Repository navigation
ci: complete mise.lock, pin mise and install with --locked - #439
Conversation
… run mise.lock lacked the Lua checksum, the reviewfixer task tool and LuaJIT's conda packages, so every `mise install` in CI wrote those entries again and downloaded lua-5.5.0.tar.gz from www.lua.org to do it, even with all tools cached. A slow lua.org then failed "Set up mise". A new unit-tests step fails when `mise install` changes mise.lock. _Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high_
|
@codex review |
|
@codex security review |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 26897257de
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…lock afterwards _Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high_
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
_Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high_
ThomasK33
changed the title
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
_Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high_
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Why
CI's "Set up mise" step failed twice today on two PRs (the 0.4.0 release PR, run 42637745893, and #438, run 42650046753), each time after three timeouts downloading
https://www.lua.org/ftp/lua-5.5.0.tar.gz. All 15 tools were already restored from the mise cache. The download happened anyway becausemise.lockwas incomplete: withlockfile = true,mise installwrites every entry thatmise lockwould write, and it downloads the tool to compute a missing checksum.What
mise.lock: the output ofmise lock -p linux-x64,macos-arm64on main. It adds the Lua checksum for both platforms, thegithub:ThomasK33/reviewfixerentries (thereviewfixtask's tool), and LuaJIT's conda packages for linux-x64. The Lua checksumsha256:57ccc32b…matches the hash that www.lua.org/ftp/ publishes and the hash of the downloaded tarball.unit-tests: "Set up mise" now runsmise install --locked(install_args). It installs only tools listed inmise.lock, never rewrites it, and fails at once when a tool is missing from it, instead of downloading lock data on every run. Lua still downloads from www.lua.org on a cold cache, because the vfox plugin supplies that URL.release-please.yamlandrelease-notes.yaml: their mise setup installs with--lockedtoo (--locked node communique,--locked communique). Runs 42640921895 and 42649849602 show both release jobs checking all 32 lock targets, Lua included.7a5b051d…). The--lockedrules changed in 2026.11.0, and CI otherwise takes each new mise release on the day it ships. The release tarballs match the release'sSHASUMS256.txt, and the.tar.gzand.tar.zstarchives hold the same binary.mise.toml: the[settings]comment now says to keep the lock complete and why, and that the vfox backend (Lua, Neovim) records a checksum without comparing the download with it.Testing
mise.lock,MISE_LOG_LEVEL=debug mise install(all tools installed) logged 10 www.lua.org references and rewrotemise.lock(41 added lines). With thismise.lock, the same command logged 0 and left the file byte-identical, twice.mise install --lockedexited 0 with 0 www.lua.org references on both main's and thismise.lock, and rewrote neither.mise install --locked node communiqueandmise install --locked communiqueboth exited 0. With communique's checksum removed from the lock,--lockedfailed at once with "No lockfile checksum found".mise run all: treefmt 0 changed, luacheck 0 warnings / 0 errors, 1062 successes / 0 failures / 0 errors / 7 pending.The first CI run on this PR misses the mise cache (the key follows the lockfile), so it downloads every tool once.
Generated with
xum• Model:anthropic:claude-opus-5-5• Thinking:high