[aledbf]

Depends on spin-stack/go-tools#50. It takes go-tools at that PR's commit (8cf54b0); once #50 is on main, re-pin with go get github.com/spin-stack/go-tools@<main's commit> and mark this ready.

What

Every run: step of pages.yml is one task, and pnpm through Socket Firewall is held too (this repository installs no packages, so that gate only keeps it so).

step	now
go vet, go test, palette -check, mark -check, shots -check, screens -check (six steps)	go tool task check, which already ran the same six commands in the same order
unpack the screens' images from their release (main only)	go tool task screens:download; its if: and GH_TOKEN stay in the workflow, and the repository comes from GITHUB_REPOSITORY (this one outside CI) instead of a ${{ }} in the shell

• go-tools is a new dependency: taskgate and sfw are go.mod tools, and task check runs go tool taskgate and go tool sfw check first.
• Task is a go.mod tool at v3.53.1, the version go-tools pins, so the workflow needs only setup-go. This repository never installed Task in CI before.
• screens/img/ is ignored, since task screens:download can now write it locally.
• The README shows the tasks as go tool task ... and says what the gates check.

No exemptions.

Checked

• go tool task check passes locally: taskgate (every step a task, 0 exempt), sfw check, vet, test, and the palette, mark, shots and screens checks.
• go tool task screens:download unpacks 332 images from the release screens.json names.
• actionlint 1.7.12 passes, and every action is still pinned by commit.
• go tool task --list parses the Taskfile, and both tasks the workflow calls exist.

Not checked: the screens download and the Pages deploy on GitHub, which only run on main.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}