fix(ci): Replace npm install -g @go-task/cli with go-task/setup-task action to eliminate npm supply-chain risk; Use reusable CI actions from yscope-dev-utils; Bump actions/checkout to v6.0.2.

[junhaoliao]

Description

All CI workflows install the Task runner via npm install -g @go-task/cli. @go-task/cli declares
a transitive dependency on axios: ^1.8.2, and because global npm installs have no lock file, npm
resolves to whatever the latest semver-compatible version is at install time. During the
axios supply-chain compromise on 2026-03-31, this caused CI runners to pull in the
malicious axios@1.14.1 package, which executed a post-install script that connected to an
attacker-controlled C2 server.

This PR:

1. Replaces npm install -g @go-task/cli with reusable CI actions from the yscope-dev-utils
   submodule (updated to 38bf51e), which wraps the official
   go-task/setup-task action pinned by commit SHA. The action downloads the Task
   binary directly from GitHub Releases without involving npm, eliminating the transitive dependency
   on axios and the broader npm supply-chain attack surface.
2. Replaces the standalone curl-based uv install in the lint workflow with the reusable
   install-uv action from yscope-dev-utils, which uses astral-sh/setup-uv pinned
   by commit SHA.
3. Bumps actions/checkout from v4 (unpinned tag) to
   v6.0.2 (de0fac2e4500dabe0009e67214ff5f5447ce83dd), pinned by commit SHA
   across all workflows.

Checklist

• The PR satisfies the contribution guidelines.
• This is a breaking change and that has been indicated in the PR title, OR this isn't a
  breaking change.
• Necessary docs have been updated, OR no docs need to be updated.

Validation performed

1. Verified that no npm install -g commands remain in any workflow file.
2. Confirmed the pinned commit SHA 3be4020d41929789a01026e0e427a4321ce0ad44 corresponds to
   go-task/setup-task v2.0.0.
3. Verified the yscope-dev-utils submodule is updated to 38bf51e and its reusable actions are
   correctly referenced in the lint workflow.
4. Confirmed all actions/checkout references are pinned to
   de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6.0.2).

[coderabbitai]

Warning

Rate limit exceeded

@junhaoliao has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 29 minutes and 47 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 29 minutes and 47 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d887293a-133c-424c-899c-cc3cc0ca7f86

📥 Commits

Reviewing files that changed from the base of the PR and between e922dfd and dbe3a98.

📒 Files selected for processing (3)

• .github/workflows/build.yaml
• .github/workflows/lint.yaml
• tools/yscope-dev-utils

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Bill-hbrhbr]

lgtm

[Bill-hbrhbr]

use ROOT_TASKFILE