[dependabot]

Bumps jdx/mise-action from 4.3.0 to 5.0.1.

Release notes

Sourced from jdx/mise-action's releases.

v5.0.1: Verify cached mise binaries before running them

mise-action now checks the integrity of an already-installed mise binary before running it. This fixes a security issue that was reported privately.

Fixed

• An existing mise binary is verified before it is run. When a mise binary is already on the runner (for example, restored from cache or in mise_dir), the action now checks it before calling it. If you set a sha256 input, the binary must match that checksum and report the requested version. Otherwise, it must match the signed release checksums for the version being installed. If the check fails, the action prints a warning, deletes the binary and installs the requested release again. Before this fix, the action could run a cached binary before checking it. (#637 by @​jdx)

Changed

Changes to how the action handles an existing binary, also from #637:

• Switching versions uses a full install. If the cached binary doesn't match the requested version, the action downloads and installs that version. It no longer runs mise self-update.
• Unpinned runs always pick a release. Without a version input, the action now selects a release every time, using minimum_release_age, even when mise is already installed. It then checks the existing binary against that release, and reinstalls if the binary doesn't match.
• Older releases need a sha256 input to reuse a cached binary. Some older mise releases have no signed checksums. With the sha256 input set, a cached binary of one of these releases can still be reused without a download. Without it, the action can't verify the binary and installs it again.

Full Changelog: jdx/mise-action@v5.0.0...v5.0.1

v5.0.0: Default minimum release age of 24 hours for mise

If you don't pin a version, mise-action now installs the newest stable mise release that is at least 24 hours old. Upgrading mise on a runner that already has it is also less likely to hit GitHub API rate limits.

Breaking Changes

minimum_release_age now defaults to 24h (#632 by @​jdx)

Before this release, minimum_release_age was an opt-in setting. It now defaults to 24h. If you don't set version, the action picks the highest-numbered stable mise release published at least 24 hours ago. A mise release that just shipped won't be installed until it's a day old.

To get the latest stable release right away, as in v4, set the delay to 0s. You can also choose a longer delay:

- uses: jdx/mise-action@v5
  with:
    minimum_release_age: 0s   # or e.g. 7d

• An explicit version input still takes precedence and skips the delay.
• The setting applies only to the mise binary, not to tools installed by mise.
• The action now gets the release list from a public CDN index (releases.tsv on mise.jdx.dev) instead of paging through the GitHub Releases API. Picking a release doesn't use GitHub API quota, even when an installed binary is reused. If the index is missing or malformed, the action fails instead of skipping the release-age check.
• Replacing an older installed binary still runs mise self-update, which may call the GitHub API to fetch that exact release.

Fixed

• mise self-update now runs with MISE_GITHUB_TOKEN. When a runner already had a different mise version installed, the action runs mise self-update to switch versions. That GitHub API call used to go out without authentication, so busy shared or self-hosted runners could hit the rate limit and fail with HTTP 403 RateLimitedError. If you already set a token in your environment, the action leaves it unchanged. (#619 by @​hegde5)

New Contributors

• @​hegde5 made their first contribution in #619

Full Changelog: jdx/mise-action@v4.3.0...v5.0.0

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

5.1.1 - 2026-10-04

🐛 Bug Fixes

• make GitHub token persistence opt-in (#658) by @​jdx in #658

---

5.1.0 - 2026-10-04

🚀 Features

• output active tool versions (#655) by @​jdx in #655
• add opt-in cache_save_post input (#649) by @​jdx in #649
• add plugins input (#656) by @​jdx in #656

🐛 Bug Fixes

• (cache) keep a cached mise instead of re-downloading when version is unset (#642) by @​jdx in #642
• save cache after inexact cache restore (#646) by @​jdx in #646
• extract mise zip with PowerShell instead of unzip on Windows (#650) by @​jdx in #650
• cache mise binary for caches saved without a version record (#648) by @​jdx in #648

📚 Documentation

• explain the Rust cache caveat and workarounds (#651) by @​jdx in #651
• add matrix and external cache guides; warn on shadowed mise_toml (#654) by @​jdx in #654

⚙️ Miscellaneous Tasks

• add TypeScript 7 alongside TypeScript 6 (#639) by @​jdx in #639
• make the final job depend on every test job (#643) by @​jdx in #643
• roll every check up into the final job (#645) by @​jdx in #645
• remove unneeded @​types/handlebars dependency (#647) by @​jdx in #647

---

5.0.1 - 2026-09-30

🐛 Bug Fixes

• verify cached mise before execution (#637) by @​jdx in #637

---

5.0.0 - 2026-09-28

🚀 Features

• breaking default minimum release age to 24 hours (#632) by @​jdx in 279d505

... (truncated)

Commits

• 7a4e45a chore: release v5.0.1 (#638)
• c4102d4 fix: verify cached mise before execution (#637)
• baf7eb4 chore(deps): update dependency aube to latest (#636)
• c75796c chore(deps): update dependency communique to latest (#635)
• ec2665b chore(deps): update github actions (#633)
• 342b4c0 chore(deps): update dependency aube to latest (#634)
• 9149ea8 chore: release v5.0.0 (#620)
• 279d505 feat!: default minimum release age to 24 hours (#632)
• aa79241 chore(entire): restore lower-cost trail findings
• 6ac0f83 chore(entire): commit claude session hooks
• Additional commits viewable in compare view

[qawatake]

@dependabot rebase

[qawatake]

アップデートレビュー: mise-action 4.3.0 → 5.0.1

最終判定: 保留（メジャー採用の合意待ち）
リスク評価: 低
レビュー種別: Comment
対象head: c8a2e0017774522744a0fbd3ef0db5d96b829cf3
技術的推奨: 実施。追加の手動preview確認は不要。

確認した変更点 (2.1)

公式v5.0.0、公式v5.0.1、累積変更のproduction code・action inputs・README/CHANGELOGを確認。
v5.0.0はmise本体のminimum_release_ageの既定値を24hに変更し、version未指定時のrelease選択を公式CDN indexへ移す（欠損/不正indexでは失敗）。
v5.0.1は既存/cache復元miseを実行前に署名付きrelease checksumまたは明示SHA256で検証し、不一致なら削除・再installする安全性修正。version変更時のself-updateを再installに変更し、version未指定時は既存binaryの有無に関わらずreleaseを選ぶ。古い署名情報のないreleaseではcacheを再利用できずdownloadする場合がある。

影響範囲と対応の妥当性 (2.2, 2.3)

変更	このrepoへの影響	判断根拠
24hの既定release age	選択するmise versionに影響なし	PRの全変更箇所で version: 2026.8.3 を明示。公式実装でも明示versionを優先しage選択を通らない
実行前checksum検証	CI cacheの検証が強化される	最新headのjob logで2026.8.3の既存binaryがsigned checksumsで検証成功したことを確認
Action更新	CI/toolchainセットアップのみ	workflow内のAction固定SHAの置換だけ。アプリAPI、toolchain指定、依存lock、業務挙動・deploy先の変更なし
install/cache lifecycle	Linux/macOSの既存手順と互換	対象repoの新headで既存CIを実行成功。Actionによる本体version選択と、miseがinstallするNode/pnpm等の固定指定は別物

検証 (2.4)

mainのレビュー済みセキュリティ修正を含むbase b3eb202e9e195c1821f5afae2b788be1a7ecc49f に追従済み。headを再取得し、作者・open・競合なしを確認。このheadの既存チェック e2e / build / test-e2e-tools は全件成功。
ログからcache復元binaryの検証成功と既存build/test等の完了を確認。Obsidian E2Eのあるrepoは実macOS/Electron上のE2Eも成功。Cloudflareアプリは既存テスト/build/dry-runを実行し、外部deployは実施していない。私有依存グラフを送信するローカルauditは行わず既存CI結果を使用。

切り戻し・供給元・ライセンス (2.5, 2.6, 2.7)

切り戻しはworkflowの固定SHAを4.3.0の c2a87611a18de5b3828c5652fe268e992400cb5c に戻す。供給元は従来のjdx/mise-action。新しい固定SHA 7a4e45a543138629540c9a1616d08632b893e492 は公式v5.0.1 tagのcommitとAPIで一致確認。2026-09-30公開で7日以上経過。公式commitのLICENSEはMITで変更なし。cache鍵やbinaryの残留は再installで回復でき、アプリのデータmigrationなし。

ブロック条件

技術的な未解決blockは見つかっていない。運用指示の「major更新は案を提示し、合意後に定型処理として記録する」に従い、このメジャー採用の合意待ちとしてマージを保留。

依頼事項

このrepoを含むmise-action 5.0.1の採用範囲への合意。秘密情報の提供や人間だけが行えるpreview操作は不要。

未確認・レビュアーへの申し送り (2.9)

release用workflowを実際にタグ作成/公開まで動かす試験は行っていない。今回の変更は同じ固定mise versionのセットアップとcache検証に限られ、通常CIで検証できたため不可逆な公開試験を要求しない。採用後、マージ直前にhead SHA・checksを再確認する。

[qawatake]

レビュー補足（供給元・ライセンス）: Action本体のMITは不変ですが、同梱ライセンス一覧も確認しました。間接minimatchは3.1.5（ISC）から10.2.6（BlueOak-1.0.0）へ変更され、v5の dist/licenses.txt に公式ライセンス全文が同梱されています。配布時の本文または公式リンクの通知条件を確認済みです。ActionをCIで利用する更新であり、アプリ配布物にこのライセンスを混入させる変更ではありません。

同一覧でAzure core-client 1.11.1 / typespec ts-http-runtime 0.3.9のLicense表示がnullになっていますが、公式npm metadataと各tarballのLICENSEはMITでした。両packageのcopyright/ライセンス本文が既存のMicrosoft MIT本文と完全一致し、v5の同梱一覧にもその本文が残っていることを照合したため、「無ライセンスになった」とは判定しません。上の技術的推奨・採用合意待ちという判定は維持します。

[qawatake]

Update review: jdx/mise-action 4.3.0 → 5.0.1

Final decision: Proceed
Risk: Medium — axis: change type (major; breaking changes do not apply to our usage)
Review type: Approve
Release/deploy: Not needed (no-release) — workflow-only change; toolchain resolved in CI is identical to main (same mise 2026.8.3, node/pnpm versions, exact cache-key hit)

Changes reviewed (2.1)

• Sources: release notes v5.0.0, v5.0.1; compare v4.3.0...v5.0.1 (action.yml, src/index.ts)
• Range: 4.3.0 → 5.0.0 → 5.0.1
• Breaking/behavior: minimum_release_age defaults to 24h (v5.0.0); cached mise binary is verified against signed checksums before execution, version switches reinstall instead of self-update (v5.0.1, security fix #637). runs.using unchanged (node24); cache key format unchanged.

Impact and adequacy (2.2, 2.3)

Change	Impact	Evidence	PR adequate
minimum_release_age default 24h	None	all uses pin version: 2026.8.3; log: "minimum_release_age is ignored because an explicit mise version was provided"	Yes
Binary verification before run	None	log: "Verified existing mise-v2026.8.3-* against signed checksums"; cache reused	Yes
Reinstall instead of self-update	None	version pinned, no switch	Yes

Verification (2.4)

• CI green; read job logs: exact cache hit on the same key as main, installed node/pnpm match main push runs, no warnings from mise-action.
• The release workflow (tagpr.yml, where present) does not run on PRs; it uses identical inputs and mise.toml, so the same result applies.

Rollback, supply chain, license (2.5, 2.6, 2.7)

• Rollback: revert the SHA; no irreversible side effects.
• Supply chain: pinned SHA 7a4e45a5 equals tag v5.0.1 and is on upstream main; published 2026-09-30 (10 days).
• License: MIT → MIT.

Blocking conditions

• None

Requests

• None

Unverified / notes (2.9)

• v5.1.1 (2026-10-04) stops exporting MISE_GITHUB_TOKEN to later steps (breaking). Out of scope here; check when that bump arrives.