feat: add mise-env option to run-script

.github/workflows/run-script.yml

@@ -18,6 +18,10 @@ on:
         type: boolean
         description: "Expose the job's read-only GitHub token to the script as GH_TOKEN"
         default: false
+      mise-env:
+        type: string
+        description: "Value for MISE_ENV, selecting additional mise.<env>.toml config files"
+        default: ""
     secrets:
       STEP_SECURITY_API_KEY:
         required: false
@@ -29,6 +33,8 @@ jobs:
       contents: read
     env:
       HARDEN_RUNNER: ${{ secrets.STEP_SECURITY_API_KEY != '' }} # zizmor: ignore[secrets-outside-env]
+      MISE_ENV: ${{ inputs.mise-env }}
+      MISE_LOCKED: "1"
     steps:
       - name: Harden Runner
         if: env.HARDEN_RUNNER == 'true'

README.md

@@ -34,6 +34,15 @@ commits never get one, so a SHA is what names the commit you meant.
 
 Run a set of commands on the repository, with the required tools installed via `mise`.
 
+Tools are read from `mise.toml`, and the `mise.lock` lockfile is required to be
+present and contain all the tools to install. `.tool-versions` is not supported
+due to lack of hash pinning.
+
+Set `mise-env` to select a [mise
+environment](https://mise.jdx.dev/configuration/environments.html) via
+`MISE_ENV`, so that `mise.<env>.toml` files (such as one with CI-only tools)
+are loaded on top of the default config.
+
 
 ```
   Lint:

mise.toml

@@ -0,0 +1,8 @@
+[tools]
+just = "1.58.0"
+prek = "0.5.5"
+uv = "0.13.4"
+
+[settings]
+lockfile = true
+lockfile_platforms = ["linux-x64", "linux-arm64", "macos-x64", "macos-arm64"]