feat: update to devbox/task toolstack

.github/setup/action.yml

@@ -0,0 +1,25 @@
+name: Setup development tools
+description: Install the locked Devbox environment and restore Go and ko caches.
+runs:
+  using: composite
+  steps:
+    - uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
+      with:
+        devbox-version: 0.18.4
+        enable-cache: 'true'
+        disable-nix-access-token: 'true'
+    - name: Locate Go caches
+      id: cache
+      shell: bash
+      run: |
+        : "${GITHUB_OUTPUT:?GITHUB_OUTPUT is required}"
+        printf 'build=%s\nmodules=%s\n' "$(devbox run -- go env GOCACHE)" "$(devbox run -- go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
+        printf 'KO_CACHE=%s/ko-cache\n' "$RUNNER_TEMP" >> "$GITHUB_ENV"
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: |
+          ${{ steps.cache.outputs.build }}
+          ${{ steps.cache.outputs.modules }}
+          ${{ runner.temp }}/ko-cache
+        key: ${{ runner.os }}-${{ runner.arch }}-tools-${{ hashFiles('devbox.lock', '**/go.sum', '.ko.yaml') }}
+        restore-keys: ${{ runner.os }}-${{ runner.arch }}-tools-

.github/workflows/check-actions.yaml

@@ -16,10 +16,12 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
       - name: Ensure SHA pinned actions
         uses: zgosalvez/github-actions-ensure-sha-pinned-actions@60e3a74c7b74a319e8e53e46bc455205f7173e1a # v5.0.8
         with:
           # slsa-github-generator requires using a semver tag for reusable workflows.
           # See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators
           allowlist: |
-            slsa-framework/slsa-github-generator
+            slsa-framework/slsa-github-generator

.github/workflows/check-commit.yaml

@@ -20,4 +20,5 @@ jobs:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
+          persist-credentials: false
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1

.github/workflows/check.yaml

@@ -8,50 +8,18 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
-        with:
-          node-version: '24'
-          cache: npm
-      - run: npm ci --ignore-scripts --no-audit --no-fund
-      - name: Unit and local integration tests
-        run: npm test
-      - uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
-        with:
-          version: v4.2.0
-      - name: Real Helm packaging integration
-        run: npm run test:helm
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version: '1.25'
-          cache: false
-      - name: Install actionlint and Task
-        run: |
-          go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.7
-          go install github.com/go-task/task/v3/cmd/task@v3.53.1
-      - name: Real Task target integration
-        run: npm run test:task
-      - name: Validate workflows and composite actions
-        run: npm run lint
-      - name: Check shell scripts
-        run: shellcheck helm-oci-chart/publish.sh task-ko-publish/publish.sh
-      - name: Exercise exists action
-        id: exists
-        uses: ./exists
-        with:
-          value: example
-      - name: Exercise empty input
-        id: empty
-        uses: ./exists
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          value: ''
-      - name: Assert exists outputs
-        env:
-          PRESENT: ${{ steps.exists.outputs.result }}
-          EMPTY: ${{ steps.empty.outputs.result }}
-        run: test "$PRESENT" = true && test "$EMPTY" = false
+          persist-credentials: false
+      - uses: ./.github/setup
+      - name: Run all checks
+        run: devbox run -- task check:full

Taskfile.yml

@@ -0,0 +1,98 @@
+version: '3'
+
+silent: true
+
+set: [errexit, nounset, pipefail]
+
+vars:
+  ACTIONS:
+    sh: find . -name 'action.yaml' -not -path './node_modules/*' -print0 | sort -z | xargs -0
+
+tasks:
+  default:
+    desc: List available tasks.
+    cmds:
+      - task --list
+
+  ### Node.js tasks ###
+
+  npm:ci:
+    desc: Install Node.js dependencies.
+    cmds:
+      - npm ci --ignore-scripts --no-audit --no-fund
+
+  test:
+    desc: Run unit and local integration tests.
+    deps: [npm:ci]
+    cmds:
+      - npm test
+
+  test:helm:
+    desc: Run Helm packaging integration tests.
+    deps: [npm:ci]
+    cmds:
+      - npm run test:helm
+
+  test:task:
+    desc: Run Task target integration tests.
+    deps: [npm:ci]
+    cmds:
+      - npm run test:task
+
+  ### Lint tasks ###
+
+  lint:actions:
+    desc: Validate GitHub Actions and composite actions.
+    aliases: [lint-actions]
+    cmds:
+      - node scripts/lint.mjs
+
+  lint:shell:
+    desc: Check shell scripts with shellcheck.
+    aliases: [lint-shell]
+    cmds:
+      - shellcheck helm-oci-chart/publish.sh task-ko-publish/publish.sh
+
+  lint:zizmor:
+    desc: Security-lint GitHub Actions workflows and composite actions with zizmor.
+    aliases: [lint-zizmor]
+    cmds:
+      - zizmor -q .github/workflows/ {{.ACTIONS}}
+
+  lint:zizmor-fix:
+    desc: Security-lint GitHub Actions workflows and composite actions with zizmor and auto-fix.
+    aliases: [lint-zizmor-fix]
+    cmds:
+      - zizmor -q .github/workflows/ {{.ACTIONS}} --fix=all
+
+  ### Action exercises ###
+
+  exercise:exists:
+    desc: Exercise the exists action with sample inputs.
+    cmds:
+      - |
+        # Simulate the exists action's composite step logic
+        value="example"
+        if [ -n "$value" ]; then echo "true"; else echo "false"; fi
+      - |
+        value=""
+        if [ -n "$value" ]; then echo "true"; else echo "false"; fi
+
+  ### Aggregate checks ###
+
+  check:
+    desc: Run the checks used by CI (e2e runs separately).
+    cmds:
+      - task: npm:ci
+      - task: test
+      - task: test:helm
+      - task: test:task
+      - task: lint:actions
+      - task: lint:shell
+      - task: lint:zizmor
+
+  check:full:
+    desc: Run all CI checks including action exercises.
+    cmds:
+      - task: check
+      - task: exercise:exists

devbox.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://raw.githubusercontent.com/jetify-com/devbox/0.17.5/.schema/devbox.schema.json",
+  "packages": {
+    "zizmor": "1.25.2",
+    "go-task": "3.53.1",
+    "actionlint": "1.7.7",
+    "nodejs": "24",
+    "go": "1.27.1",
+    "shellcheck": "",
+    "kubernetes-helm": "4.2.0"
+  }
+}