fix(ci): Replace npm install -g @go-task/cli with go-task/setup-task action to eliminate npm supply-chain risk.

[junhaoliao]

Description

All CI workflows install the Task runner via npm install -g @go-task/cli. @go-task/cli declares
a transitive dependency on axios: ^1.8.2, and because global npm installs have no lock file, npm
resolves to whatever the latest semver-compatible version is at install time. During the
axios supply-chain compromise on 2026-03-31, this caused CI runners to pull in the
malicious axios@1.14.1 package, which executed a post-install script that connected to an
attacker-controlled C2 server.

This PR replaces all occurrences of npm install -g @go-task/cli with the official
go-task/setup-task GitHub Action, pinned by commit SHA. The action downloads the Task
binary directly from GitHub Releases without involving npm, eliminating the transitive dependency on
axios and the broader npm supply-chain attack surface.

Checklist

• The PR satisfies the contribution guidelines.
• This is a breaking change and that has been indicated in the PR title, OR this isn't a
  breaking change.
• Necessary docs have been updated, OR no docs need to be updated.

Validation performed

1. Verified that no npm install -g commands remain in any workflow file.
2. Confirmed the pinned commit SHA 3be4020d41929789a01026e0e427a4321ce0ad44 corresponds to
   go-task/setup-task v2.0.0.

[coderabbitai]

Warning

Rate limit exceeded

@junhaoliao has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 27 minutes and 30 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 27 minutes and 30 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8885606b-e51a-48b5-b62b-2d8da5271cd4

📥 Commits

Reviewing files that changed from the base of the PR and between 99431c2 and 9229937.

📒 Files selected for processing (2)

• .github/workflows/code-linting-checks.yaml
• .github/workflows/unit-tests.yaml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[junhaoliao]

Closing this PR as it has been fully superseded by #110 (merged as 38bf51e).

PR #110 addressed the same npm supply-chain risk by:

• Replacing npm install -g @go-task/cli with the go-task/setup-task action (wrapped in reusable composite actions under exports/github/actions/)
• Bumping actions/checkout to v6.0.2 (pinned by SHA)
• Adding additional reusable composite actions for uv, Java, Python, and tool version printing

Rebasing this branch on main results in conflicts since main already contains a superset of these changes. Skipping our commit would produce an empty PR.