ci: adopt task-first ci module and x shared toolchains

Replace the bespoke Dagger-first flow (which pinned now-removed x go,
prettier, cosign, and syft toolchains) with x's task-first pattern.

- Move toolchains/kclipper to ci; rename the module to Ci (dagger/ci)
  and register it in the root dagger.json alongside the remote devbox
  and commitlint toolchains.
- Pin the remaining remote x toolchains (devbox, goreleaser, security,
  zizmor) to 8990610a338bb60f9aa8708d5fa89e1c3c6725dc. cosign and syft
  are now folded into goreleaser; EnsureGitRepo and
  VerifyBinaryPlatform are methods on it.
- Run go build/test/lint/format locally via devbox; the ci module
  reproduces them with task targets inside the devbox toolchain
  container. Tests build with cgo and the netgo tag.
- Preserve the full release pipeline: cgo + Zig cross-compile, KCL
  language-server bundling, macOS SDK via Nix, macOS notarization, and
  KCL module publishing.
- Restructure .taskfiles local-first and point CI workflows at the ci
  toolchain.

Author: MacroPower

.commitlintrc.yaml

@@ -20,7 +20,8 @@ rules:
   scope-enum:
     - 2
     - always
-    - - cli
+    - - ci
+      - cli
       - deps
       - modules
       - plugin

.github/renovate.json5

@@ -25,15 +25,29 @@
       matchStringsStrategy: "recursive",
       datasourceTemplate: "helm",
     },
+    // Tool and image versions pinned as Go constants in the ci module,
+    // annotated with `// renovate:` comments, e.g.:
+    //   renovateVersion = "43.224.0" // renovate: datasource=npm depName=renovate
+    //   nixImage = "ghcr.io/nixos/nix:2.34.7" // renovate: datasource=docker depName=ghcr.io/nixos/nix
+    // For image references, the version is the tag after the last colon.
     {
       customType: "regex",
-      managerFilePatterns: ["/toolchains/.+/main\\.go$/"],
+      managerFilePatterns: ["/^ci/.+\\.go$/"],
       matchStrings: [
-        // The optional non-captured prefix strips the image name from full
-        // refs (e.g. "ghcr.io/nixos/nix:2.32.8"), leaving only the tag as
-        // currentValue.
-        '\\w+\\s*=\\s*"(?:[^"]*:)?(?<currentValue>[^":]+)"\\s*//\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)(?:\\s+extractVersion=(?<extractVersion>[^\\s]+))?',
+        '"(?:[^"]*:)?(?<currentValue>[^":]+)"\\s*// renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)',
       ],
+      versioningTemplate: "{{#if (equals datasource 'docker')}}docker{{else}}semver-coerced{{/if}}",
+    },
+    // Tool versions pinned in Taskfiles as `<value> # renovate:` annotations.
+    // (devbox.json tool versions are handled by Renovate's built-in devbox
+    // manager, so they need no customManager here.)
+    {
+      customType: "regex",
+      managerFilePatterns: ["/(^|/)Taskfile\\.yaml$/", "/(^|/)\\.taskfiles/.+\\.yaml$/"],
+      matchStrings: [
+        '(?<currentValue>v?[0-9][^\\s#"]*)\\s*#\\s*renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)',
+      ],
+      versioningTemplate: "{{#if (equals datasource 'docker')}}docker{{else}}semver-coerced{{/if}}",
     },
   ],
   packageRules: [

.github/workflows/build.yaml

@@ -32,6 +32,6 @@ jobs:
         uses: dagger/dagger-for-github@v8.4.1
         with:
           version: "v0.21.4"
-          call: kclipper build --output=./dist
+          call: ci build --output=./dist
           cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}
           enable-github-summary: "true"

.github/workflows/release.yaml

@@ -63,7 +63,7 @@ jobs:
         with:
           version: "v0.21.4"
           call: >-
-            kclipper release
+            ci release
             --github-token=env://GITHUB_TOKEN
             --registry-username="${{ github.actor }}"
             --registry-password=env://REGISTRY_PASSWORD
@@ -127,7 +127,7 @@ jobs:
         with:
           version: "v0.21.4"
           call: >-
-            kclipper publish-kclmodules
+            ci publish-kclmodules
             --tag="${{ steps.tag.outputs.value }}"
             --registry-username="${{ github.actor }}"
             --registry-password=env://REGISTRY_PASSWORD

.github/workflows/renovate.yaml

@@ -34,7 +34,7 @@ env:
   LOG_LEVEL: "${{ inputs.logLevel || 'info' }}"
   RENOVATE_AUTODISCOVER: true
   RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}"
-  RENOVATE_DRY_RUN: "${{ inputs.dryRun == true }}"
+  RENOVATE_DRY_RUN: "${{ inputs.dryRun == 'true' }}"
   RENOVATE_PLATFORM: github
   RENOVATE_PLATFORM_COMMIT: true
   RENOVATE_ALLOWED_COMMANDS: '["^kcl .+$"]'

.github/workflows/validate.yaml

@@ -15,30 +15,74 @@ permissions:
 
 jobs:
   check:
-    name: check
+    name: check (${{ matrix.task }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Each entry is a function on the `ci` toolchain. lint and test run the
+        # matching Taskfile target inside the devbox environment
+        # (dagger -> devbox -> task); the rest compose a toolchain or Node
+        # container directly: security (Trivy via the security toolchain),
+        # lint-actions (zizmor via the zizmor toolchain), lint-renovate
+        # (renovate-config-validator in a Node container), and lint-releaser /
+        # lint-kclmodules (goreleaser/kcl). Mirrors the gates developers run via
+        # `task check:all`.
+        task:
+          - lint
+          - test
+          - security
+          - lint-actions
+          - lint-renovate
+          - lint-releaser
+          - lint-kclmodules
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           persist-credentials: false
-          fetch-depth: 2
 
-      - name: Run all checks (lint + generator freshness in parallel)
+      - name: Run ci ${{ matrix.task }}
+        uses: dagger/dagger-for-github@v8.4.1
+        with:
+          version: "v0.21.4"
+          call: ci ${{ matrix.task }}
+          cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}
+          enable-github-summary: "true"
+
+  toolchains:
+    name: toolchains
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Run ci toolchain tests
         uses: dagger/dagger-for-github@v8.4.1
         with:
           version: "v0.21.4"
           verb: check
-          args: go:lint kclipper:lint-prettier kclipper:lint-actions kclipper:lint-releaser kclipper:lint-kclmodules go:generate go:tidy
+          args: -m ci/tests
           cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}
           enable-github-summary: "true"
 
+  coverage:
+    name: coverage
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
       - name: Export coverage profile
         if: ${{ !cancelled() }}
         uses: dagger/dagger-for-github@v8.4.1
         with:
           version: "v0.21.4"
-          call: go test-coverage --output=coverage.txt
+          call: ci test-coverage --output=coverage.txt
           cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}
           enable-github-summary: "true"
 

.gitignore

@@ -26,3 +26,9 @@ dist/
 
 # Devbox environment
 .devbox/
+
+# Worktrees
+.worktrees/
+
+# SARIF scan output (from `task security:sarif-source` / `sarif-image`)
+*.sarif

.lefthook.yaml

@@ -3,7 +3,7 @@
 pre-commit:
   commands:
     check:
-      run: devbox run -- dagger check
+      run: devbox run -- task check
 
 commit-msg:
   commands:

.taskfiles/fmt/Taskfile.yaml

@@ -3,16 +3,35 @@ version: "3"
 set: [errexit, nounset, pipefail]
 shopt: [globstar]
 
+# Prettier checks and formats YAML, JSON, and Markdown; devbox provides it on
+# PATH (it bundles its own Node runtime). Patterns are quoted so prettier does
+# its own globbing; .prettierignore excludes dagger.json files, testdata, and
+# the Helm chart templates (which contain Go template syntax, not valid YAML).
+vars:
+  PRETTIER_CONFIG: ./.prettierrc.yaml
+  PRETTIER_PATTERNS: '"*.yaml" "*.md" "*.json" "**/*.yaml" "**/*.md" "**/*.json"'
+
+# `sources` lets Task skip prettier entirely when no formattable file changed.
+# The globs mirror PRETTIER_PATTERNS, and the `exclude:` entries mirror
+# .prettierignore (which Task does not read); .prettierignore and the config
+# itself are sources too, so editing either re-runs prettier. `exclude:` must
+# follow the positive globs it negates.
 tasks:
-  # The kclipper toolchain exposes a single format function covering both
-  # Go and prettier targets; there is no standalone prettier module at the
-  # repo root, so format here applies both.
-  format:
-    desc: Formats Go, YAML, JSON, and Markdown files via Dagger
+  lint:
+    desc: Lints YAML, JSON, and Markdown formatting with prettier
+    sources: &prettier-sources
+      - "**/*.yaml"
+      - "**/*.md"
+      - "**/*.json"
+      - .prettierignore
+      - exclude: "**/dagger.json"
+      - exclude: "**/testdata/**"
+      - exclude: "**/templates/**"
     cmds:
-      - dagger call -y kclipper format
+      - prettier --config {{.PRETTIER_CONFIG}} --check {{.PRETTIER_PATTERNS}}
 
-  lint:
-    desc: Lints YAML, JSON, and Markdown files via Dagger
+  format:
+    desc: Formats YAML, JSON, and Markdown with prettier
+    sources: *prettier-sources
     cmds:
-      - dagger check kclipper:lint-prettier
+      - prettier --config {{.PRETTIER_CONFIG}} -w {{.PRETTIER_PATTERNS}}

.taskfiles/gh/Taskfile.yaml

@@ -3,8 +3,41 @@ version: "3"
 set: [errexit, nounset, pipefail]
 shopt: [globstar]
 
+# GitHub configuration linting. Both checks run through Dagger via the `ci`
+# toolchain: Actions workflows through the zizmor toolchain, the Renovate config
+# through a pinned renovate-config-validator in a Node container. Neither tool is
+# on the devbox PATH.
 tasks:
-  lint:
-    desc: Lints GitHub Actions workflows via Dagger
+  actions:lint:
+    desc: Lints GitHub Actions workflows with zizmor
+    summary: |
+      Linting runs zizmor via the `ci` toolchain's zizmor toolchain dependency,
+      against .github/workflows with .github/zizmor.yaml. It runs through Dagger
+      because zizmor is not on the devbox PATH.
+    # `sources` skips the Dagger invocation when no workflow or zizmor config
+    # changed. A zizmor version bump (pinned in the `ci` module) is not tracked
+    # here; re-run with --force or `task clean` after upgrading the toolchain.
+    sources:
+      - .github/workflows/*.yaml
+      - .github/workflows/*.yml
+      - .github/zizmor.yaml
+    cmds:
+      - dagger call ci lint-actions
+
+  renovate:lint:
+    desc: Validates the Renovate configuration with renovate-config-validator
+    summary: |
+      Validation runs renovate-config-validator at a pinned version in a Node
+      container via the `ci` toolchain. It runs through Dagger because neither
+      devbox nor a shared toolchain provides the validator.
+    # `sources` skips the Dagger invocation when the Renovate config is
+    # unchanged. The validator version is pinned in the `ci` module and is not
+    # tracked here; re-run with --force or `task clean` after upgrading it.
+    sources:
+      - .github/renovate.json5
     cmds:
-      - dagger check kclipper:lint-actions
+      - dagger call ci lint-renovate
+
+  lint:
+    desc: Lints GitHub configuration (Actions workflows + Renovate config)
+    deps: [actions:lint, renovate:lint]