ci: complete mise.lock, pin mise and install with --locked

.github/workflows/release-notes.yaml

@@ -63,8 +63,13 @@ jobs:
       - name: Set up mise
         uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          install_args: communique
+          # --locked: install only tools listed in mise.lock and never rewrite it (see test.yml).
+          install_args: --locked communique
           cache: false
+          # mise is pinned because `--locked` rules change between releases (2026.11.0 started to require a
+          # checksum). sha256 is the linux-x64 mise binary from the v2026.11.5 release.
+          version: 2026.11.5
+          sha256: 7a5b051d6f17d335c502f8047a5175cf3103f347d91942771c60da4e302ebcb0
 
       - name: Resolve previous release ref
         run: |

.github/workflows/release-please.yaml

@@ -49,8 +49,13 @@ jobs:
       - name: Set up mise
         uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          install_args: node communique
+          # --locked: install only tools listed in mise.lock and never rewrite it (see test.yml).
+          install_args: --locked node communique
           cache: false
+          # mise is pinned because `--locked` rules change between releases (2026.11.0 started to require a
+          # checksum). sha256 is the linux-x64 mise binary from the v2026.11.5 release.
+          version: 2026.11.5
+          sha256: 7a5b051d6f17d335c502f8047a5175cf3103f347d91942771c60da4e302ebcb0
 
       - name: Install locked Release Please dependency
         env:

.github/workflows/test.yml

@@ -39,6 +39,15 @@ jobs:
 
       - name: Set up mise
         uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        with:
+          # --locked installs only tools listed in mise.lock, fails when an entry is missing, and never rewrites it.
+          # Without it, `mise install` fills in missing lock data and downloads tools again to do it, so a slow
+          # www.lua.org failed this step.
+          install_args: --locked
+          # mise is pinned because `--locked` rules change between releases (2026.11.0 started to require a
+          # checksum). sha256 is the linux-x64 mise binary from the v2026.11.5 release.
+          version: 2026.11.5
+          sha256: 7a5b051d6f17d335c502f8047a5175cf3103f347d91942771c60da4e302ebcb0
 
       - name: Install release tooling dependencies
         env:

mise.toml

@@ -14,10 +14,16 @@
 
 [settings]
 # Maintain a committed mise.lock pinning resolved URLs + checksums for the
-# binary-download tools (the integrity role flake.lock used to play).
-# Caveats: the conda-backed luajit only locks the platform it was resolved on
-# (Linux CI backfills its entry on first install); source-built tools (lua,
-# neovim) and npm-backed prettier record a URL/version but no checksum.
+# tools (the integrity role flake.lock used to play). Keep it complete: when it
+# lacks an entry that `mise lock` would write, a plain `mise install` writes
+# that entry again and downloads the tool to do it, so a slow www.lua.org once
+# failed CI's "Set up mise" step. CI runs `mise install --locked`, which fails
+# when a tool is missing from this file and never rewrites it.
+# npm-backed prettier records a version but no checksum, and the conda-backed
+# luajit records its conda packages only for the platform it was locked on.
+# The vfox backend (lua, neovim) records a checksum but does not compare its
+# download with it: Lua builds from the lua.org tarball unchecked, and the
+# Neovim plugin checks the upstream checksum instead.
 # Regenerate with: mise lock -p linux-x64,macos-arm64
 lockfile = true