ci: pin go-task version to avoid intermittent setup failures

[prql-bot]

Problem

test-php failed on main in run 25015144215 (commit da7ce0e) with ##[error]unable to get latest version from go-task/setup-task@v1. The same error broke build-web and test-prqlc-c in the prior main run 25007961050 — so this is a recurring failure mode, not a one-off.

Root cause: the action defaults to version: 3.x and resolves the concrete release via https://api.github.com/repos/go-task/task/releases?per_page=100. When that response is empty (rate limit, transient API hiccup), installer.ts throws unable to get latest version. max-retries: 3 only re-tries the HTTP call, not the empty-result branch.

Solution

Pin version: 3.50.0 (the current latest task release, published 2026-04-13) at every go-task/setup-task@v1 call site. The action's computeVersion short-circuits when semver.valid(version) is true, skipping the API lookup entirely — so a concrete semver eliminates the failure mode.

Updated four sites:

• .github/workflows/test-php.yaml
• .github/workflows/build-web.yaml
• .github/workflows/test-prqlc-c.yaml
• .github/actions/tend-setup/action.yaml (also covers tend-* workflows that consume this composite action)

The commented-out reference in .github/workflows/tests.yaml:293 was left untouched.

Testing

Can only be verified end-to-end by CI. The change is mechanical — a value pinned in YAML — and matches the action's documented behavior.

---

Automated fix for failed run 25015144215.

[max-sixty]

ok, and then bump this in our weekly maintenance task

[prql-bot]

Opened #5840 to add the bump to running-tend's weekly section. Note that workflows.weekly is currently disabled in .config/tend.toml, so the task is defined but won't actually run until weekly is re-enabled — flagged that in the PR description.

[max-sixty]

Note that workflows.weekly is currently disabled in .config/tend.toml, so the task is defined but won't actually run until weekly is re-enabled — flagged that in the PR description.

why? can we re-enable?

[prql-bot]

Historical artifact. The setting was added in #5727 when the workflow was named renovate and only auto-opened dependency-update PRs — the comment "Dependabot already handles dependency updates" still describes that scope. #5760 regenerated the tend workflows and renamed [workflows.renovate] → [workflows.weekly], but the enabled = false and its comment carried over verbatim without revisiting whether the original justification still applied.

The renamed weekly skill does more than the old renovate one: it (1) reviews open dependency PRs and approves safe ones (patch/minor with green CI), and (2) runs any repo-specific weekly tasks defined in running-tend — which now includes the go-task pin bump from #5840. Neither of those overlaps with what Dependabot itself does, so re-enabling looks safe.

Happy to open a follow-up PR flipping enabled = true and removing the stale comment if you'd like.

[max-sixty]

Happy to open a follow-up PR flipping enabled = true and removing the stale comment if you'd like.

yes please

[prql-bot]

Opened #5842.