[amondnet]

Summary

Commit mise.lock so mise-installed tools are verified against recorded checksums and URLs instead of being resolved fresh on every install. min_version moves to 2026.11.1, the first mise release that writes and reads lockfile format 4.

• Adds mise.lock (lockfile_version 4) for node 24.22.2, bun 1.3.14, cargo:hk 1.48.0, and mr-boxington 1.29.2.
• Adds mise.macos-x64.lock for Intel Macs, which build mbx from crates.io through the cargo:mbx alias in mise.macos-x64.toml. Only the version is recorded, the same layout as ci: adopt mbx (mr-boxington) build cache locally and in CI shunt#894.
• Adds a mise run lock task and sets min_version = "2026.11.1" in mise.toml.

Scope

• node and bun carry sha256 and URL for linux x64/arm64 (plus musl and baseline), macos arm64/x64, and windows x64.
• mr-boxington uses the GitHub release backend (packslip:github.com/jdx/mr-boxington) with checksums for linux x64/arm64 (gnu and musl), macos-arm64, and windows-x64. There is no darwin x86_64 release asset.
• cargo:hk is a source build, so only its version is recorded.
• The Rust toolchain stays owned by rust-toolchain.toml (out of scope per the issue).

Tradeoffs

• mise run lock task. On an Intel Mac, .miserc.toml's auto_env loads mise.macos-x64.toml, so a plain mise lock writes mr-boxington into the base mise.lock under the cargo:mbx backend with no checksums. The task relocks with MISE_AUTO_ENV=false and locks mr-boxington without macos-x64. Regenerating from scratch with the task reproduces the committed lockfile, and running it again is a no-op.
• No workflow change for --locked. jdx/mise-action v4.2.0 (used in ci.yml and docs.yml) adds --locked to mise install when the repo has a mise lockfile, so CI installs node and bun from the recorded URLs and checksums. cargo:hk and mr-boxington stay disabled in CI through MISE_DISABLE_TOOLS.

Blast radius

Anyone running mise install now gets the locked versions and checksums. Contributors on a mise older than 2026.11.1 are blocked by the new min_version. CI behavior changes only through the automatic --locked.

Verification

• Regenerated both lockfiles from scratch with mise run lock on an Intel Mac (mise 2026.11.1) and got the committed content. A second run changed nothing.
• Not verified locally: the locked install on Linux CI. All tools were already installed on this machine, so the dry-run did not exercise checksum verification. This PR's CI run is that check.

Related issue

Closes #136

Checklist

• PR title follows Conventional Commits
• Tests added or updated, and the suite passes (mise run test) — N/A, no code change
• Lint/format pass (mise run lint) — N/A, config and lockfiles only
• Documentation updated if behavior changed — the mise run lock task is self-describing
• No breaking change, or a BREAKING CHANGE: note is included

---

Summary by cubic

Commits the mise lockfiles so mise-installed tools are verified against recorded checksums and URLs instead of being resolved fresh on each install. Closes #136.

• mise.lock records checksums and URLs for node, bun, and mr-boxington, plus the version for the cargo-built hk.
• Adds mise.macos-x64.lock for Intel Macs, where mbx is built from crates.io through the cargo:mbx alias (version only).
• Adds a mise run lock task so plain mise lock on Intel Macs doesn't fold the macos-x64 alias into the base lockfile.
• Bumps min_version to 2026.11.1, the first mise release that writes and reads lockfile format 4.

Migration

• CI installs with --locked automatically via jdx/mise-action v4.2.0.
• Contributors on mise older than 2026.11.1 are blocked by the new min_version.

^{Written for commit 97573ea. Summary will update on new commits.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[gemini-code-assist]

Code Review

This pull request introduces auto-generated lockfiles (mise.lock and mise.macos-x64.lock) and updates mise.toml to specify a minimum required version of mise and add a new lock task. A critical issue was found in mise.toml where min_version is set to a non-existent future version ("2026.11.1"), which would block all mise executions; this should be corrected to "2024.11.1".

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Adds tool lockfiles with recorded versions, download URLs, and checksums.

• mise installs use locked tool downloads across platforms.
• The lock task refreshes checksums without the Intel Mac alias.

No actionable issues were found. Downloaded assets and checksum values were not verified at runtime.

_{Reviews (1) · Last reviewed commit: "build: commit mise.lock so mise-installe..." · Reviewed by Greptile}

[cubic-dev-ai]

cubic analysis

All reported issues were addressed across 3 files

Linked issue analysis

Linked issue: pleaseai/code-search#136: build: commit a mise.lock so mise-installed tools are checksum-verified

Status	Acceptance criteria	Notes
✅	Lock every mise-installed tool with its artifact details	mise.lock records the configured tools, including checksums and URLs for downloadable artifacts.
✅	Add a lockfile for the macOS x64 configuration	mise.macos-x64.lock records mr-boxington through the cargo:mbx backend for Intel Macs.
✅	Require a mise version that supports the lockfile format	mise.toml sets min_version to 2026.11.1, the version identified as supporting format 4.

Architecture diagram

sequenceDiagram
    participant Dev as Developer
    participant Mise as Mise CLI
    participant Lock as Mise Lockfile
    participant Registry as External Registries
    participant CI as CI Workflow

    Note over Dev,Mise: Lockfile Configuration

    Dev->>Mise: mise install
    Mise->>Lock: Read mise.lock (lockfile_version 4)
    alt Lockfile exists and min_version satisfied
        Mise->>Registry: Fetch tools using recorded checksums and URLs
        Registry-->>Mise: Node, bun, mr-boxington, hk binaries
        Mise->>Registry: Verify sha256 checksums
    else No lockfile or stale
        Mise->>Registry: Resolve tools fresh
        Registry-->>Mise: Tool metadata and binaries
    end

    Note over Dev,Mise: Intel Mac Workflow

    Dev->>Mise: mise run lock
    Mise->>Mise: Set MISE_AUTO_ENV=false
    Mise->>Lock: Lock node, bun, cargo:hk
    Mise->>Lock: Lock mr-boxington (excludes macos-x64)
    Mise->>Lock: Write mise.lock (no macos-x64 cargo:mbx alias)
    Mise->>Lock: Write mise.macos-x64.lock (cargo:mbx version only)

    Note over Mise,CI: CI Behavior

    CI->>Mise: mise install with --locked flag
    Mise->>Lock: Read locked versions and checksums
    Mise->>Registry: Install from recorded URLs
    Registry-->>Mise: Verified tools
    Note over CI: Disabled tools: cargo:hk, mr-boxington via MISE_DISABLE_TOOLS

    alt Old mise version (< 2026.11.1)
        Mise->>Dev: Block execution (min_version not satisfied)
    end

Loading

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 1 benchmark is dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 7 untouched benchmarks

---

_{Comparing amondnet/136-mise-lock (97573ea) with main (48bea95)}