[aledbf]

Closes #99

Repositories will stop compiling Task and go-tools' commands: they get the released binaries, pinned by sha256 in versions.yaml.

What's in it

• versions.yaml, additive.
  • A download entry can say {os} and {arch} in its source and have pins:, a sha256 per os/arch, in place of pin.
  • Entry.For is one platform's view of the entry; fetch and Pinned use this machine's.
  • A bump hashes every platform's file and rewrites each pin in place. A release missing one platform's file is refused.
  • github-release <repo> <prefix> reads releases named <prefix><version>.
• cmd/task. A repository's go.mod takes it as go tool task.
  • It finds versions.yaml (cwd upwards) and puts its task and go-tools in the user's cache, verified by sha256 and unpacked once per pin (internal/toolcache, safe when two processes race).
  • It prepends the tools' directory to PATH (replacing it, not duplicating it) and execs Task.
  • It links only versions and internal/fetch.
  • Against the real Task 3.54.0 release: 1.5 s the first time, 36 ms after.
• versions/gate. With cmd/task in go.mod, it counts task and go-tools as read, and requires go-tools' version to be the time in go.mod's go-tools pseudo-version: one commit for the packages and the commands.
• Releases. A release job in ci.yml, after the Gate, only on pushes to main.
  • task release:build builds every command except task for linux/amd64, linux/arm64, darwin/amd64 and darwin/arm64, reproducibly: two builds give the same sha256.
  • actions/attest-build-provenance attests the archives.
  • task release:publish publishes bin-<commit's UTC time>; a retried run doesn't publish twice.
• proven. An artifact uploaded with archive: false, like a run's trace.json, is read as its one file. proven flakes used to fail on it with "the artifact is not a zip".
• Docs. The versions.yaml reference, getting started, and the README.

Why

From go-tools#99: Task as a tool is ~375 modules and go-tools' tools ~70; brand goes from 451 to 5 modules without them. shipset's go tool task test spent 94 s on downloads and compiling before the first test.

Checked

• task lint, task test and task site pass.
• go run ./cmd/mutate -base origin/main -max 600: 182 mutations, 0 survived.
• release:build ran locally: 18 commands, about 40–44 MB per platform.

The first release appears when this merges, and each repository moves to it in its own PR.

🤖 Generated with Claude Code