feat: Evaluate task-based tool installation vs. GitHub Actions for tools like uv and nodejs

[coderabbitai]

Summary

A discussion in #110 raised the question of whether tools like uv (and potentially nodejs) should be installed via task scripts rather than dedicated GitHub composite Actions.

Context

In #110 (comment), @davidlion suggested that for tools which are relatively easy for us to manage ourselves (e.g., uv, rust), we could create task scripts to install and set up the environment — similar to how CLP handles rust. This approach would benefit both local builds and CI pipelines equally, while CI composite actions would be reserved for tools that users are expected to manage themselves.

@davidlion also noted that the toolchain code from CLP probably should eventually be moved into yscope-dev-utils.

@Bill-hbrhbr noted several advantages of the current approach using pipx and GitHub Actions (see CLP #1320):

• pipx avoids modifying system directories; prepending the pipx bin path to PATH ensures correct version priority.
• GitHub Actions remove the need to handle runner environment differences, user/group handling, partial script invocation, and sudo.
• setup-task and setup-uv are published by their respective maintainers, making them reliable dependencies.

Additionally, nodejs is being considered for addition to toolchains.

Discussion Points

• Should tools like uv be installed via task scripts to unify local and CI setup?
• Which tools are best managed via GitHub composite Actions vs. task scripts?
• Should CLP's toolchain task scripts be migrated to yscope-dev-utils?

References

• PR: feat(ci): Add reusable GitHub actions for CI setup; Bump actions/checkout to v6.0.2. #110
• Discussion comment: feat(ci): Add reusable GitHub actions for CI setup; Bump actions/checkout to v6.0.2. #110 (comment)
• CLP toolchains reference: https://github.com/y-scope/clp/blob/main/taskfiles/toolchains.yaml#L57
• CLP PR with pipx-based install: https://github.com/y-scope/clp/pull/1320/changes

Opened by @Bill-hbrhbr.

[davidlion]

To be clear the points the points about pipx and github actions are not reasons against a create a task that can work both locally and in CI.

pipx avoids modifying system directories; prepending the pipx bin path to PATH ensures correct version priority.

It is very possible to use task to install a tool local to the project or a user. Many tooling install scripts do this by default anyway (e.g. the main recommended go-task install script).

GitHub Actions remove the need to handle runner environment differences, user/group handling, partial script invocation, and sudo.

Not really sure how this is relevant if a dependency/tool is installed locally to the project.

setup-task and setup-uv are published by their respective maintainers, making them reliable dependencies.

Many projects like go-task and uv have their own 1 line installation scripts as the recommended method to install so this would only be an advantage in rare cases where there is a maintainer-made github action, but no maintainer-made build script. One example would be installing an arbitrary version of python without using uv.