fix(ci): Replace npm install -g @go-task/cli with go-task/setup-task action to eliminate npm supply-chain risk; Use reusable CI actions from yscope-dev-utils; Bump actions/checkout to v6.0.2.

[junhaoliao]

Description

All CI workflows install the Task runner via npm install -g @go-task/cli. @go-task/cli declares
a transitive dependency on axios: ^1.8.2, and because global npm installs have no lock file, npm
resolves to whatever the latest semver-compatible version is at install time. During the
axios supply-chain compromise on 2026-03-31, this caused CI runners to pull in the
malicious [email protected] package, which executed a post-install script that connected to an
attacker-controlled C2 server.

This PR:

1. Replaces npm install -g @go-task/cli with the official go-task/setup-task
   GitHub Action, pinned by commit SHA. The action downloads the Task binary directly from GitHub
   Releases without involving npm, eliminating the transitive dependency on axios and the broader npm
   supply-chain attack surface.
2. Replaces inline actions/setup-python, go-task/setup-task, and the standalone coreutils
   install step in log-viewer-docs.yaml with reusable CI actions from
   yscope-dev-utils (the install-python and install-go-task composite
   actions). The install-go-task action already handles the macOS coreutils installation
   internally, so the separate step is no longer needed.
3. Bumps actions/checkout from unpinned v4 / old SHA to
   de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6.0.2) across all workflows (lint.yaml,
   log-viewer-docs.yaml, release.yaml, test.yaml).
4. Updates tools/yscope-dev-utils submodule to 38bf51e which contains the reusable CI actions.

Checklist

• The PR satisfies the contribution guidelines.
• This is a breaking change and that has been indicated in the PR title, OR this isn't a
  breaking change.
• Necessary docs have been updated, OR no docs need to be updated.

Validation performed

1. Verified that no npm install -g commands remain in any workflow file.
2. Confirmed the pinned commit SHA 3be4020d41929789a01026e0e427a4321ce0ad44 corresponds to
   go-task/setup-task v2.0.0.
3. Verified that actions/checkout is pinned to de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6.0.2)
   in all workflow files.
4. Verified that yscope-dev-utils composite actions (install-python, install-go-task) are
   correctly referenced from ./tools/yscope-dev-utils/exports/github/actions/.
5. Verified that the install-go-task action includes the macOS coreutils installation step,
   making the standalone step in log-viewer-docs.yaml redundant.

[coderabbitai]

Warning

Rate limit exceeded

@junhaoliao has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 29 minutes and 1 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 29 minutes and 1 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0834b8b5-d15c-402d-8861-20cba9db1349

📥 Commits

Reviewing files that changed from the base of the PR and between 36ef843 and 511753b.

📒 Files selected for processing (5)

• .github/workflows/lint.yaml
• .github/workflows/log-viewer-docs.yaml
• .github/workflows/release.yaml
• .github/workflows/test.yaml
• tools/yscope-dev-utils

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}