Skip to content

Conversation

@per1234
Copy link
Contributor

@per1234 per1234 commented Sep 16, 2025

The "Task" task runner tool is used to perform all common development and maintenance operations for the project.

Previously, the version of Task was not well managed.

The GitHub Actions workflows used the latest version of Task, only constrained by major version. This meant that the GitHub Actions workflows could break at any time through a new release of Task that contained regressions or breaking changes.

The contributors used whichever version of Task happened to be installed on their machine. This meant that they might get different results from that produced by the environment of the GitHub Actions workflows.

The better solution is to take the same approach for managing the Task dependency as is done for the project's other dependencies:

  • Install a specific version of Task according to a single source of versioning data.
  • Use the Dependabot service to get automated update pull requests.

Since Task is a Go module-based project, this can be accomplished by using the Go modules system, which has explicit support for tool dependencies as of the Go 1.24 release.

The "Task" task runner tool is used to perform all common development and maintenance operations for the project.

Previously, the version of Task was not well managed.

The GitHub Actions workflows used the latest version of Task, only constrained by major version. This meant that the
GitHub Actions workflows could break at any time through a new release of Task that contained regressions or breaking
changes.

The contributors used whichever version of Task happened to be installed on their machine. This meant that they might
get different results from that produced by the environment of the GitHub Actions workflows.

The better solution is to take the same approach for managing the Task dependency as is done for the project's other
dependencies:

* Install a specific version of Task according to a single source of versioning data.
* Use the Dependabot service to get automated update pull requests.

Since Task is a Go module-based project, this can be accomplished by using the Go modules system, which has explicit
support for tool dependencies as of the Go 1.24 release.
@per1234 per1234 self-assigned this Sep 16, 2025
@per1234 per1234 added type: enhancement Proposed improvement topic: code Related to content of the project itself labels Sep 16, 2025
@per1234 per1234 merged commit 26facb7 into arduino:main Sep 16, 2025
51 checks passed
@per1234 per1234 deleted the manage-task branch September 16, 2025 04:47
@per1234
Copy link
Contributor Author

per1234 commented Nov 3, 2025

Use the Dependabot service to get automated update pull requests.

I discovered that I was mistaken about this effect. Although Dependabot does provide update PRs when tool dependencies are managed via the alternative provisional "tools.go" approach, unfortunately it does not for tools managed via the newer tools directive: dependabot/dependabot-core#12050

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

topic: code Related to content of the project itself type: enhancement Proposed improvement

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant