From 420ba6e8e5459096c60f101e28f7c1a1d92964df Mon Sep 17 00:00:00 2001 From: Alberto Donato Date: Mon, 26 Oct 2026 16:26:23 +0100 Subject: [PATCH 1/8] feat: add mise-env option to run-script ### what add a `mise-env` parameter to the `run-script` workflow to set `MISE_ENV`, so that `mise..toml` config files are loaded on top of the default config. ### why Allow using CI-specific tooling without having `mise` pick it up by default in the repo ### testing will test in workflows ### docs updated docs Co-Authored-By: Claude Opus 5.5 --- .github/workflows/run-script.yml | 5 +++++ README.md | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/.github/workflows/run-script.yml b/.github/workflows/run-script.yml index 9a13e6f..d2528a3 100644 --- a/.github/workflows/run-script.yml +++ b/.github/workflows/run-script.yml @@ -18,6 +18,10 @@ on: type: boolean description: "Expose the job's read-only GitHub token to the script as GH_TOKEN" default: false + mise-env: + type: string + description: "Value for MISE_ENV, selecting additional mise..toml config files" + default: "" secrets: STEP_SECURITY_API_KEY: required: false @@ -29,6 +33,7 @@ jobs: contents: read env: HARDEN_RUNNER: ${{ secrets.STEP_SECURITY_API_KEY != '' }} # zizmor: ignore[secrets-outside-env] + MISE_ENV: ${{ inputs.mise-env }} steps: - name: Harden Runner if: env.HARDEN_RUNNER == 'true' diff --git a/README.md b/README.md index fc38592..930f865 100644 --- a/README.md +++ b/README.md @@ -34,6 +34,11 @@ commits never get one, so a SHA is what names the commit you meant. Run a set of commands on the repository, with the required tools installed via `mise`. +Tools are read from the standard mise config files (`mise.toml`, `.tool-versions`, ...). +Set `mise-env` to select a [mise environment](https://mise.jdx.dev/configuration/environments.html) +via `MISE_ENV`, so that `mise..toml` files (such as one with CI-only tools) are +loaded on top of the default config. + ``` Lint: From d91458886bfb677abcfe398909dca8ba37482b80 Mon Sep 17 00:00:00 2001 From: Alberto Donato Date: Mon, 26 Oct 2026 18:24:48 +0100 Subject: [PATCH 2/8] run mise with --locked --- .github/workflows/run-script.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/run-script.yml b/.github/workflows/run-script.yml index d2528a3..725d52e 100644 --- a/.github/workflows/run-script.yml +++ b/.github/workflows/run-script.yml @@ -53,6 +53,8 @@ jobs: with: minimum_release_age: 7d cache: true + env: + MISE_LOCKED: "1" # Always read the cache, it's safe to do so even on untrusted PRs. - name: Restore pre-commit cache From 2fe2ecbfb3d9d99e084774f230cb3b946cc78113 Mon Sep 17 00:00:00 2001 From: Alberto Donato Date: Mon, 26 Oct 2026 18:29:04 +0100 Subject: [PATCH 3/8] chore: replace mise config --- .tool-versions | 3 --- mise.lock | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++ mise.toml | 11 ++++++++++ 3 files changed, 66 insertions(+), 3 deletions(-) delete mode 100644 .tool-versions create mode 100644 mise.lock create mode 100644 mise.toml diff --git a/.tool-versions b/.tool-versions deleted file mode 100644 index 9373257..0000000 --- a/.tool-versions +++ /dev/null @@ -1,3 +0,0 @@ -just 1.58.0 -prek 0.5.5 -uv 0.12.23 diff --git a/mise.lock b/mise.lock new file mode 100644 index 0000000..1df5f6f --- /dev/null +++ b/mise.lock @@ -0,0 +1,55 @@ +# @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html + +[[tools.just]] +version = "1.58.0" +backend = "aqua:casey/just" + +[tools.just."platforms.linux-arm64"] +checksum = "sha256:748237128c4c40cbdabc65e841d05ceba13cc23a91eaba395495894c1d9764df" +url = "https://github.com/casey/just/releases/download/1.58.0/just-1.58.0-aarch64-unknown-linux-musl.tar.gz" + +[tools.just."platforms.linux-x64"] +checksum = "sha256:4a5cc2f53e6f0f8c59092a6cc38291eb729d46a7dd95d3ae582008881b84931d" +url = "https://github.com/casey/just/releases/download/1.58.0/just-1.58.0-x86_64-unknown-linux-musl.tar.gz" + +[tools.just."platforms.macos-x64"] +checksum = "sha256:9a09cfef66aaa79da58203970103a0684307716caaabd3e9844cacc4dc0f4023" +url = "https://github.com/casey/just/releases/download/1.58.0/just-1.58.0-x86_64-apple-darwin.tar.gz" + +[[tools.prek]] +version = "0.5.5" +backend = "aqua:j178/prek" + +[tools.prek."platforms.linux-arm64"] +checksum = "sha256:e7208e5d42daaa8d9167971e7d2d3388d80cce241d1cecea745a6c88d6b6368e" +url = "https://github.com/j178/prek/releases/download/v0.5.5/prek-aarch64-unknown-linux-musl.tar.gz" +provenance = "github-attestations" + +[tools.prek."platforms.linux-x64"] +checksum = "sha256:57948d4772f4eb58387ce4a6d619ecd2d8d7e9d765eed6a316f5b3f92c86d951" +url = "https://github.com/j178/prek/releases/download/v0.5.5/prek-x86_64-unknown-linux-musl.tar.gz" +provenance = "github-attestations" + +[tools.prek."platforms.macos-x64"] +checksum = "sha256:9ea09639374a34b6f0b7d2a2567c175221cd37e44004e9b1cf591f31f9dda1b3" +url = "https://github.com/j178/prek/releases/download/v0.5.5/prek-x86_64-apple-darwin.tar.gz" +provenance = "github-attestations" + +[[tools.uv]] +version = "0.13.4" +backend = "aqua:astral-sh/uv" + +[tools.uv."platforms.linux-arm64"] +checksum = "sha256:253a17cadcb659ae77a0fe3b9a2f1c14297528d480c421899e61e64d64f24e8f" +url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-musl.tar.gz" +provenance = "github-attestations" + +[tools.uv."platforms.linux-x64"] +checksum = "sha256:28d4385f9f9d1d1c7654d85b3855e0e2615b2f6cc13136a2edff858bbdc16ff1" +url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-musl.tar.gz" +provenance = "github-attestations" + +[tools.uv."platforms.macos-x64"] +checksum = "sha256:7be2dcd316122f4b3e5a0a7889f6248266c14425374e105ff7dc9779184603a6" +url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz" +provenance = "github-attestations" diff --git a/mise.toml b/mise.toml new file mode 100644 index 0000000..7e8f0f4 --- /dev/null +++ b/mise.toml @@ -0,0 +1,11 @@ +[tools] +just = "1.58.0" +prek = "0.5.5" +uv = "0.13.4" + +[settings] +lockfile = true + +[tasks.lock] +description = "Update mise.lock for all supported platforms" +run = "mise lock --platform linux-x64,linux-arm64,macos-x64" From fefc4090985968c2907c6655fd1204c61f13fbb5 Mon Sep 17 00:00:00 2001 From: Alberto Donato Date: Mon, 26 Oct 2026 18:31:10 +0100 Subject: [PATCH 4/8] global env --- .github/workflows/run-script.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/run-script.yml b/.github/workflows/run-script.yml index 725d52e..a07a6ed 100644 --- a/.github/workflows/run-script.yml +++ b/.github/workflows/run-script.yml @@ -34,6 +34,7 @@ jobs: env: HARDEN_RUNNER: ${{ secrets.STEP_SECURITY_API_KEY != '' }} # zizmor: ignore[secrets-outside-env] MISE_ENV: ${{ inputs.mise-env }} + MISE_LOCKED: "1" steps: - name: Harden Runner if: env.HARDEN_RUNNER == 'true' @@ -53,8 +54,6 @@ jobs: with: minimum_release_age: 7d cache: true - env: - MISE_LOCKED: "1" # Always read the cache, it's safe to do so even on untrusted PRs. - name: Restore pre-commit cache From 14619555f8864faa4881f008e4f525ca6135c7fe Mon Sep 17 00:00:00 2001 From: Alberto Donato Date: Mon, 26 Oct 2026 18:34:18 +0100 Subject: [PATCH 5/8] update platforms --- mise.lock | 14 ++++++++++++++ mise.toml | 2 +- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/mise.lock b/mise.lock index 1df5f6f..d29f948 100644 --- a/mise.lock +++ b/mise.lock @@ -12,6 +12,10 @@ url = "https://github.com/casey/just/releases/download/1.58.0/just-1.58.0-aarch6 checksum = "sha256:4a5cc2f53e6f0f8c59092a6cc38291eb729d46a7dd95d3ae582008881b84931d" url = "https://github.com/casey/just/releases/download/1.58.0/just-1.58.0-x86_64-unknown-linux-musl.tar.gz" +[tools.just."platforms.macos-arm64"] +checksum = "sha256:50ae3e996c974a0bf32ea7d10f495070df33f1b43e0616b2769e3d4821ed8f48" +url = "https://github.com/casey/just/releases/download/1.58.0/just-1.58.0-aarch64-apple-darwin.tar.gz" + [tools.just."platforms.macos-x64"] checksum = "sha256:9a09cfef66aaa79da58203970103a0684307716caaabd3e9844cacc4dc0f4023" url = "https://github.com/casey/just/releases/download/1.58.0/just-1.58.0-x86_64-apple-darwin.tar.gz" @@ -30,6 +34,11 @@ checksum = "sha256:57948d4772f4eb58387ce4a6d619ecd2d8d7e9d765eed6a316f5b3f92c86d url = "https://github.com/j178/prek/releases/download/v0.5.5/prek-x86_64-unknown-linux-musl.tar.gz" provenance = "github-attestations" +[tools.prek."platforms.macos-arm64"] +checksum = "sha256:e4bc3132023b50020e62b073bc3147082828bf250d8b9282850c6f2bed5471b6" +url = "https://github.com/j178/prek/releases/download/v0.5.5/prek-aarch64-apple-darwin.tar.gz" +provenance = "github-attestations" + [tools.prek."platforms.macos-x64"] checksum = "sha256:9ea09639374a34b6f0b7d2a2567c175221cd37e44004e9b1cf591f31f9dda1b3" url = "https://github.com/j178/prek/releases/download/v0.5.5/prek-x86_64-apple-darwin.tar.gz" @@ -49,6 +58,11 @@ checksum = "sha256:28d4385f9f9d1d1c7654d85b3855e0e2615b2f6cc13136a2edff858bbdc16 url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-musl.tar.gz" provenance = "github-attestations" +[tools.uv."platforms.macos-arm64"] +checksum = "sha256:e0b1d4743ce64c55d9f0f4a444afa6b81125680070ee04e853fcd0f6c1ebf8f1" +url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz" +provenance = "github-attestations" + [tools.uv."platforms.macos-x64"] checksum = "sha256:7be2dcd316122f4b3e5a0a7889f6248266c14425374e105ff7dc9779184603a6" url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz" diff --git a/mise.toml b/mise.toml index 7e8f0f4..3297e25 100644 --- a/mise.toml +++ b/mise.toml @@ -8,4 +8,4 @@ lockfile = true [tasks.lock] description = "Update mise.lock for all supported platforms" -run = "mise lock --platform linux-x64,linux-arm64,macos-x64" +run = "mise lock --platform linux-x64,linux-arm64,macos-arm64" From 9cb73b83aa85261c3882386476bdcf7ab035a7ce Mon Sep 17 00:00:00 2001 From: Alberto Donato Date: Mon, 26 Oct 2026 18:38:21 +0100 Subject: [PATCH 6/8] drop task --- mise.toml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/mise.toml b/mise.toml index 3297e25..bde242e 100644 --- a/mise.toml +++ b/mise.toml @@ -5,7 +5,3 @@ uv = "0.13.4" [settings] lockfile = true - -[tasks.lock] -description = "Update mise.lock for all supported platforms" -run = "mise lock --platform linux-x64,linux-arm64,macos-arm64" From d4f1f034172b04b5e67a476ed8595d43c414d4f2 Mon Sep 17 00:00:00 2001 From: Alberto Donato Date: Mon, 26 Oct 2026 18:46:32 +0100 Subject: [PATCH 7/8] declare platforms --- mise.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/mise.toml b/mise.toml index bde242e..5fe9d32 100644 --- a/mise.toml +++ b/mise.toml @@ -5,3 +5,4 @@ uv = "0.13.4" [settings] lockfile = true +lockfile_platforms = ["linux-x64", "linux-arm64", "macos-x64", "macos-arm64"] From 51c38589c89eb23bb3cf575e814b077d9eaf2738 Mon Sep 17 00:00:00 2001 From: Alberto Donato Date: Mon, 26 Oct 2026 19:33:49 +0100 Subject: [PATCH 8/8] readme updates --- README.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 930f865..75fe760 100644 --- a/README.md +++ b/README.md @@ -34,10 +34,14 @@ commits never get one, so a SHA is what names the commit you meant. Run a set of commands on the repository, with the required tools installed via `mise`. -Tools are read from the standard mise config files (`mise.toml`, `.tool-versions`, ...). -Set `mise-env` to select a [mise environment](https://mise.jdx.dev/configuration/environments.html) -via `MISE_ENV`, so that `mise..toml` files (such as one with CI-only tools) are -loaded on top of the default config. +Tools are read from `mise.toml`, and the `mise.lock` lockfile is required to be +present and contain all the tools to install. `.tool-versions` is not supported +due to lack of hash pinning. + +Set `mise-env` to select a [mise +environment](https://mise.jdx.dev/configuration/environments.html) via +`MISE_ENV`, so that `mise..toml` files (such as one with CI-only tools) +are loaded on top of the default config. ```