[skevetter]

Three provider CI/tooling updates:

1. Replace softprops/action-gh-release with gh release upload --clobber. Its update-release PATCH failed for SSH v1.1.43, leaving Latest without provider.yaml and causing downstream 404s.
2. Standardize hooks on prek.toml with versioned tools in mise.toml/mise.lock, exact project Go versions for Go hooks, and jdx/mise-action in CI.
3. Remove Taskfile.yml and preserve all prior tasks in mise.toml.

Verification: prek validate-config and actionlint pass. Every migrated task is listed by mise tasks; representative lint, test, argument-bearing, and download task definitions were exercised. The exact release-upload command succeeded against SSH v1.1.43.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 37 seconds.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: fafb3f53-3b43-4d7f-86d3-aeea85f834ab

📥 Commits

Reviewing files that changed from the base of the PR and between 8738a07 and 6e6247c.

⛔ Files ignored due to path filters: 1

• mise.lock is excluded by !**/*.lock

📒 Files selected for processing: 5

• .github/workflows/pre-commit.yml
• .pre-commit-config.yaml
• Taskfile.yml
• mise.toml
• prek.toml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 666bfe84-bbf6-4c89-82ea-2ff84fc42ed7

📥 Commits

Reviewing files that changed from the base of the PR and between c0ecced and 8738a07.

📒 Files selected for processing: 2

• .github/workflows/pre-commit.yml
• .pre-commit-config.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The release workflow now uploads provider.yaml with gh release upload. The pre-commit workflow sets up Go from go.mod, and Go hooks use the system Go installation by default.

Changes: Release asset upload

Layer / File(s)	Summary
Upload release asset .github/workflows/release.yaml	The workflow uploads provider.yaml to the GoReleaser tag with gh release upload --clobber and GITHUB_TOKEN. This replaces the softprops/action-gh-release step.

Pre-commit Go setup

Layer / File(s)	Summary
Configure Go for hooks .github/workflows/pre-commit.yml, .pre-commit-config.yaml	The workflow sets up Go from go.mod before running prek. The pre-commit configuration selects the system Go installation as the default Go hook language version.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 8738a

The release workflow uploads the provider asset to the intended release, and pre-commit uses the Go version declared by the module. No material merge risk remains.

Security architecture risk: 🔵 Low · up to 8738a

Release publication retains the same token permissions, target tag, and asset. Replacement can still leave the asset missing after failure; that behavior predates this PR. Equivalence of retry and concurrent-run recovery behavior remains uncertain.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The publication credential retains repository contents-write authority, which is broader than this single asset. The new command names only dist/provider.yaml and does not introduce a different repository target or an additional credential scope.

Trust Boundaries and Controls

• observed — Pull-request pre-commit execution remains in a separate workflow with contents: read. Adding Go setup does not change its trigger to a privileged pull-request context or give it the release workflow's write permission.

Pre-merge checks: 5

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the main changes: hardening the release upload and standardizing prek tooling.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}