diff --git a/.github/workflows/release-notes.yaml b/.github/workflows/release-notes.yaml index e8476761..efd9ccb1 100644 --- a/.github/workflows/release-notes.yaml +++ b/.github/workflows/release-notes.yaml @@ -63,8 +63,13 @@ jobs: - name: Set up mise uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 with: - install_args: communique + # --locked: install only tools listed in mise.lock and never rewrite it (see test.yml). + install_args: --locked communique cache: false + # mise is pinned because `--locked` rules change between releases (2026.11.0 started to require a + # checksum). sha256 is the linux-x64 mise binary from the v2026.11.5 release. + version: 2026.11.5 + sha256: 7a5b051d6f17d335c502f8047a5175cf3103f347d91942771c60da4e302ebcb0 - name: Resolve previous release ref run: | diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml index db46bf63..258d1b4a 100644 --- a/.github/workflows/release-please.yaml +++ b/.github/workflows/release-please.yaml @@ -49,8 +49,13 @@ jobs: - name: Set up mise uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 with: - install_args: node communique + # --locked: install only tools listed in mise.lock and never rewrite it (see test.yml). + install_args: --locked node communique cache: false + # mise is pinned because `--locked` rules change between releases (2026.11.0 started to require a + # checksum). sha256 is the linux-x64 mise binary from the v2026.11.5 release. + version: 2026.11.5 + sha256: 7a5b051d6f17d335c502f8047a5175cf3103f347d91942771c60da4e302ebcb0 - name: Install locked Release Please dependency env: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 2b790d60..303c5e57 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -39,6 +39,15 @@ jobs: - name: Set up mise uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 + with: + # --locked installs only tools listed in mise.lock, fails when an entry is missing, and never rewrites it. + # Without it, `mise install` fills in missing lock data and downloads tools again to do it, so a slow + # www.lua.org failed this step. + install_args: --locked + # mise is pinned because `--locked` rules change between releases (2026.11.0 started to require a + # checksum). sha256 is the linux-x64 mise binary from the v2026.11.5 release. + version: 2026.11.5 + sha256: 7a5b051d6f17d335c502f8047a5175cf3103f347d91942771c60da4e302ebcb0 - name: Install release tooling dependencies env: diff --git a/mise.lock b/mise.lock index 16f3e62b..f3df30fd 100644 --- a/mise.lock +++ b/mise.lock @@ -1,5 +1,17 @@ # @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html +[conda-packages.linux-x64."_openmp_mutex-4.5-20_gnu"] +url = "https://conda.anaconda.org/conda-forge/linux-64/_openmp_mutex-4.5-20_gnu.conda" +checksum = "sha256:1dd3fffd892081df9726d7eb7e0dea6198962ba775bd88842135a4ddb4deb3c9" + +[conda-packages.linux-x64."libgcc-16.2.0-ha9f2e26_7"] +url = "https://conda.anaconda.org/conda-forge/linux-64/libgcc-16.2.0-ha9f2e26_7.conda" +checksum = "sha256:e031634c3a928f9594eba868bc46ef5230d6571a364a0c63215b06c4563bfcea" + +[conda-packages.linux-x64."libgomp-16.2.0-he0feb66_7"] +url = "https://conda.anaconda.org/conda-forge/linux-64/libgomp-16.2.0-he0feb66_7.conda" +checksum = "sha256:92a0bb350c7be6a4eedcb4e111c60aefd176018e6b1c009a6e025dbe9bbcd758" + [[tools.actionlint]] version = "1.7.12" backend = "aqua:rhysd/actionlint" @@ -42,6 +54,22 @@ url = "https://github.com/junegunn/fzf/releases/download/v0.73.1/fzf-0.73.1-linu checksum = "sha256:d27fd68c04fb9b42f7c73a3f7d38069a74d308e40174f64a072c747213e97286" url = "https://github.com/junegunn/fzf/releases/download/v0.73.1/fzf-0.73.1-darwin_arm64.tar.gz" +[[tools."github:ThomasK33/reviewfixer"]] +version = "0.1.0-beta.0" +backend = "github:ThomasK33/reviewfixer" + +[tools."github:ThomasK33/reviewfixer"."platforms.linux-x64"] +checksum = "sha256:4eb3a976ec5519dc1c9d7251b086a7596a9eae3e8afed79002231c0748f8b51c" +checksum_source = "mise-versions" +url = "https://github.com/ThomasK33/reviewfixer/releases/download/v0.1.0-beta.0/reviewfixer_0.1.0-beta.0_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/ThomasK33/reviewfixer/releases/assets/406574132" + +[tools."github:ThomasK33/reviewfixer"."platforms.macos-arm64"] +checksum = "sha256:0f8230121494ec7110fe369e4bcf46b162a8e021386a74ca9e3a76ddf4880014" +checksum_source = "mise-versions" +url = "https://github.com/ThomasK33/reviewfixer/releases/download/v0.1.0-beta.0/reviewfixer_0.1.0-beta.0_darwin_arm64.tar.gz" +url_api = "https://api.github.com/repos/ThomasK33/reviewfixer/releases/assets/406574133" + [[tools."github:numtide/treefmt"]] version = "2.5.0" backend = "github:numtide/treefmt" @@ -75,9 +103,11 @@ version = "5.5.0" backend = "vfox:mise-plugins/vfox-lua" [tools.lua."platforms.linux-x64"] +checksum = "sha256:57ccc32bbbd005cab75bcc52444052535af691789dba2b9016d5c50640d68b3d" url = "https://www.lua.org/ftp/lua-5.5.0.tar.gz" [tools.lua."platforms.macos-arm64"] +checksum = "sha256:57ccc32bbbd005cab75bcc52444052535af691789dba2b9016d5c50640d68b3d" url = "https://www.lua.org/ftp/lua-5.5.0.tar.gz" [[tools.luajit]] @@ -87,6 +117,15 @@ backend = "conda:luajit" [tools.luajit.options] channel = "conda-forge" +[tools.luajit."platforms.linux-x64"] +checksum = "sha256:ba8559635ebee997cfb3fe3ade3131bcae487e4b6e858770c2f0dc597b700044" +url = "https://conda.anaconda.org/conda-forge/linux-64/luajit-2.1.1744318430-h280c20c_0.conda" +conda_deps = [ + "libgcc-16.2.0-ha9f2e26_7", + "_openmp_mutex-4.5-20_gnu", + "libgomp-16.2.0-he0feb66_7", +] + [tools.luajit."platforms.macos-arm64"] checksum = "sha256:51cadbc5cc111fb0f8804c501603e22d03af38285f75f393c289b254408f47ed" url = "https://conda.anaconda.org/conda-forge/osx-arm64/luajit-2.1.1744318430-h1a92334_0.conda" @@ -97,9 +136,11 @@ version = "0.12.3" backend = "vfox:mise-plugins/vfox-neovim" [tools.neovim."platforms.linux-x64"] +checksum = "sha256:c441b547142860bf01bcce39e36cbed185c41112813e15443b16e5237750724d" url = "https://github.com/neovim/neovim/releases/download/v0.12.3/nvim-linux-x86_64.tar.gz" [tools.neovim."platforms.macos-arm64"] +checksum = "sha256:532da1d00e465a660fa01c3d4991333d09c52107dce7df937368545daca0a14e" url = "https://github.com/neovim/neovim/releases/download/v0.12.3/nvim-macos-arm64.tar.gz" [[tools.node]] diff --git a/mise.toml b/mise.toml index 2d480524..e909fac2 100644 --- a/mise.toml +++ b/mise.toml @@ -14,10 +14,16 @@ [settings] # Maintain a committed mise.lock pinning resolved URLs + checksums for the -# binary-download tools (the integrity role flake.lock used to play). -# Caveats: the conda-backed luajit only locks the platform it was resolved on -# (Linux CI backfills its entry on first install); source-built tools (lua, -# neovim) and npm-backed prettier record a URL/version but no checksum. +# tools (the integrity role flake.lock used to play). Keep it complete: when it +# lacks an entry that `mise lock` would write, a plain `mise install` writes +# that entry again and downloads the tool to do it, so a slow www.lua.org once +# failed CI's "Set up mise" step. CI runs `mise install --locked`, which fails +# when a tool is missing from this file and never rewrites it. +# npm-backed prettier records a version but no checksum, and the conda-backed +# luajit records its conda packages only for the platform it was locked on. +# The vfox backend (lua, neovim) records a checksum but does not compare its +# download with it: Lua builds from the lua.org tarball unchecked, and the +# Neovim plugin checks the upstream checksum instead. # Regenerate with: mise lock -p linux-x64,macos-arm64 lockfile = true