Bump Task to 3.53.1 in CI and Dockerfiles

Upgrade the pinned Task CLI to 3.53.1 across CI and Docker build configs. Updated defaults and ARGs in .github/actions/setup-task/action.yml, .github/workflows/publish-ci-image.yml, docker/ci/Dockerfile, docker/embedded/Dockerfile(.fat,.ultra-lite) and engine/Dockerfile. Also updated platform-specific SHA256 checksums for the Task archives and clarified the action description to note native runner support.

.github/actions/setup-task/action.yml

@@ -1,10 +1,10 @@
 name: Setup Task from the CI image
-description: Install the pinned Task binary, using the Ubuntu CI image on Linux
+description: Install the pinned Task binary from the CI image on Linux or natively on other runners
 inputs:
   version:
     description: Task version to install
     required: false
-    default: 3.52.0
+    default: 3.53.1
 runs:
   using: composite
   steps:
@@ -36,10 +36,10 @@ runs:
         install_dir="${RUNNER_TEMP}/task-bin"
         mkdir -p "${install_dir}"
         case "${RUNNER_OS}-${RUNNER_ARCH}" in
-          macOS-X64) task_platform=darwin; task_arch=amd64; task_file=task_darwin_amd64.tar.gz; task_sha256=416348147bc2f1c729417249d932add7894fb01a126128778195942c249d7c0b ;;
-          macOS-ARM64) task_platform=darwin; task_arch=arm64; task_file=task_darwin_arm64.tar.gz; task_sha256=debfa9a3bc06fcb5d5550b44725ecd22bb305499ce057bd6d7a774db5cdaa7b8 ;;
-          Windows-X64) task_platform=windows; task_arch=amd64; task_file=task_windows_amd64.zip; task_sha256=e3bd4439b445f4f135758a2666ec8b33ccde789f7f615309c58f116b0e566e79 ;;
-          Windows-ARM64) task_platform=windows; task_arch=arm64; task_file=task_windows_arm64.zip; task_sha256=3f3b5bbf23d10c73f8f11bc4a47d1465f3a61a30fa231fddf0a87edc52937237 ;;
+          macOS-X64) task_platform=darwin; task_arch=amd64; task_file=task_darwin_amd64.tar.gz; task_sha256=7f1a702d54a789cb818a636039a83df071f4179893133afafa4eba351a7e19ef ;;
+          macOS-ARM64) task_platform=darwin; task_arch=arm64; task_file=task_darwin_arm64.tar.gz; task_sha256=85d2d96c2380b33d7855b07b3f7a20dc7ca0eda999a26efa0fb5f6f32b366cd7 ;;
+          Windows-X64) task_platform=windows; task_arch=amd64; task_file=task_windows_amd64.zip; task_sha256=27c0cd248c12cba03d8958d954a3df981c900be885ec9ce5f6a3cdc4e9a19316 ;;
+          Windows-ARM64) task_platform=windows; task_arch=arm64; task_file=task_windows_arm64.zip; task_sha256=4f7c32c0b5a09aabfd860bcf4ff5649f0483339c1f7f90ad5ee55692da7237b6 ;;
           *) echo "Unsupported runner: ${RUNNER_OS}-${RUNNER_ARCH}" >&2; exit 1 ;;
         esac
         archive="${RUNNER_TEMP}/${task_file}"

.github/workflows/publish-ci-image.yml

@@ -6,7 +6,7 @@ on:
       task-version:
         description: Task version to publish
         required: true
-        default: 3.52.0
+        default: 3.53.1
         type: string
   push:
     paths:
@@ -28,7 +28,7 @@ jobs:
         shell: bash
         env:
           INPUT_VERSION: ${{ inputs.task-version }}
-        run: echo "value=${INPUT_VERSION:-3.52.0}" >> "${GITHUB_OUTPUT}"
+        run: echo "value=${INPUT_VERSION:-3.53.1}" >> "${GITHUB_OUTPUT}"
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

docker/ci/Dockerfile

@@ -1,9 +1,9 @@
-# Lightweight Ubuntu image with a pinned Task binary for CI experiments.
+# Lightweight Ubuntu image with a pinned Task binary for CI.
 # Build with: task docker:build:ci
 
 FROM ubuntu:noble@sha256:561618e2c15bf2397621dd04f96926663a3b5616c189cf7e38db7e82f5c538ea
 
-ARG TASK_VERSION=3.52.0
+ARG TASK_VERSION=3.53.1
 ARG TARGETARCH=amd64
 
 RUN set -eux; \
@@ -11,8 +11,8 @@ RUN set -eux; \
     apt-get install --no-install-recommends -y ca-certificates curl tar; \
     rm -rf /var/lib/apt/lists/*; \
     case "${TARGETARCH}" in \
-      amd64) task_arch=amd64; task_sha256=02c679ffae53dca791804847d78b31731615894e292948397c971c87ac9e95bd ;; \
-      arm64) task_arch=arm64; task_sha256=7e0044108830cec0534577b289564e3b7c83e6df276feb631a1edc63d04e4ebe ;; \
+      amd64) task_arch=amd64; task_sha256=a54a408f6861ff921f6e87774180db31bacd8c1e7c944ca696db9fea49a82fc7 ;; \
+      arm64) task_arch=arm64; task_sha256=e3ad19101493a0112e1f22ae8ccc54bf03e533b1076a0ca1e6c782a09ad2e588 ;; \
       *) echo "Unsupported Docker architecture: ${TARGETARCH}" >&2; exit 1 ;; \
     esac; \
     archive="/tmp/task_linux_${task_arch}.tar.gz"; \

docker/embedded/Dockerfile

@@ -7,7 +7,7 @@ ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}
 # Stage 1: Build the Java application and frontend
 FROM gradle:9.6.1-jdk25@sha256:e8aeffb8197b17151ce24607811f60e91125f0018f7a3b08dc504ba9168a9c4f AS app-build
 
-ARG TASK_VERSION=3.49.1
+ARG TASK_VERSION=3.53.1
 RUN apt-get update \
     && apt-get install -y --no-install-recommends curl ca-certificates \
     && update-ca-certificates \

docker/embedded/Dockerfile.fat

@@ -8,7 +8,7 @@ ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}
 # Stage 1: Build the Java application and frontend
 FROM gradle:9.6.1-jdk25@sha256:e8aeffb8197b17151ce24607811f60e91125f0018f7a3b08dc504ba9168a9c4f AS app-build
 
-ARG TASK_VERSION=3.49.1
+ARG TASK_VERSION=3.53.1
 RUN apt-get update \
     && apt-get install -y --no-install-recommends curl ca-certificates \
     && update-ca-certificates \

docker/embedded/Dockerfile.ultra-lite

@@ -5,7 +5,7 @@
 FROM gradle:9.6.1-jdk25@sha256:e8aeffb8197b17151ce24607811f60e91125f0018f7a3b08dc504ba9168a9c4f AS build
 
 # Install Node.js and npm for frontend build
-ARG TASK_VERSION=3.49.1
+ARG TASK_VERSION=3.53.1
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \

engine/Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.5
 FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim@sha256:531f855bda2c73cd6ef67d56b733b357cea384185b3022bd09f05e002cd144ca
 
-ARG TASK_VERSION=3.52.0
+ARG TASK_VERSION=3.53.1
 RUN apt-get update \
     && apt-get install -y --no-install-recommends curl ca-certificates \
     && ARCH=$(dpkg --print-architecture) \