[aledbf]

Holds this repository to two spin-stack rules, with the gates from go-tools:

1. Every workflow step is one task. Each run: step is go tool task <name>, so what CI does lives in the Taskfile and runs the same way locally.
2. pnpm is the only JS package manager, and it installs through Socket Firewall (go tool sfw pnpm ...).

Depends on spin-stack/go-tools#50. go-tools is pinned to that PR's commit 8cf54b0. Once #50 merges, re-pin with go get github.com/spin-stack/go-tools@<main's commit>.

What changed

Tools. go.mod adds go-tools (cmd/taskgate, cmd/sfw) and Task v3.53.1 as tools. The workflows now need only setup-go, and every go-task/setup-task step is gone. The composite action no longer has the repo-token input, which only setup-task used. task lint now also runs go tool taskgate and go tool sfw check.

The reference oracle uses pnpm instead of yarn. reference/ is upstream's git submodule (devcontainers/cli), so no lockfile can be committed for it. At task time, reference:install:

• writes a pnpm-workspace.yaml that allows the two install scripts yarn ran: esbuild, and node-pty, which the oracle loads to exec with a TTY. It also sets verifyDepsBeforeRun: error, because otherwise pnpm run installs on its own, outside the firewall;
• runs go tool sfw pnpm import, which turns upstream's yarn.lock into a pnpm-lock.yaml at the same versions;
• runs go tool sfw pnpm install --frozen-lockfile.

Then reference:compile runs pnpm run compile. Both generated files stay in reference/ as untracked files, so git status now shows ? reference. Deleting them after the install is not an option: pnpm 11's pnpm run treats a missing lockfile as out of date.

pnpm 11.27.1 (the version go-tools uses) is installed with pnpm/action-setup, pinned by commit (v6.1.0). pnpm 11 needs Node 22.13 or later, so the jobs that built the reference on Node 20 (go-cli parity, and release's gate, gate-runtime and metrics) now use Node 24. The composite action already used 24 for the runtime parity lanes. No setup-node cache is used.

Converted steps (22 → 0 findings, no exemptions):

workflow / job / step	now
go-cli / lint-and-test / Coverage summary	coverage:summary SRC=coverage.out TITLE="unit (hermetic)"
go-cli / lint-and-test / ./devcontainer --version	build:smoke (new)
go-cli / e2e / Coverage summary	coverage:summary (e2e)
go-cli / parity / Coverage summary	coverage:summary (contract)
go-cli / parity / record reference commit	reference:commit (new)
go-cli / daily-changes / check	ci:daily-changes (new)
go-cli / parity-runtime / Plan this run	parity:plan (new); the diff range comes in through DIFF_BASE/DIFF_HEAD env
go-cli / parity-runtime / Coverage summary	coverage:summary, titled with $PARITY_SHARD_INDEX
go-cli / parity-runtime / record reference commit	reference:commit
go-cli / parity-publish-full / Coverage summary	coverage:summary (publish)
go-cli / parity-runtime-gate / Normalize lane dirs	coverage:unpack (new)
go-cli / parity-runtime-gate / Merged coverage report	coverage:merge, which now tees to $GITHUB_STEP_SUMMARY when it is set
go-cli / parity-runtime-gate / Gate on runtime + publish	parity:gate (new); the job results come in through RUNTIME_RESULT/PUBLISH_RESULT env
go-cli / cross-compile / ls -lh dist/	folded into build:cross
codeql / Run manual build steps	removed: it was template boilerplate behind if: matrix.build-mode == 'manual', and no matrix entry is manual
release / prepare / resolve	release:resolve (new). It reads GITHUB_EVENT_NAME instead of a copied EVENT_NAME. Outside CI it does a dispatch dry run
release / tag / create and push the tag	release:tag (new). The tag and version come in through env instead of ${{ }} inside the script. The job gains setup-go
release / goreleaser / Compute image ref	removed. The image name is now the Taskfile var IMAGE, and the tasks build the ref from RELEASE_VERSION
release / goreleaser / Smoke test	release:smoke (new)
release / goreleaser / Record image digest	release:digest (new)
release / goreleaser / Update :latest	release:latest (new); continue-on-error stays in the YAML
release / goreleaser / Sign image and attest SBOM	release:sign (new)

Each task writes to $GITHUB_OUTPUT / $GITHUB_STEP_SUMMARY when they are set, and to the terminal otherwise. Shell options are unchanged: set -euo pipefail where the step had it, and Task's default -e where the step relied on GitHub's bash -e.

Verified locally

• go tool taskgate: OK (0 exempt). go tool sfw check: OK.
• actionlint v1.7.7: clean, apart from the custom blacksmith-* runner labels it doesn't know (same as main).
• go tool task --list parses. Every task a workflow calls exists.
• go tool task lint, test:unit, test:integration, and the workflow tests (TestWorkflow*, TestGoCLIWorkflow*): pass. go mod tidy -diff: clean.
• Reference with pnpm 11.27.1 and Node 22, from a clean submodule: task reference installs and compiles. node reference/devcontainer.js --version prints 0.89.0, and node-pty's native module loads.
• task parity:contract (oracle flag coverage, plus the contract lane against the pnpm-built oracle): 74 pass, 0 fail. The skipped cases are the docker and network ones.
• Ran these tasks with and without GitHub's variables set: coverage, coverage:summary, coverage:unpack, coverage:merge, build:smoke, build:cross, reference:commit, parity:plan (PR and daily), ci:daily-changes (schedule and dispatch), parity:gate (pass and fail), release:resolve (auto CalVer, explicit version, a rejected version, tag push).
• task vuln: reports only standard-library findings for the local go1.27.0, the same as on main. CI's setup-go takes the latest 1.27.x.

Not verified

• Anything that needs Docker parity runtime, publish or e2e on a CI runner, or Node 24 for the reference build: CI on this PR will run those.
• release:tag, release:smoke, release:digest, release:latest and release:sign, which need release credentials and GHCR. They are checked only by rendering them (task --summary).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}