tools: Task and go-tools as released binaries, not go.mod's

.github/taskgate-allow.txt

@@ -1,4 +1,4 @@
-# What taskgate allows on purpose (go tool taskgate -allow, from task lint). Each line is a key and
+# What taskgate allows on purpose (taskgate -allow, from task lint). Each line is a key and
 # its why: a workflow step that is not one `task <name>`, as <file>/<job>/<step>; a task's shell
 # over twelve lines, as <file>:<task>; a script a task runs that is a program - over forty lines of
 # shell, or deciding anything by GITHUB_OUTPUT, GITHUB_ENV or jq - by its path. The list may shrink

.github/workflows/image.yml

@@ -76,7 +76,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      # The Taskfiles hand the builds their pins with `go tool versions`.
+      # The Taskfiles hand the builds their pins with go-tools' `versions`.
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:

.github/workflows/kernel.yml

@@ -72,7 +72,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      # The Taskfile hands the build its pins with `go tool versions`.
+      # The Taskfile hands the build its pins with go-tools' `versions`.
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:

Taskfile.yml

@@ -68,7 +68,7 @@ vars:
   # go-tools' command, at the version go.mod pins (its tool directive): the tool is only ever
   # run from a checkout, and Go's build cache makes the second run of it as fast as a binary
   # would be.
-  VERSIONS: go tool versions
+  VERSIONS: versions
   # How many jobs to compile with. CI sets them to its runner's cores.
   QEMU_JOBS: '{{.QEMU_JOBS | default 8}}'
   KERNEL_NPROC: '{{.KERNEL_NPROC | default 8}}'
@@ -220,21 +220,21 @@ tasks:
       # that cannot fail, every path and task AGENTS.md and CLAUDE.md name resolves, every
       # mutate-exempt reason covers an edit mutate makes, every workflow step is one task, and
       # pnpm is the one package manager, installing through Socket Firewall.
-      - go tool ctxlife
-      - go tool testquality ./...
-      - go tool refs
-      - go tool mutate -stale-exempts
+      - ctxlife
+      - testquality ./...
+      - refs
+      - mutate -stale-exempts
       # The Task running this one, which taskgate asks for the task names a workflow step runs.
-      - go tool taskgate -allow .github/taskgate-allow.txt -task {{.TASK_EXE}}
-      - go tool sfw check
+      - taskgate -allow .github/taskgate-allow.txt -task {{.TASK_EXE}}
+      - sfw check
       - task: lint:workflows
 
   lint:workflows:
     desc: actionlint over .github/, and every action pinned by its commit.
     cmds:
       # -shellcheck= because actionlint runs whatever shellcheck is on PATH: a runner has one and
       # a laptop may not, and a gate whose answer depends on the machine is not a gate.
-      - go run github.com/rhysd/actionlint/cmd/actionlint@$(go tool versions version actionlint) -shellcheck=
+      - go run github.com/rhysd/actionlint/cmd/actionlint@$(versions version actionlint) -shellcheck=
       - cmd: 'echo "OK: actionlint"'
       # A tag is whatever its owner points it at, and release.yml holds the token that publishes
       # the tarball every host boots its machines from; the comment is the version Dependabot moves.
@@ -263,7 +263,7 @@ tasks:
           # A push that created its branch has no commit before it.
           git rev-parse --verify "$base^{commit}" >/dev/null 2>&1 || base=HEAD~1
         fi
-        go tool mutate -base "${base:-origin/main}" -max 2000
+        mutate -base "${base:-origin/main}" -max 2000
 
   coverage:
     desc: >-
@@ -374,7 +374,7 @@ tasks:
           --certificate-oidc-issuer https://token.actions.githubusercontent.com "$dir/$sbom"
         # osv-scanner exits 1 when it found something, which is the answer; above 1 it failed.
         status=0
-        go run "github.com/google/osv-scanner/v2/cmd/osv-scanner@$(go tool versions version osv-scanner)" \
+        go run "github.com/google/osv-scanner/v2/cmd/osv-scanner@$(versions version osv-scanner)" \
           scan source -L "$dir/$sbom" --format json > "$dir/osv.json" || status=$?
         [ "$status" -le 1 ] || exit "$status"
         mkdir -p _output
@@ -486,7 +486,7 @@ tasks:
       Who built the release VERSION and from what - this commit, every pin in versions.yaml - as
       SLSA provenance, in _output/provenance.json.
     cmds:
-      - go tool provenance -version "${VERSION}" -out _output/provenance.json
+      - provenance -version "${VERSION}" -out _output/provenance.json
 
   release:sign:
     desc: >-
@@ -519,8 +519,8 @@ tasks:
             --bundle "${f}.cdx.sigstore.json" "${f}" > /dev/null
           attested cyclonedx "${f}.cdx.sigstore.json" "${f}"
         done
-        go tool attestgate files -require provenance _output/release
-        go tool attestgate files -require cdx -except '*.sha256,machine.env,*.cdx.json' _output/release
+        attestgate files -require provenance _output/release
+        attestgate files -require cdx -except '*.sha256,machine.env,*.cdx.json' _output/release
 
   release:tag:
     desc: Tag this commit VERSION and push the tag. A version tagged already is refused, since git push does not move a tag.

boot/Taskfile.yml

@@ -45,7 +45,7 @@ tasks:
           (cd "$dir" && sha256sum -c "$name.tar.gz.sha256")
           # cosign by its pin, built rather than installed by the action: one pin for a laptop
           # and a runner alike.
-          go run "github.com/sigstore/cosign/v3/cmd/cosign@$(go tool versions version cosign)" verify-blob \
+          go run "github.com/sigstore/cosign/v3/cmd/cosign@$(versions version cosign)" verify-blob \
             --bundle "$dir/$name.tar.gz.sigstore.json" \
             --certificate-identity https://github.com/spin-stack/spin-machine/.github/workflows/release.yml@refs/heads/main \
             --certificate-oidc-issuer https://token.actions.githubusercontent.com "$dir/$name.tar.gz"

docs/releasing.md

@@ -40,7 +40,7 @@ or changed, and the patches added, changed or removed), whether checkpoints carr
 
 Each file the release offers - the tarball, its `.sha256` and `machine.env` - carries two
 Sigstore bundles beside it: `<file>.sigstore.json`, the signature of the workflow that built it,
-and `<file>.provenance.sigstore.json`, its SLSA provenance (`go tool provenance`: this workflow at
+and `<file>.provenance.sigstore.json`, its SLSA provenance (go-tools' `provenance`: this workflow at
 its commit, and every pin in `versions.yaml`). Whoever takes one checks both against
 `release.yml` at the ref it ran on:
 
@@ -63,7 +63,7 @@ holds it to the version they asked for.
 What the release is made of is its CycloneDX SBOM, written by `hack/release` from what the builds
 recorded - the apk databases QEMU and e2fsprogs were statically linked in (each build's
 `/lib/apk/db/installed`, extracted to `_output/sbom/`), the image's `packages.txt`, the pins in
-`versions.yaml`, and each shipped file by its hash - and checked with `go tool sbom check`: a
+`versions.yaml`, and each shipped file by its hash - and checked with go-tools' `sbom check`: a
 component with no version fails the release. It is inside the tarball at
 `usr/share/spin-stack/sbom/machine.cdx.json`, beside it as `<tarball>.cdx.json`, and attested
 over the tarball as `<tarball>.cdx.sigstore.json` (`cosign verify-blob-attestation --type

e2fsprogs/Taskfile.yml

@@ -2,7 +2,7 @@ version: '3'
 
 vars:
   E2FSPROGS_VERSION:
-    sh: go tool versions version e2fsprogs
+    sh: versions version e2fsprogs
 
 tasks:
   build:

go.mod

@@ -1,158 +1,14 @@
 module github.com/spin-stack/spin-machine
 
-go 1.27
+go 1.27.0
 
 toolchain go1.27.3
 
-tool (
-	github.com/go-task/task/v3/cmd/task
-	github.com/spin-stack/go-tools/cmd/attestgate
-	github.com/spin-stack/go-tools/cmd/ctxlife
-	github.com/spin-stack/go-tools/cmd/mutate
-	github.com/spin-stack/go-tools/cmd/provenance
-	github.com/spin-stack/go-tools/cmd/refs
-	github.com/spin-stack/go-tools/cmd/sbom
-	github.com/spin-stack/go-tools/cmd/sfw
-	github.com/spin-stack/go-tools/cmd/taskgate
-	github.com/spin-stack/go-tools/cmd/testquality
-	github.com/spin-stack/go-tools/cmd/versions
-)
-
 require (
-	github.com/spin-stack/go-tools v0.0.0-20261109064146-2b473b1bc102
+	github.com/spin-stack/go-tools v0.0.0-20261109214710-b4b5f4a78a45
 	golang.org/x/sys v0.49.0
 )
 
-require (
-	cel.dev/expr v0.25.2 // indirect
-	charm.land/bubbles/v2 v2.1.1 // indirect
-	charm.land/bubbletea/v2 v2.0.10 // indirect
-	charm.land/lipgloss/v2 v2.0.6 // indirect
-	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.24.0 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.3.0 // indirect
-	cloud.google.com/go/compute/metadata v0.10.0 // indirect
-	cloud.google.com/go/iam v1.14.0 // indirect
-	cloud.google.com/go/monitoring v1.31.0 // indirect
-	cloud.google.com/go/storage v1.65.1 // indirect
-	github.com/CycloneDX/cyclonedx-go v0.12.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.38.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.62.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.62.0 // indirect
-	github.com/Ladicle/tabwriter v1.0.0 // indirect
-	github.com/Masterminds/semver/v3 v3.5.0 // indirect
-	github.com/alecthomas/chroma/v2 v2.27.0 // indirect
-	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.44.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.32.40 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.39 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 // indirect
-	github.com/aws/smithy-go v1.28.1 // indirect
-	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/chainguard-dev/git-urls v1.0.2 // indirect
-	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
-	github.com/charmbracelet/x/ansi v0.11.8 // indirect
-	github.com/charmbracelet/x/term v0.2.2 // indirect
-	github.com/charmbracelet/x/termios v0.1.1 // indirect
-	github.com/charmbracelet/x/windows v0.2.2 // indirect
-	github.com/clipperhouse/displaywidth v0.11.0 // indirect
-	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
-	github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/dlclark/regexp2/v2 v2.7.1 // indirect
-	github.com/docker/cli v29.7.2+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.9.3 // indirect
-	github.com/dominikbraun/graph v0.23.0 // indirect
-	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/elliotchance/orderedmap/v3 v3.1.1 // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.39.0 // indirect
-	github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
-	github.com/fatih/color v1.19.0 // indirect
-	github.com/felixge/httpsnoop v1.1.0 // indirect
-	github.com/fsnotify/fsnotify v1.10.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
-	github.com/go-logr/logr v1.4.4 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/go-task/task/v3 v3.54.0 // indirect
-	github.com/go-task/template v0.2.0 // indirect
-	github.com/google/go-containerregistry v0.22.1 // indirect
-	github.com/google/s2a-go v0.1.10 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.22 // indirect
-	github.com/googleapis/gax-go/v2 v2.26.2 // indirect
-	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74 // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-getter v1.8.9 // indirect
-	github.com/hashicorp/go-version v1.9.0 // indirect
-	github.com/joho/godotenv v1.5.1 // indirect
-	github.com/klauspost/compress v1.20.2 // indirect
-	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
-	github.com/klauspost/pgzip v1.2.6 // indirect
-	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
-	github.com/mattn/go-colorable v0.1.15 // indirect
-	github.com/mattn/go-isatty v0.0.24 // indirect
-	github.com/mattn/go-runewidth v0.0.27 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
-	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pierrec/lz4/v4 v4.1.27 // indirect
-	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
-	github.com/puzpuzpuz/xsync/v4 v4.5.0 // indirect
-	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/sajari/fuzzy v1.0.0 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
-	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.8.1 // indirect
-	github.com/stretchr/objx v0.5.3 // indirect
-	github.com/stretchr/testify v1.12.1 // indirect
-	github.com/u-root/u-root v0.16.0 // indirect
-	github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 // indirect
-	github.com/ulikunitz/xz v0.5.16 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/zeebo/xxh3 v1.1.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.45.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect
-	go.opentelemetry.io/otel v1.45.0 // indirect
-	go.opentelemetry.io/otel/metric v1.45.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.45.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect
-	go.opentelemetry.io/otel/trace v1.45.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.6 // indirect
-	golang.org/x/crypto v0.58.0 // indirect
-	golang.org/x/mod v0.42.0 // indirect
-	golang.org/x/net v0.61.0 // indirect
-	golang.org/x/oauth2 v0.37.0 // indirect
-	golang.org/x/sync v0.24.0 // indirect
-	golang.org/x/term v0.47.0 // indirect
-	golang.org/x/text v0.43.0 // indirect
-	golang.org/x/time v0.16.0 // indirect
-	golang.org/x/tools v0.52.0 // indirect
-	google.golang.org/api v0.299.0 // indirect
-	google.golang.org/genproto v0.0.0-20260724162435-b2f20204f0df // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260724162435-b2f20204f0df // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260921155816-b14227669459 // indirect
-	google.golang.org/grpc v1.84.0 // indirect
-	google.golang.org/protobuf v1.36.12 // indirect
-	mvdan.cc/sh/v3 v3.14.1 // indirect
-	mvdan.cc/sh/x v0.0.0-20260922090537-aebdf2b86f56 // indirect
-)
+require go.yaml.in/yaml/v3 v3.0.6 // indirect
+
+tool github.com/spin-stack/go-tools/cmd/task