[aledbf]

What

go tool sfw: pnpm is the one package manager, and it installs through Socket Firewall

• go tool sfw pnpm install ... runs pnpm through Socket Firewall Free, which refuses packages Socket has confirmed as malware before they are downloaded.
  • The binary is pinned by sha256 for linux and darwin, amd64 and arm64, in cmd/sfw/versions.yaml, which the command embeds.
  • It is fetched once into the user's cache and checked against its pin on every run, because Socket does not sign the binaries.
  • The version is v1.15.4: v1.15.6 was a day old, and the rule here is a week.
• go tool sfw check fails on:
  • npm, npx, yarn, bun or bunx anywhere a command is written, through the firewall or not;
  • a pnpm command that fetches without the firewall;
  • package-lock.json, npm-shrinkwrap.json, yarn.lock or bun.lock;
  • a package.json without "packageManager": "pnpm@<version>".

go tool taskgate: every workflow step is one task

• Every run: step of a workflow or composite action has to be a single task ... or go tool task ... line. What CI does is written once, in the Taskfile, and a developer runs the same thing.
• -allow <file> lists the steps that are not a task on purpose, as <file>/<job>/<step> # why. A line that matches no step fails too.

This repository

• ci.yml and pages.yml run only tasks. The coverage summary and mutate's choice of base were shell in the workflow; they are now task coverage and task mutate.
• The only two exemptions are the steps that read Task's pin before Task exists. go-tools is a library, so it does not take Task into its go.mod: its importers would get Task's modules (grpc and more) in their module graph. Applications should use go tool task instead.
• task lint runs both gates. task site installs through the firewall.
• Docs: new sfw and taskgate pages, and README rows.

Checked

• task test, task lint and task site pass.
• task mutate BASE=origin/main: 141 refused, 0 survived. It first found 11 weak spots, which are now tested.
• In the other spin-stack repos, taskgate reports: spin 35 steps, spin-machine 37, ami 23, devcontainer-cli 22, spin-terraform-aws 15, brand 7, website 4, shipset 3, skills 2. ci and spinbox.dev-deploy already pass.
• sfw check finds pnpm installs without the firewall in spin and website, and yarn in devcontainer-cli.

🤖 Generated with Claude Code