From 83c8e6c9658fb62c39ec0a9a43ed48ac866755a7 Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Mon, 9 Nov 2026 03:09:49 -0300 Subject: [PATCH 1/2] build: pass the running Task to taskgate go-tools 1c70756 made taskgate check that every workflow step names a task the Taskfile has, by running `task --list-all`; Task is a go.mod tool here, not on PATH, so the gate failed with 'exec: "task": executable file not found'. -task {{.TASK_EXE}} hands it the Task already running. Co-Authored-By: Claude Opus 5.5 --- Taskfile.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Taskfile.yml b/Taskfile.yml index 37f7c24..cf906a1 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -207,7 +207,8 @@ tasks: - go tool refs - go tool mutate -stale-exempts - task: deadcode - - go tool taskgate + # The Task running this one, which taskgate asks for the task names a workflow step runs. + - go tool taskgate -task {{.TASK_EXE}} - go tool sfw check lint:go: From faee61506b54f3144d767d136804c84cfaa430c8 Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Mon, 9 Nov 2026 03:43:43 -0300 Subject: [PATCH 2/2] ci: pass the workflow token to go-tools downloads go-tools 2b473b1 (spin-stack/go-tools#89): with GITHUB_TOKEN or GH_TOKEN set, a GitHub release download goes through the API, where a token counts, instead of anonymously; the token goes to api.github.com and nowhere else, and an error names the host that answered. GitHub's status page on 2026-11-08 and -09 names the 504s that failed CI: increased timeouts due to a surge in anonymous users. The workflows that run the tools now set GITHUB_TOKEN to the workflow's own token at workflow level. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/go-cli.yml | 5 +++++ go.mod | 4 ++-- go.sum | 8 ++++---- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/.github/workflows/go-cli.yml b/.github/workflows/go-cli.yml index a99fc29..a100a9b 100644 --- a/.github/workflows/go-cli.yml +++ b/.github/workflows/go-cli.yml @@ -32,6 +32,11 @@ concurrency: # request from a fork runs on GitHub's runners instead: its code never reaches spin-stack's AWS # account. Only a branch of this repository, which takes write access to push, runs on the fleet. +# go-tools' downloads (sfw, versions) ask GitHub with this: anonymous ones are the first it sheds +# under load, and they answered 504 for minutes on 2026-11-09. +env: + GITHUB_TOKEN: ${{ github.token }} + jobs: # What a pull request changed, broken one small edit at a time (go-tools mutate): an # edit no test refuses fails, so new code arrives with tests that hold it. diff --git a/go.mod b/go.mod index c4c4d52..4538e55 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/opencontainers/image-spec v1.1.1 github.com/spf13/cobra v1.10.2 github.com/spf13/pflag v1.1.0 - github.com/spin-stack/go-tools v0.0.0-20261026011834-5fc0868cb561 + github.com/spin-stack/go-tools v0.0.0-20261109064146-2b473b1bc102 github.com/tailscale/hujson v0.0.0-20260727124030-b80ff77dac4f github.com/testcontainers/testcontainers-go v0.44.0 go.uber.org/mock v0.6.0 @@ -168,7 +168,7 @@ require ( go.opentelemetry.io/otel/sdk v1.46.0 // indirect go.opentelemetry.io/otel/sdk/metric v1.46.0 // indirect go.opentelemetry.io/otel/trace v1.46.0 // indirect - go.yaml.in/yaml/v3 v3.0.5 // indirect + go.yaml.in/yaml/v3 v3.0.6 // indirect golang.org/x/mod v0.42.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.24.0 // indirect diff --git a/go.sum b/go.sum index ca6a426..8a2c459 100644 --- a/go.sum +++ b/go.sum @@ -309,8 +309,8 @@ github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag= github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spiffe/go-spiffe/v2 v2.8.1 h1:eXZMLsu+3MLEPJyGJkolqtVrteZfQdUpOWj6LTiDl/E= github.com/spiffe/go-spiffe/v2 v2.8.1/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U= -github.com/spin-stack/go-tools v0.0.0-20261026011834-5fc0868cb561 h1:g4acS+rNKMfVXLtf6QeDyiqrwPOfc+EdwiFmO0InF3Y= -github.com/spin-stack/go-tools v0.0.0-20261026011834-5fc0868cb561/go.mod h1:AjnMnKNXxvNt1n0zTkHpABmBd+NnNBqdRMSwmYu885Y= +github.com/spin-stack/go-tools v0.0.0-20261109064146-2b473b1bc102 h1:xoQmNO0ya9P6U1JVBPoI9Q3ltyBurMqWAORBQl6/OH0= +github.com/spin-stack/go-tools v0.0.0-20261109064146-2b473b1bc102/go.mod h1:z8XsGI1fEXvJf5J5BOMkv9veB2rDkmRFs2FtSfluzVM= github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= @@ -364,8 +364,8 @@ go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFj go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y= go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= -go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= +go.yaml.in/yaml/v3 v3.0.6 h1:zcDfvjXEqTQmpjniUBLc91xYJMB2c4QOFxEF/LCEckM= +go.yaml.in/yaml/v3 v3.0.6/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54= golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= golang.org/x/exp v0.0.0-20260718201538-764159d718ef h1:LkZ48HFgy/TvhTI0bcWkjgFkgLyKUwcTbDjS0DUjw+A=