From 26897257de35f747249ea5fad035d5c07337500d Mon Sep 17 00:00:00 2001 From: Thomas Kosiewski Date: Mon, 9 Nov 2026 16:14:37 +0000 Subject: [PATCH 1/4] ci: complete mise.lock so mise install stops downloading Lua on every run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mise.lock lacked the Lua checksum, the reviewfixer task tool and LuaJIT's conda packages, so every `mise install` in CI wrote those entries again and downloaded lua-5.5.0.tar.gz from www.lua.org to do it, even with all tools cached. A slow lua.org then failed "Set up mise". A new unit-tests step fails when `mise install` changes mise.lock. _Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high_ --- .github/workflows/test.yml | 8 ++++++++ mise.lock | 41 ++++++++++++++++++++++++++++++++++++++ mise.toml | 10 ++++++---- 3 files changed, 55 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 2b790d60..aeda654a 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -40,6 +40,14 @@ jobs: - name: Set up mise uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 + # `mise install` rewrites an incomplete mise.lock and downloads tools again to do it. + - name: Check that mise.lock is complete + run: | + if ! git diff --exit-code -- mise.lock; then + echo "::error file=mise.lock::mise install changed mise.lock. Run 'mise lock -p linux-x64,macos-arm64' and commit the result." + exit 1 + fi + - name: Install release tooling dependencies env: NPM_CONFIG_IGNORE_SCRIPTS: "true" diff --git a/mise.lock b/mise.lock index 16f3e62b..f3df30fd 100644 --- a/mise.lock +++ b/mise.lock @@ -1,5 +1,17 @@ # @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html +[conda-packages.linux-x64."_openmp_mutex-4.5-20_gnu"] +url = "https://conda.anaconda.org/conda-forge/linux-64/_openmp_mutex-4.5-20_gnu.conda" +checksum = "sha256:1dd3fffd892081df9726d7eb7e0dea6198962ba775bd88842135a4ddb4deb3c9" + +[conda-packages.linux-x64."libgcc-16.2.0-ha9f2e26_7"] +url = "https://conda.anaconda.org/conda-forge/linux-64/libgcc-16.2.0-ha9f2e26_7.conda" +checksum = "sha256:e031634c3a928f9594eba868bc46ef5230d6571a364a0c63215b06c4563bfcea" + +[conda-packages.linux-x64."libgomp-16.2.0-he0feb66_7"] +url = "https://conda.anaconda.org/conda-forge/linux-64/libgomp-16.2.0-he0feb66_7.conda" +checksum = "sha256:92a0bb350c7be6a4eedcb4e111c60aefd176018e6b1c009a6e025dbe9bbcd758" + [[tools.actionlint]] version = "1.7.12" backend = "aqua:rhysd/actionlint" @@ -42,6 +54,22 @@ url = "https://github.com/junegunn/fzf/releases/download/v0.73.1/fzf-0.73.1-linu checksum = "sha256:d27fd68c04fb9b42f7c73a3f7d38069a74d308e40174f64a072c747213e97286" url = "https://github.com/junegunn/fzf/releases/download/v0.73.1/fzf-0.73.1-darwin_arm64.tar.gz" +[[tools."github:ThomasK33/reviewfixer"]] +version = "0.1.0-beta.0" +backend = "github:ThomasK33/reviewfixer" + +[tools."github:ThomasK33/reviewfixer"."platforms.linux-x64"] +checksum = "sha256:4eb3a976ec5519dc1c9d7251b086a7596a9eae3e8afed79002231c0748f8b51c" +checksum_source = "mise-versions" +url = "https://github.com/ThomasK33/reviewfixer/releases/download/v0.1.0-beta.0/reviewfixer_0.1.0-beta.0_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/ThomasK33/reviewfixer/releases/assets/406574132" + +[tools."github:ThomasK33/reviewfixer"."platforms.macos-arm64"] +checksum = "sha256:0f8230121494ec7110fe369e4bcf46b162a8e021386a74ca9e3a76ddf4880014" +checksum_source = "mise-versions" +url = "https://github.com/ThomasK33/reviewfixer/releases/download/v0.1.0-beta.0/reviewfixer_0.1.0-beta.0_darwin_arm64.tar.gz" +url_api = "https://api.github.com/repos/ThomasK33/reviewfixer/releases/assets/406574133" + [[tools."github:numtide/treefmt"]] version = "2.5.0" backend = "github:numtide/treefmt" @@ -75,9 +103,11 @@ version = "5.5.0" backend = "vfox:mise-plugins/vfox-lua" [tools.lua."platforms.linux-x64"] +checksum = "sha256:57ccc32bbbd005cab75bcc52444052535af691789dba2b9016d5c50640d68b3d" url = "https://www.lua.org/ftp/lua-5.5.0.tar.gz" [tools.lua."platforms.macos-arm64"] +checksum = "sha256:57ccc32bbbd005cab75bcc52444052535af691789dba2b9016d5c50640d68b3d" url = "https://www.lua.org/ftp/lua-5.5.0.tar.gz" [[tools.luajit]] @@ -87,6 +117,15 @@ backend = "conda:luajit" [tools.luajit.options] channel = "conda-forge" +[tools.luajit."platforms.linux-x64"] +checksum = "sha256:ba8559635ebee997cfb3fe3ade3131bcae487e4b6e858770c2f0dc597b700044" +url = "https://conda.anaconda.org/conda-forge/linux-64/luajit-2.1.1744318430-h280c20c_0.conda" +conda_deps = [ + "libgcc-16.2.0-ha9f2e26_7", + "_openmp_mutex-4.5-20_gnu", + "libgomp-16.2.0-he0feb66_7", +] + [tools.luajit."platforms.macos-arm64"] checksum = "sha256:51cadbc5cc111fb0f8804c501603e22d03af38285f75f393c289b254408f47ed" url = "https://conda.anaconda.org/conda-forge/osx-arm64/luajit-2.1.1744318430-h1a92334_0.conda" @@ -97,9 +136,11 @@ version = "0.12.3" backend = "vfox:mise-plugins/vfox-neovim" [tools.neovim."platforms.linux-x64"] +checksum = "sha256:c441b547142860bf01bcce39e36cbed185c41112813e15443b16e5237750724d" url = "https://github.com/neovim/neovim/releases/download/v0.12.3/nvim-linux-x86_64.tar.gz" [tools.neovim."platforms.macos-arm64"] +checksum = "sha256:532da1d00e465a660fa01c3d4991333d09c52107dce7df937368545daca0a14e" url = "https://github.com/neovim/neovim/releases/download/v0.12.3/nvim-macos-arm64.tar.gz" [[tools.node]] diff --git a/mise.toml b/mise.toml index 2d480524..4d16c46d 100644 --- a/mise.toml +++ b/mise.toml @@ -14,10 +14,12 @@ [settings] # Maintain a committed mise.lock pinning resolved URLs + checksums for the -# binary-download tools (the integrity role flake.lock used to play). -# Caveats: the conda-backed luajit only locks the platform it was resolved on -# (Linux CI backfills its entry on first install); source-built tools (lua, -# neovim) and npm-backed prettier record a URL/version but no checksum. +# tools (the integrity role flake.lock used to play). Keep it complete: when it +# lacks an entry that `mise lock` would write, every `mise install` writes that +# entry again and downloads the tool to do it, so a slow www.lua.org once failed +# CI's "Set up mise" step. CI fails when `mise install` changes this file. +# npm-backed prettier records a version but no checksum, and the conda-backed +# luajit records its conda packages only for the platform it was locked on. # Regenerate with: mise lock -p linux-x64,macos-arm64 lockfile = true From 092189c053f79063cf39ad977ee4e35f2e9bba0c Mon Sep 17 00:00:00 2001 From: Thomas Kosiewski Date: Mon, 9 Nov 2026 16:22:42 +0000 Subject: [PATCH 2/4] ci: install tools with mise install --locked instead of checking the lock afterwards MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit _Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high_ --- .github/workflows/test.yml | 12 ++++-------- mise.toml | 7 ++++--- 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index aeda654a..38049371 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -39,14 +39,10 @@ jobs: - name: Set up mise uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 - - # `mise install` rewrites an incomplete mise.lock and downloads tools again to do it. - - name: Check that mise.lock is complete - run: | - if ! git diff --exit-code -- mise.lock; then - echo "::error file=mise.lock::mise install changed mise.lock. Run 'mise lock -p linux-x64,macos-arm64' and commit the result." - exit 1 - fi + with: + # --locked installs only from mise.lock and never rewrites it. Without it, `mise install` fills in missing lock + # data and downloads tools again to do it, so a slow www.lua.org failed this step. + install_args: --locked - name: Install release tooling dependencies env: diff --git a/mise.toml b/mise.toml index 4d16c46d..72e3738b 100644 --- a/mise.toml +++ b/mise.toml @@ -15,9 +15,10 @@ [settings] # Maintain a committed mise.lock pinning resolved URLs + checksums for the # tools (the integrity role flake.lock used to play). Keep it complete: when it -# lacks an entry that `mise lock` would write, every `mise install` writes that -# entry again and downloads the tool to do it, so a slow www.lua.org once failed -# CI's "Set up mise" step. CI fails when `mise install` changes this file. +# lacks an entry that `mise lock` would write, a plain `mise install` writes +# that entry again and downloads the tool to do it, so a slow www.lua.org once +# failed CI's "Set up mise" step. CI runs `mise install --locked`, which fails +# when a tool is missing from this file and never rewrites it. # npm-backed prettier records a version but no checksum, and the conda-backed # luajit records its conda packages only for the platform it was locked on. # Regenerate with: mise lock -p linux-x64,macos-arm64 From 371f28133566517d6cb89e80f2169a7f69b1c687 Mon Sep 17 00:00:00 2001 From: Thomas Kosiewski Date: Mon, 9 Nov 2026 16:42:22 +0000 Subject: [PATCH 3/4] ci: pin mise and install with --locked in the release workflows too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit _Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high_ --- .github/workflows/release-notes.yaml | 7 ++++++- .github/workflows/release-please.yaml | 7 ++++++- .github/workflows/test.yml | 4 ++++ mise.toml | 3 +++ 4 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-notes.yaml b/.github/workflows/release-notes.yaml index e8476761..0bcc86ad 100644 --- a/.github/workflows/release-notes.yaml +++ b/.github/workflows/release-notes.yaml @@ -63,8 +63,13 @@ jobs: - name: Set up mise uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 with: - install_args: communique + # --locked: install only from mise.lock, never rewrite it (see test.yml). + install_args: --locked communique cache: false + # mise is pinned because `--locked` rules change between releases (2026.11.0 started to require a + # checksum). sha256 is the linux-x64 mise binary from the v2026.11.5 release. + version: 2026.11.5 + sha256: 7a5b051d6f17d335c502f8047a5175cf3103f347d91942771c60da4e302ebcb0 - name: Resolve previous release ref run: | diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml index db46bf63..321d97e5 100644 --- a/.github/workflows/release-please.yaml +++ b/.github/workflows/release-please.yaml @@ -49,8 +49,13 @@ jobs: - name: Set up mise uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 with: - install_args: node communique + # --locked: install only from mise.lock, never rewrite it (see test.yml). + install_args: --locked node communique cache: false + # mise is pinned because `--locked` rules change between releases (2026.11.0 started to require a + # checksum). sha256 is the linux-x64 mise binary from the v2026.11.5 release. + version: 2026.11.5 + sha256: 7a5b051d6f17d335c502f8047a5175cf3103f347d91942771c60da4e302ebcb0 - name: Install locked Release Please dependency env: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 38049371..921b5320 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -43,6 +43,10 @@ jobs: # --locked installs only from mise.lock and never rewrites it. Without it, `mise install` fills in missing lock # data and downloads tools again to do it, so a slow www.lua.org failed this step. install_args: --locked + # mise is pinned because `--locked` rules change between releases (2026.11.0 started to require a + # checksum). sha256 is the linux-x64 mise binary from the v2026.11.5 release. + version: 2026.11.5 + sha256: 7a5b051d6f17d335c502f8047a5175cf3103f347d91942771c60da4e302ebcb0 - name: Install release tooling dependencies env: diff --git a/mise.toml b/mise.toml index 72e3738b..e909fac2 100644 --- a/mise.toml +++ b/mise.toml @@ -21,6 +21,9 @@ # when a tool is missing from this file and never rewrites it. # npm-backed prettier records a version but no checksum, and the conda-backed # luajit records its conda packages only for the platform it was locked on. +# The vfox backend (lua, neovim) records a checksum but does not compare its +# download with it: Lua builds from the lua.org tarball unchecked, and the +# Neovim plugin checks the upstream checksum instead. # Regenerate with: mise lock -p linux-x64,macos-arm64 lockfile = true From cfabf4629000e94ffb1f4fea9124b4edec1258c4 Mon Sep 17 00:00:00 2001 From: Thomas Kosiewski Date: Mon, 9 Nov 2026 16:54:26 +0000 Subject: [PATCH 4/4] ci: say exactly what mise install --locked guarantees MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit _Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high_ --- .github/workflows/release-notes.yaml | 2 +- .github/workflows/release-please.yaml | 2 +- .github/workflows/test.yml | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-notes.yaml b/.github/workflows/release-notes.yaml index 0bcc86ad..efd9ccb1 100644 --- a/.github/workflows/release-notes.yaml +++ b/.github/workflows/release-notes.yaml @@ -63,7 +63,7 @@ jobs: - name: Set up mise uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 with: - # --locked: install only from mise.lock, never rewrite it (see test.yml). + # --locked: install only tools listed in mise.lock and never rewrite it (see test.yml). install_args: --locked communique cache: false # mise is pinned because `--locked` rules change between releases (2026.11.0 started to require a diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml index 321d97e5..258d1b4a 100644 --- a/.github/workflows/release-please.yaml +++ b/.github/workflows/release-please.yaml @@ -49,7 +49,7 @@ jobs: - name: Set up mise uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 with: - # --locked: install only from mise.lock, never rewrite it (see test.yml). + # --locked: install only tools listed in mise.lock and never rewrite it (see test.yml). install_args: --locked node communique cache: false # mise is pinned because `--locked` rules change between releases (2026.11.0 started to require a diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 921b5320..303c5e57 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -40,8 +40,9 @@ jobs: - name: Set up mise uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 with: - # --locked installs only from mise.lock and never rewrites it. Without it, `mise install` fills in missing lock - # data and downloads tools again to do it, so a slow www.lua.org failed this step. + # --locked installs only tools listed in mise.lock, fails when an entry is missing, and never rewrites it. + # Without it, `mise install` fills in missing lock data and downloads tools again to do it, so a slow + # www.lua.org failed this step. install_args: --locked # mise is pinned because `--locked` rules change between releases (2026.11.0 started to require a # checksum). sha256 is the linux-x64 mise binary from the v2026.11.5 release.