fix(ci): Replace npm install -g @go-task/cli with go-task/setup-task action to eliminate npm supply-chain risk; Use reusable CI actions from yscope-dev-utils; Bump actions/checkout to v6.0.2.

[junhaoliao]

Description

Replace npm install -g @go-task/cli with go-task/setup-task

All CI workflows previously installed the Task runner via npm install -g @go-task/cli.
@go-task/cli declares a transitive dependency on axios: ^1.8.2, and because global npm installs
have no lock file, npm resolves to whatever the latest semver-compatible version is at install time.
During the axios supply-chain compromise on 2026-03-31, this caused CI runners to
pull in the malicious axios@1.14.1 package, which executed a post-install script that connected to
an attacker-controlled C2 server.

The first commit replaces all occurrences of npm install -g @go-task/cli with the official
go-task/setup-task GitHub Action, pinned by commit SHA. The action downloads the Task
binary directly from GitHub Releases without involving npm, eliminating the transitive dependency on
axios and the broader npm supply-chain attack surface.

Use reusable CI actions from yscope-dev-utils; Bump actions/checkout to v6.0.2

The second commit:

• Updates the tools/yscope-dev-utils submodule to 38bf51e, which
  provides reusable GitHub Actions for CI setup.
• Replaces actions/setup-python and go-task/setup-task in lint.yml with the corresponding
  reusable actions from tools/yscope-dev-utils/exports/github/actions/ (install-python and
  install-go-task).
• The install-go-task action also handles coreutils installation on macOS (for md5sum), so the
  standalone brew install coreutils step is removed.
• Pins actions/checkout to the commit SHA for v6.0.2 across all workflows (build_wheels.yml and
  lint.yml).

Checklist

• The PR satisfies the contribution guidelines.
• This is a breaking change and that has been indicated in the PR title, OR this isn't a
  breaking change.
• Necessary docs have been updated, OR no docs need to be updated.

Validation performed

1. Verified that no npm install -g commands remain in any workflow file.
2. Confirmed the pinned commit SHA 3be4020d41929789a01026e0e427a4321ce0ad44 corresponds to
   go-task/setup-task v2.0.0.
3. Verified that no unpinned actions/checkout, actions/setup-python, or go-task/setup-task
   references remain in any workflow file.
4. Confirmed the install-go-task reusable action includes the coreutils macOS installation step.

[coderabbitai]

Warning

Rate limit exceeded

@junhaoliao has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 29 minutes and 27 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 29 minutes and 27 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 92e90030-39ea-4ab0-bcc2-ab0037d45c34

📥 Commits

Reviewing files that changed from the base of the PR and between 08e0be3 and d2b2cec.

📒 Files selected for processing (3)

• .github/workflows/build_wheels.yml
• .github/workflows/lint.yml
• tools/yscope-dev-utils

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Bill-hbrhbr]

lgtm

[Bill-hbrhbr]

change ROOT_TASKFILE