Merge branch 'main' into task-secret

taskfile/ast/matrix.go

@@ -93,6 +93,21 @@ func (matrix *Matrix) DeepCopy() *Matrix {
 	}
 }
 
+// DeepCopy returns a copy of the MatrixRow. Without this, deepcopy.OrderedMap
+// falls back to copying the *MatrixRow pointer as-is, so every "copy" of a
+// Matrix would still share the same underlying rows - see #2890, where
+// concurrent invocations of a task with a `ref:` matrix row raced on
+// resolveMatrixRefs mutating that shared row.
+func (row *MatrixRow) DeepCopy() *MatrixRow {
+	if row == nil {
+		return nil
+	}
+	return &MatrixRow{
+		Ref:   row.Ref,
+		Value: deepcopy.Slice(row.Value),
+	}
+}
+
 func (matrix *Matrix) UnmarshalYAML(node *yaml.Node) error {
 	switch node.Kind {
 	case yaml.MappingNode:

taskfile/node.go

@@ -93,8 +93,8 @@ func getScheme(uri string) (string, error) {
 		return "git", nil
 	}
 
-	if i := strings.Index(uri, "://"); i != -1 {
-		return uri[:i], nil
+	if before, _, ok := strings.Cut(uri, "://"); ok {
+		return before, nil
 	}
 
 	return "", nil

taskfile/reader.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/url"
 	"os"
+	"slices"
 	"sync"
 	"time"
 
@@ -285,12 +286,7 @@ func (r *Reader) isTrusted(uri string) bool {
 	host := parsedURL.Host
 
 	// Check against each trusted pattern (exact match including port if provided)
-	for _, pattern := range r.trustedHosts {
-		if host == pattern {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(r.trustedHosts, host)
 }
 
 func (r *Reader) include(ctx context.Context, node Node) error {