[dependabot]

Bumps jdx/mise-action from 5.0.1 to 5.1.1.

Release notes

Sourced from jdx/mise-action's releases.

v5.1.1: GitHub token is no longer exported to later steps by default

mise-action no longer exports its GitHub token as MISE_GITHUB_TOKEN to every later step in the job. A new persist_github_token input lets you turn that back on, or pass a different token to later steps. This changes the default behavior. If later steps need the token, see Breaking Changes below.

Fixed

• The GitHub token now stays inside the action by default. Before this release, the github_token input (which defaults to ${{ github.token }}) was written to GITHUB_ENV as MISE_GITHUB_TOKEN. That let any later step read the token and call the GitHub API with the job's permissions, even if the step never asked for a credential. Now the token is set only for the mise-action step and the processes it starts. The action masks the token in logs. (#658 by @​jdx, reported in #657)

Added

• persist_github_token input (default false). It takes one of three values:

  • false: the token stays inside the action.
  • true: the token the action used is exported to later steps. If env.MISE_GITHUB_TOKEN is already set, it takes precedence over github_token.
  • A token value: that token is exported to later steps instead, for example a read-only token. The action still installs tools with github_token, or with MISE_GITHUB_TOKEN if it's already set.

  Setting false doesn't clear a MISE_GITHUB_TOKEN that was already set at the job level or exported by an earlier step. (#658 by @​jdx)

Breaking Changes

Check your workflow if a later step needs MISE_GITHUB_TOKEN, such as mise shims, mise exec, mise run or lazy tool installs that call the GitHub API. Those steps no longer get the token automatically and may hit GitHub API rate limits. To get the old behavior back, opt in:

- uses: jdx/mise-action@v5
  with:
    persist_github_token: true

Or give later steps a separate token:

- uses: jdx/mise-action@v5
  with:
    persist_github_token: ${{ secrets.READ_ONLY_TOKEN }}

Full Changelog: jdx/mise-action@v5.1.0...v5.1.1

v5.1.0: Tool version outputs, plugins input, and cached mise reuse

mise-action now reports the tool versions it installed as step outputs, can install mise plugins before tools, and can save the cache at the end of the job. Several caching fixes stop the action from downloading mise again on every run.

Added

• Tool versions as step outputs. After install, the action runs mise ls --json --current and sets a versions output. This is a JSON object of the active, installed tools. Each tool maps to a list of {version, requested_version, install_path, source} entries. Each tool also gets its own output with its resolved version, such as steps.mise.outputs.node. A tool only gets its own output if its name is a valid output name and isn't cache-hit or versions. Names like npm:@scope/pkg appear only in versions. If the action can't read the versions, it prints a warning and the step still succeeds. (#655 by @​jdx)

  - uses: jdx/mise-action@v5
    id: mise
  - run: echo "node ${{ steps.mise.outputs.node }}"

• plugins input. List plugins one per line as name or name url. Blank lines and # comments are ignored. The action runs mise plugins install -y for each one before mise install. Plugins that are already installed, for example restored from the cache, are left as they are. An unknown plugin fails the step. When plugins is set, its hash is added to the default cache key. Custom cache_key templates can use it as {{plugins_hash}}. If plugins is unset, existing cache keys don't change. (#656 by @​jdx)

  - uses: jdx/mise-action@v5

... (truncated)

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

5.2.0 - 2026-10-16

🚀 Features

• (cache) rebuild the cache every 30 days by default (#689) by @​jdx in #689
• (cache) retry throttled cache restores and saves (#692) by @​jdx in #692
• verify the mise binary against its signed packslip (#693) by @​jdx in #693

🐛 Bug Fixes

• export the PATH entries mise reports with mise env --paths (#685) by @​jdx in #685

🔍 Other Changes

• Use monorepo install when configured (#679) by @​zeitlinger in #679
• Change minimum age for auto-merging release PRs by @​jdx in b511e8d

📚 Documentation

• tell release workflows not to use the cache (#682) by @​jdx in #682
• explain caching mise downloads instead of installs (#686) by @​zeitlinger in #686
• use resolved Windows downloads cache path (#690) by @​zeitlinger in #690

⚙️ Miscellaneous Tasks

• stop restoring caches in release jobs (#683) by @​jdx in #683
• replace prettier with oxfmt (#694) by @​jdx in #694

---

5.1.2 - 2026-10-12

🐛 Bug Fixes

• continue with the existing mise when auto-update cannot replace it (#665) by @​jdx in #665
• export mise_dir as MISE_DATA_DIR so mise installs tools there (#672) by @​jdx in #672

📚 Documentation

• explain MISE_ENABLE_TOOLS in GitHub Actions (#667) by @​zeitlinger in #667
• update the Rust cache section for mise 2026.9.2 (#670) by @​jdx in #670

⚙️ Miscellaneous Tasks

• (ci) update pr-closer to v1.3.0 by @​jdx in 076ebfb
• (ci) lint workflows with jactionlint (#673) by @​jdx in #673
• (ci) switch to jactionlint v2 and drop zizmor (#674) by @​jdx in #674
• update pr-closer policy by @​jdx in 88f13e0

... (truncated)

Commits

• 2d8d4ca chore: release v5.1.1 (#659)
• 3eb43e3 fix: make GitHub token persistence opt-in (#658)
• 94c60b3 chore: release v5.1.0 (#640)
• 4fff0c6 feat: add plugins input (#656)
• 893fc72 docs: add matrix and external cache guides; warn on shadowed mise_toml (#654)
• 41f5868 feat: add opt-in cache_save_post input (#649)
• 2fe229b fix: cache mise binary for caches saved without a version record (#648)
• abd75d9 fix: extract mise zip with PowerShell instead of unzip on Windows (#650)
• 4b9c295 docs: explain the Rust cache caveat and workarounds (#651)
• 7927c6f feat: output active tool versions (#655)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[qawatake]

Update review: jdx/mise-action v5.0.1 → v5.1.1

Final decision: Proceed
Risk assessment: Medium — axes hit: change type (minor; v5.1.1 documents a breaking change in default behavior, which does not apply to this repo). All other axes Low.
Review type: Approve
Release/deploy: Not required (no-release) — rationale: the PR only changes .github/workflows/ci.yml. The shipped artifact of this plugin is main.js + manifest.json, built locally by pnpm build and attached to GitHub releases; no workflow in this repo builds or publishes it. A CI action is not on the bundled / emitted / generated path, so the artifact bytes cannot change.

Changes reviewed (2.1)

• Primary sources consulted: release notes of v5.1.0 and v5.1.1; compare v5.0.1...v5.1.1 (16 commits, file list incl. action.yml, src/, dist/index.js).
• Version range reviewed: v5.0.1 → v5.1.0 → v5.1.1 (all intermediate releases).
• Breaking / behavior changes:
  • v5.1.1 (documented as breaking): github_token is no longer exported to later steps as MISE_GITHUB_TOKEN; new persist_github_token input (default false).
  • v5.1.0: cached mise is kept when version is unset (auto_update input, default false); cache is saved after a partial-match restore; new versions / per-tool step outputs; new plugins and cache_save_post inputs; action.yml now declares a post: step (only saves cache when cache_save_post: true); warning when mise_toml input is shadowed by .mise.toml.

Impact and adequacy of the PR (2.2, 2.3)

Change	Affected location / no impact	Evidence	Is the PR adequate
MISE_GITHUB_TOKEN no longer persisted	No impact	Searched scripts/, .github/, package.json, mise.toml, tests/ for MISE_, GITHUB_TOKEN, GH_TOKEN, mise exec/run/x: the only later steps needing a token (scripts/setup-obsidian.sh → gh) get GH_TOKEN explicitly in ci.yml. All tools are installed by install: true, so no lazy install needs the token. CI logs on this head show persist_github_token: false, no Setting MISE_GITHUB_TOKEN, and every later step passing.	Yes (no change needed; this is a hardening for this repo)
Cache behavior when version unset / auto_update	No impact	ci.yml pins version: 2026.8.3; release notes state an explicit version behaves as before. Log: Verified existing mise-v2026.8.3 ... against signed checksums, cache key unchanged (mise-v1-...-2026.8.3-3981b3d...).	Yes
Partial-match cache save fix	No impact (exact cache hit in all 3 jobs)	Job logs: Cache hit for: mise-v1-...	Yes
New post: step, cache_save_post	No functional impact	Input defaults to false (log shows cache_save_post: false); post step completed without errors.	Yes
New outputs / plugins input / mise_toml warning	Not used	ci.yml uses only version, install, cache.	Yes

Verification (2.4)

• CI results, and what CI does not cover: run 38944573389 on head 632836c — build, e2e, test-e2e-tools all success. Every job uses the changed action, so the change is exercised directly by CI. Not covered: a cold-cache run (all three jobs restored the cache); the install path itself is unchanged for an explicit version.
• Additional checks I did: read the job log bodies (not just the status) for build and e2e: mise 2026.8.3 verified against signed checksums, node 24.19.0 / pnpm 10.33.2 resolved as before, check-toolchain / check-actions-pinned / check-config-schema all ok, e2e 1 passed.

Rollback, supply chain, license (2.5, 2.6, 2.7)

• Rollback: revert the SHA pin in ci.yml. No irreversible side effects (cache keys unchanged).
• Supply chain: tag v5.1.1 → commit 2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca (lightweight tag, matches the pin in this PR); the commit is an ancestor of main (compare: behind 30, ahead 0). Release published 2026-10-04 by github-actions[bot] and marked immutable, same as v5.0.1. All commits in range authored by the maintainer (jdx) via PRs. Upstream checks on the release commit include Check dist/ (dist rebuilt from source and diffed) and zizmor, all success. Published 13 days ago; issues opened in jdx/mise-action since 2026-10-04 (#657, #664, #668, #669, #688, #691) contain no compromise report and none concern the inputs used here (version, install, cache).
• License: MIT → MIT (unchanged).

Blocking conditions

• Hit: none.

Requests

• None.

Unverified items / notes for other reviewers (2.9)

• Cold-cache behavior with v5.1.x was not exercised (all jobs hit the cache). Known constraint, not a blocker: the download / checksum path for an explicit version is documented as unchanged, and a failure would surface as a red CI run, not a silent change.
• I did not read dist/index.js line by line; I relied on upstream's Check dist/ job for dist ↔ source consistency.