chore: pin mockgen and govulncheck as go tools

.execs/tools.flow

@@ -9,29 +9,29 @@ executables:
       dir: //
       failFast: false
       maxThreads: 3
+      # mockgen and govulncheck are pinned as tools in go.mod and run with `go tool`, so they
+      # need no install. The tools below are kept out of go.mod because their dependency trees
+      # would leak into the module graph of anything importing pkg/.
       execs:
         - cmd: |
             if ! command -v go &> /dev/null; then
               echo "Go is not installed. Please install Go first."
               exit 1
             fi
         - cmd: |
-            if ! command -v cobra-cli &> /dev/null; then
-              echo "cobra-cli is not installed. Installing..."
-              go install github.com/spf13/cobra-cli@v1.3.0
+            # GOBIN is shared across repos, so a binary already on PATH may be another repo's
+            # version. Reinstall whenever its module version differs from the pin.
+            want=v1.3.0
+            have=$(go version -m "$(command -v cobra-cli 2>/dev/null)" 2>/dev/null | awk '$1 == "mod" {print $3}')
+            if [ "$have" != "$want" ]; then
+              echo "Installing cobra-cli ${want} (found: ${have:-none})..."
+              go install github.com/spf13/cobra-cli@${want}
             fi
         - cmd: |
-            if ! command -v goreleaser &> /dev/null; then
-              echo "goreleaser is not installed. Installing..."
-              go install github.com/goreleaser/goreleaser/v2@v2.12.5
-            fi
-        - cmd: |
-            if ! command -v ginkgo &> /dev/null; then
-              echo "ginkgo is not installed. Installing..."
-              go install github.com/onsi/ginkgo/v2/ginkgo@v2.20.2
-            fi
-        - cmd: |
-            if ! command -v mockgen &> /dev/null; then
-              echo "mockgen is not installed. Installing..."
-              go install go.uber.org/mock/mockgen@v0.4.0
+            # Keep in sync with the goreleaser install in .github/workflows/release.yaml.
+            want=v2.12.5
+            have=$(go version -m "$(command -v goreleaser 2>/dev/null)" 2>/dev/null | awk '$1 == "mod" {print $3}')
+            if [ "$have" != "$want" ]; then
+              echo "Installing goreleaser ${want} (found: ${have:-none})..."
+              go install github.com/goreleaser/goreleaser/v2@${want}
             fi

.execs/validate.flow

@@ -85,22 +85,18 @@ executables:
     exec:
       dir: //
       cmd: |
-        # Without this, a failed install leaves the scan to run a missing binary and the step
-        # still "succeeds" — CI then fails two steps later on an empty SARIF file.
+        # Without this, a failed scan still lets the step "succeed" — CI then fails two steps
+        # later on an empty SARIF file.
         set -euo pipefail
 
-        if ! command -v govulncheck &> /dev/null; then
-          echo "Installing govulncheck..."
-          go install golang.org/x/vuln/cmd/govulncheck@latest
-        fi
-
+        # govulncheck is pinned as a tool in go.mod, so local and CI runs use the same version.
         if [ "${CI:-}" = "true" ]; then
           # govulncheck can list the same call stack twice for a finding, and upload-sarif rejects
           # duplicate stacks.
-          govulncheck -format sarif ./... \
+          go tool govulncheck -format sarif ./... \
             | jq '.runs[].results[] |= (if .stacks then .stacks |= unique else . end)' > govuln.sarif
           echo "Security scan completed. Results saved to govuln.sarif"
         else
-          govulncheck ./...
+          go tool govulncheck ./...
           echo "Security scan completed. No vulnerabilities found."
         fi

.github/workflows/ci.yaml

@@ -135,8 +135,6 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
-      - name: Install mockgen
-        run: go install go.uber.org/mock/mockgen@v0.4.0
       # Build the flow under review and run every task with it, so CI exercises
       # the code as it would land on main rather than the released CLI.
       - name: Build flow

docs/development.md

@@ -150,13 +150,17 @@ flow build binary ./bin/flow-dev
 
 ### Required Tools
 
-These are installed automatically by `flow install tools`:
+These are installed at their pinned versions by `flow install tools`:
 
 - [cobra-cli](https://github.com/spf13/cobra-cli) - CLI scaffolding
 - [goreleaser](https://goreleaser.com/) - Binary builds and package distribution
-- [golangci-lint](https://golangci-lint.run/) - Code linting
-- [ginkgo](https://onsi.github.io/ginkgo/) - BDD testing framework
+
+These are pinned in `go.mod` with `tool` directives and run with `go tool`, so they need no install:
+
 - [mockgen](https://github.com/uber-go/mock) - Generate test mocks
+- [govulncheck](https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck) - Vulnerability scanning
+
+[golangci-lint](https://golangci-lint.run/) runs at a pinned version through `go run` in `flow lint`.
 
 ### Additional Tools
 

go.mod

@@ -27,7 +27,7 @@ require (
 	go.etcd.io/bbolt v1.5.0
 	go.uber.org/mock v0.6.0
 	golang.org/x/exp v0.0.0-20250718183923-645b1fa84792
-	golang.org/x/mod v0.41.0
+	golang.org/x/mod v0.42.0
 	golang.org/x/sync v0.24.0
 	golang.org/x/term v0.47.0
 	golang.org/x/text v0.43.0
@@ -104,7 +104,14 @@ require (
 	github.com/zalando/go-keyring v0.2.8 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/crypto v0.58.0 // indirect
-	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/net v0.61.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
-	golang.org/x/tools v0.51.0 // indirect
+	golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e // indirect
+	golang.org/x/tools v0.52.0 // indirect
+	golang.org/x/vuln v1.9.0 // indirect
+)
+
+tool (
+	go.uber.org/mock/mockgen
+	golang.org/x/vuln/cmd/govulncheck
 )

go.sum

@@ -116,12 +116,16 @@ github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
 github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/gofrs/flock v0.13.1 h1:jjREztyBeSKBZYAC+mgc1laB+xsgy4kYMf3FbKF2UBo=
 github.com/gofrs/flock v0.13.1/go.mod h1:sf4BFiHwnvgxa25DlQoDqXQnwRMEOwqxRq37P6MzzmE=
+github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786 h1:rcv+Ippz6RAtvaGgKxc+8FQIpxHgsF+HBzPyYL2cyVU=
+github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786/go.mod h1:apVn/GCasLZUVpAJ6oWAuyP7Ne7CEsQbTnc0plM3m+o=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/jsonschema-go v0.4.2 h1:tmrUohrwoLZZS/P3x7ex0WAVknEkBZM46iALbcqoRA8=
 github.com/google/jsonschema-go v0.4.2/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE=
 github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
 github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
+github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
@@ -248,21 +252,29 @@ golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
 golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/exp v0.0.0-20250718183923-645b1fa84792 h1:R9PFI6EUdfVKgwKjZef7QIwGcBKu86OEFpJ9nUEP2l4=
 golang.org/x/exp v0.0.0-20250718183923-645b1fa84792/go.mod h1:A+z0yzpGtvnG90cToK5n2tu8UJVP2XUATh+r+sfOOOc=
-golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
-golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
-golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
-golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
+golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
 golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
 golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e h1:P6NGsugec4oASJ+yKMNgTndeo0h2CbixZLvQIe9h5R4=
+golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e/go.mod h1:GNu+nb+E5axfGmP+Uu3ZVQu5lE/Xk42MjZOHWUD94/o=
 golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
 golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
 golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
-golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
-golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
+golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs=
+golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs=
+golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
+golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
+golang.org/x/vuln v1.9.0 h1:12VaqnI9kJfqwRoPptxoqsUhQtdfrSbdksT7X/KY/sc=
+golang.org/x/vuln v1.9.0/go.mod h1:E/Frwm0xp49fTyBW+6CQHdkvobknbwUM49yEpMGUauw=
 google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
 google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/mcp/command_executor.go

@@ -100,7 +100,7 @@ func mcpProvenance(ctx context.Context) runProvenance {
 	return prov
 }
 
-//go:generate mockgen -destination=mocks/command_executor.go -package=mocks . CommandExecutor
+//go:generate go tool mockgen -destination=mocks/command_executor.go -package=mocks . CommandExecutor
 type CommandExecutor interface {
 	Execute(args ...string) (string, error)
 	ExecuteContext(ctx context.Context, args ...string) (string, error)

internal/runner/engine/engine.go

@@ -10,7 +10,7 @@ import (
 	"github.com/flowexec/flow/v2/internal/runner/engine/retry"
 )
 
-//go:generate mockgen -destination=mocks/mock_engine.go -package=mocks github.com/flowexec/flow/v2/internal/runner/engine Engine
+//go:generate go tool mockgen -destination=mocks/mock_engine.go -package=mocks github.com/flowexec/flow/v2/internal/runner/engine Engine
 
 type Result struct {
 	ID      string

internal/runner/runner.go

@@ -13,7 +13,7 @@ import (
 	"github.com/flowexec/flow/v2/types/executable"
 )
 
-//go:generate mockgen -destination=mocks/mock_runner.go -package=mocks github.com/flowexec/flow/v2/internal/runner Runner
+//go:generate go tool mockgen -destination=mocks/mock_runner.go -package=mocks github.com/flowexec/flow/v2/internal/runner Runner
 type Runner interface {
 	Name() string
 	Exec(

pkg/cache/executables_cache.go

@@ -24,7 +24,7 @@ import (
 
 const execCacheKey = "executables"
 
-//go:generate mockgen -destination=mocks/mock_executable_cache.go -package=mocks github.com/flowexec/flow/v2/pkg/cache ExecutableCache
+//go:generate go tool mockgen -destination=mocks/mock_executable_cache.go -package=mocks github.com/flowexec/flow/v2/pkg/cache ExecutableCache
 type ExecutableCache interface {
 	Update() error
 	GetExecutableByRef(ref executable.Ref) (*executable.Executable, error)