build: run task and go-tools from released binaries

go tool task is go-tools' task command now: the Task versions.yaml pins,
for every platform, with go-tools' latest release on its PATH, so the
Taskfile calls vulngate, ctxlife, testquality, refs, mutate, deadgate,
taskgate, sfw and versions by name. Neither is compiled here any more:
the module graph goes from 568 modules to 272. mockgen and deadcode stay
go.mod tools.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: aledbf

Dockerfile

@@ -18,7 +18,7 @@
 # context. For a local single-arch build:
 #   mkdir -p linux/amd64
 #   CGO_ENABLED=0 go build -o linux/amd64/devcontainer ./cmd/devcontainer
-#   docker buildx build --platform linux/amd64 --load $(go tool versions args distroless) -t devcontainer-cli .
+#   docker buildx build --platform linux/amd64 --load $(versions args distroless) -t devcontainer-cli .
 #
 # The base is pinned by digest in versions.yaml (distroless) and handed in: GoReleaser
 # reads it from DISTROLESS_IMAGE, which `task release:env` exports.

Taskfile.yml

@@ -87,7 +87,7 @@ tasks:
   vuln:
     desc: Fail on a vulnerability the code calls and that has a fix, the standard library's included (govulncheck through go-tools' vulngate)
     cmds:
-      - go tool vulngate ./...
+      - vulngate ./...
 
   coverage:
     desc: Hermetic unit coverage — per-package table + enforce the total/package floors
@@ -202,14 +202,14 @@ tasks:
     cmds:
       - go vet ./cmd/... ./internal/...
       - task: lint:go
-      - go tool ctxlife
-      - go tool testquality -allow .github/testquality-allow.txt ./...
-      - go tool refs
-      - go tool mutate -stale-exempts
+      - ctxlife
+      - testquality -allow .github/testquality-allow.txt ./...
+      - refs
+      - mutate -stale-exempts
       - task: deadcode
       # The Task running this one, which taskgate asks for the task names a workflow step runs.
-      - go tool taskgate -task {{.TASK_EXE}}
-      - go tool sfw check
+      - taskgate -task {{.TASK_EXE}}
+      - sfw check
 
   lint:go:
     desc: golangci-lint with .golangci.yml, at the version versions.yaml pins
@@ -222,18 +222,18 @@ tasks:
         -v "$(go env GOMODCACHE)":/go/pkg/mod -v "$(go env GOCACHE)":/cache/go-build
         -e GOMODCACHE=/go/pkg/mod -e GOCACHE=/cache/go-build -e GOLANGCI_LINT_CACHE=/work/artifacts/golangci-lint
         -e HOME=/tmp -e GOTOOLCHAIN=local
-        $(go tool versions ref golangci-lint) golangci-lint run ./cmd/... ./internal/...
+        $(versions ref golangci-lint) golangci-lint run ./cmd/... ./internal/...
 
   deadcode:
     desc: Fail on a function the binaries link and never call, or a package none imports, unless .github/deadcode-allow.txt says why
     cmds:
-      - go tool deadgate -deadcode "$(go tool -n deadcode)" -roots ./cmd/... -packages ./internal/... -allow .github/deadcode-allow.txt -pending .github/deadcode-pending.txt
+      - deadgate -deadcode "$(go tool -n deadcode)" -roots ./cmd/... -packages ./internal/... -allow .github/deadcode-allow.txt -pending .github/deadcode-pending.txt
 
   mutate:
     desc: Break what the change against BASE touched and fail on an edit no test refuses (BASE=origin/main; on a pull request, what it merges into)
     cmds:
       # BASE comes from `task mutate BASE=...` or the environment (the workflow's).
-      - go tool mutate -base "{{.BASE | default "${BASE:-origin/main}"}}" -max 200
+      - mutate -base "{{.BASE | default "${BASE:-origin/main}"}}" -max 200
 
   spec:compliance:
     desc: Verify spec compliance — schema attribute coverage + normative behavior (merge/lifecycle/discovery), excludes Go-only additions
@@ -253,13 +253,13 @@ tasks:
     desc: Rewrite every internal/**/testdata/ts-oracle/*.json with the results of the reference TypeScript functions (tools/tsoracle), run in the node image versions.yaml pins (needs Docker)
     deps: [reference:compile]
     cmds:
-      - go run ./cmd/devtool ts-oracle "$(go tool versions ref node)"
+      - go run ./cmd/devtool ts-oracle "$(versions ref node)"
 
   testdata:ts-oracle:check:
     desc: Fail when a testdata/ts-oracle golden differs from what the reference TypeScript functions return
     deps: [reference:compile]
     cmds:
-      - TS_ORACLE_IMAGE="$(go tool versions ref node)" go test ./internal/devtools -run '^TestTSOracleGoldensMatchTheReference$' -count=1 -v
+      - TS_ORACLE_IMAGE="$(versions ref node)" go test ./internal/devtools -run '^TestTSOracleGoldensMatchTheReference$' -count=1 -v
 
   reference:
     desc: Install and compile the TypeScript parity oracle
@@ -281,7 +281,7 @@ tasks:
       # must be in the inventory (needs reference/ checked out, so it lives here).
       - go test ./internal/cli -run TestOracleFlagCoverage -count=1
       # The ts-oracle goldens must be what the reference's functions return.
-      - TS_ORACLE_IMAGE="$(go tool versions ref node)" go test ./internal/devtools -run '^TestTSOracleGoldensMatchTheReference$' -count=1
+      - TS_ORACLE_IMAGE="$(versions ref node)" go test ./internal/devtools -run '^TestTSOracleGoldensMatchTheReference$' -count=1
       - PARITY_REPORT_FILE={{.ROOT_DIR}}/artifacts/parity-contract.json PARITY_STRICT=true PARITY_LANE=contract PARITY_SKIP_DOCKER=true PARITY_SKIP_NETWORK=true go test ./internal/cli -run TestParityMatrix -count=1 -timeout 10m -v {{.CLI_ARGS}}
 
   parity:semantic:
@@ -410,14 +410,14 @@ tasks:
         msg: goreleaser is required
     env:
       DISTROLESS_IMAGE:
-        sh: go tool versions ref distroless
+        sh: versions ref distroless
     cmds:
       - goreleaser release --clean {{.CLI_ARGS}}
 
   release:env:
     desc: "CI-ONLY: export what GoReleaser reads from versions.yaml (DISTROLESS_IMAGE) to $GITHUB_ENV"
     cmds:
-      - echo "DISTROLESS_IMAGE=$(go tool versions ref distroless)" >> "$GITHUB_ENV"
+      - echo "DISTROLESS_IMAGE=$(versions ref distroless)" >> "$GITHUB_ENV"
 
   # The release workflow's own steps. What only the workflow knows - the dispatch input, the
   # prepare job's outputs, the published digest - comes in the environment.
@@ -512,8 +512,8 @@ tasks:
           node-pty: true
         verifyDepsBeforeRun: error
         EOF
-      - go tool sfw pnpm import
-      - go tool sfw pnpm install --frozen-lockfile
+      - sfw pnpm import
+      - sfw pnpm install --frozen-lockfile
 
   reference:compile:
     internal: true

go.mod

@@ -1,6 +1,6 @@
 module github.com/devcontainers/cli
 
-go 1.27
+go 1.27.0
 
 toolchain go1.27.3
 
@@ -15,7 +15,7 @@ require (
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.1.0
-	github.com/spin-stack/go-tools v0.0.0-20261109064146-2b473b1bc102
+	github.com/spin-stack/go-tools v0.0.0-20261109214710-b4b5f4a78a45
 	github.com/tailscale/hujson v0.0.0-20260727124030-b80ff77dac4f
 	github.com/testcontainers/testcontainers-go v0.44.0
 	go.uber.org/mock v0.6.0
@@ -28,176 +28,66 @@ require (
 )
 
 require (
-	cel.dev/expr v0.25.2 // indirect
-	charm.land/bubbles/v2 v2.1.1 // indirect
-	charm.land/bubbletea/v2 v2.0.8 // indirect
-	charm.land/lipgloss/v2 v2.0.6 // indirect
-	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.23.1 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	cloud.google.com/go/iam v1.13.0 // indirect
-	cloud.google.com/go/monitoring v1.30.0 // indirect
-	cloud.google.com/go/storage v1.64.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20261006220739-8c912ac31dd4 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.35.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.59.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.59.0 // indirect
-	github.com/Ladicle/tabwriter v1.0.0 // indirect
 	github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
-	github.com/alecthomas/chroma/v2 v2.27.0 // indirect
-	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.47.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.33.4 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.20.4 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.10.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.38.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.50.0 // indirect
-	github.com/aws/smithy-go v1.28.2 // indirect
-	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/chainguard-dev/git-urls v1.0.2 // indirect
-	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
-	github.com/charmbracelet/x/ansi v0.11.8 // indirect
-	github.com/charmbracelet/x/term v0.2.2 // indirect
-	github.com/charmbracelet/x/termios v0.1.1 // indirect
-	github.com/charmbracelet/x/windows v0.2.2 // indirect
-	github.com/clipperhouse/displaywidth v0.11.0 // indirect
-	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
-	github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.2.0 // indirect
 	github.com/containerd/platforms v1.0.0-rc.5 // indirect
 	github.com/containerd/typeurl/v2 v2.3.0 // indirect
 	github.com/cpuguy83/dockercfg v0.3.2 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/dlclark/regexp2/v2 v2.7.1 // indirect
-	github.com/docker/cli v29.8.2+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.9.9 // indirect
 	github.com/docker/go-connections v0.8.2 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/dominikbraun/graph v0.23.0 // indirect
-	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/ebitengine/purego v0.10.1 // indirect
-	github.com/elliotchance/orderedmap/v3 v3.1.1 // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.39.0 // indirect
-	github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
-	github.com/fatih/color v1.19.0 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
-	github.com/fsnotify/fsnotify v1.10.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/go-task/task/v3 v3.53.1 // indirect
-	github.com/go-task/template v0.2.0 // indirect
-	github.com/google/go-containerregistry v0.22.1 // indirect
-	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.20 // indirect
-	github.com/googleapis/gax-go/v2 v2.23.0 // indirect
-	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74 // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-getter v1.8.8 // indirect
-	github.com/hashicorp/go-version v1.9.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/klauspost/compress v1.20.2 // indirect
-	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
-	github.com/klauspost/pgzip v1.2.6 // indirect
-	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
-	github.com/mattn/go-colorable v0.1.15 // indirect
-	github.com/mattn/go-isatty v0.0.24 // indirect
-	github.com/mattn/go-runewidth v0.0.27 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/moby/go-archive v0.3.0 // indirect
 	github.com/moby/patternmatcher v0.6.1 // indirect
 	github.com/moby/sys/sequential v0.7.0 // indirect
 	github.com/moby/sys/user v0.4.1 // indirect
 	github.com/moby/sys/userns v0.2.1 // indirect
 	github.com/moby/term v0.5.2 // indirect
-	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/pierrec/lz4/v4 v4.1.27 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/puzpuzpuz/xsync/v4 v4.5.0 // indirect
-	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/sajari/fuzzy v1.0.0 // indirect
+	github.com/rogpeppe/go-internal v1.15.0 // indirect
 	github.com/shirou/gopsutil/v4 v4.26.6 // indirect
 	github.com/sirupsen/logrus v1.10.2 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.8.1 // indirect
-	github.com/stretchr/objx v0.5.3 // indirect
 	github.com/stretchr/testify v1.12.1 // indirect
 	github.com/tklauser/go-sysconf v0.4.0 // indirect
 	github.com/tklauser/numcpus v0.12.0 // indirect
 	github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect
-	github.com/u-root/u-root v0.16.0 // indirect
-	github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 // indirect
-	github.com/ulikunitz/xz v0.5.16 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	github.com/zeebo/xxh3 v1.1.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.45.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
-	go.opentelemetry.io/otel v1.46.0 // indirect
-	go.opentelemetry.io/otel/metric v1.46.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.46.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.46.0 // indirect
-	go.opentelemetry.io/otel/trace v1.46.0 // indirect
+	go.opentelemetry.io/otel v1.47.0 // indirect
+	go.opentelemetry.io/otel/log v1.47.0 // indirect
+	go.opentelemetry.io/otel/metric v1.47.0 // indirect
+	go.opentelemetry.io/otel/trace v1.47.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.6 // indirect
 	golang.org/x/mod v0.42.0 // indirect
-	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.24.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 	golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e // indirect
-	golang.org/x/time v0.16.0 // indirect
 	golang.org/x/tools v0.52.0 // indirect
-	golang.org/x/vuln v1.9.0 // indirect
-	google.golang.org/api v0.293.0 // indirect
-	google.golang.org/genproto v0.0.0-20260724162435-b2f20204f0df // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 // indirect
-	google.golang.org/grpc v1.84.0 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
-	mvdan.cc/sh/moreinterp v0.0.0-20260817215856-d6550df7ed8d // indirect
-	mvdan.cc/sh/v3 v3.13.2-0.20260817215856-d6550df7ed8d // indirect
 )
 
 tool (
-	github.com/go-task/task/v3/cmd/task
-	github.com/spin-stack/go-tools/cmd/ctxlife
-	github.com/spin-stack/go-tools/cmd/deadgate
-	github.com/spin-stack/go-tools/cmd/mutate
-	github.com/spin-stack/go-tools/cmd/refs
-	github.com/spin-stack/go-tools/cmd/sfw
-	github.com/spin-stack/go-tools/cmd/taskgate
-	github.com/spin-stack/go-tools/cmd/testquality
-	github.com/spin-stack/go-tools/cmd/versions
-	github.com/spin-stack/go-tools/cmd/vulngate
+	github.com/spin-stack/go-tools/cmd/task
 	go.uber.org/mock/mockgen
 	golang.org/x/tools/cmd/deadcode
 )