Taskfile.yml index cc0607b..85a2bb7 100644 --- a/.taskfiles/runtime.Taskfile.yml +++ b/.taskfiles/runtime.Taskfile.yml @@ -6,10 +6,10 @@ version: "3" vars: RUNTIME_VERSION: map: - uv: latest - fnm: latest + uv: 0.11.16 + fnm: 1.39.0 pwsh: latest - golang: latest + golang: 1.26.3 RUNTIME_INSTALLER_SHA: map: fnm: bfb186034978b1ddaf87501eb1633bdc42a5c0a6 # 2026-03-09 Schniz/fnm .ci/install.sh diff --git a/.taskfiles/scripts/install_terraform.sh b/.taskfiles/scripts/install_terraform.sh index 470eb35..a2b8693 100755 --- a/.taskfiles/scripts/install_terraform.sh +++ b/.taskfiles/scripts/install_terraform.sh @@ -84,8 +84,13 @@ log "Installing ${TOOL_NAME}" if [[ "${VERSION}" == "latest" ]]; then apt-get install -y terraform || die "Failed to install ${TOOL_NAME}" else - # Try to install specific version (format: terraform=version) - apt-get install -y "terraform=${VERSION}" || die "Failed to install ${TOOL_NAME} version ${VERSION}" + # HashiCorp apt packages sometimes carry a Debian revision suffix + # (e.g. terraform=1.15.4-1). Try the bare version first, then fall + # back to the -1 suffix so a pinned semver like 1.15.4 resolves + # regardless of which form the apt repo currently publishes. + apt-get install -y "terraform=${VERSION}" \ + || apt-get install -y "terraform=${VERSION}-1" \ + || die "Failed to install ${TOOL_NAME} version ${VERSION} (tried ${VERSION} and ${VERSION}-1)" fi log "✓ Successfully installed ${TOOL_NAME}" diff --git a/.taskfiles/shell.Taskfile.yml b/.taskfiles/shell.Taskfile.yml index c1f7a95..d055fc8 100644 --- a/.taskfiles/shell.Taskfile.yml +++ b/.taskfiles/shell.Taskfile.yml @@ -6,8 +6,8 @@ version: "3" vars: SHELL_VERSION: map: - shellcheck: latest - shfmt: latest + shellcheck: 0.11.0 + shfmt: 3.13.1 tasks: # * Install shellcheck diff --git a/.taskfiles/terraform.Taskfile.yml b/.taskfiles/terraform.Taskfile.yml index b448af6..6d40569 100644 --- a/.taskfiles/terraform.Taskfile.yml +++ b/.taskfiles/terraform.Taskfile.yml @@ -6,8 +6,8 @@ version: "3" vars: TERRAFORM_VERSION: map: - terraform: latest - opentofu: latest + terraform: 1.15.4 + opentofu: 1.12.1 TERRAFORM_INSTALLER_SHA: map: opentofu: c4f7de951e69f7c11b04e2e97b72b1e4e447e5bc # 2024-12-26 opentofu/get.opentofu.org static/install-opentofu.sh diff --git a/.taskfiles/yaml.Taskfile.yml b/.taskfiles/yaml.Taskfile.yml index cd6c983..d678972 100644 --- a/.taskfiles/yaml.Taskfile.yml +++ b/.taskfiles/yaml.Taskfile.yml @@ -6,7 +6,7 @@ version: "3" vars: YAML_VERSION: map: - yamllint: latest + yamllint: 1.38.0 tasks: # * Install YAMLlint