mise.toml

# mise: tool + environment management for CodeMode.
#
# The committed mise.lock records per-platform download URLs + checksums, plus a
# `provenance` marker for the tools whose upstream releases carry verifiable
# GitHub attestations. `settings.locked` makes `mise install` FAIL CLOSED when a
# tool lacks a pre-resolved URL for the current platform.
#
# moon stays the task runner / CI gate; it is configured (.moon/toolchains.yml +
# moon.yml `toolchains.default: system`) to run these tools as `system` binaries
# that mise puts on PATH.

[tools]
# Language runtimes (core backend).
go = "1.26.6"
python = "3.14.3"

# Go dev-tool CLIs. The explicit `aqua:` ref forces the VERIFYING backend (checksum
# and, where upstream provides it, attestation provenance recorded in mise.lock); it
# must never fall back to a version-only backend (asdf/npm/cargo/pipx), which
# records no checksum.
"aqua:golangci/golangci-lint" = "2.12.2"
"aqua:vektra/mockery"         = "3.7.1"

# Docs (MkDocs) toolchain.
"aqua:astral-sh/uv" = "0.11.0"

# Task runner and GitHub CLI.
"aqua:moonrepo/moon" = "2.3.5"
"aqua:cli/cli"       = "2.97.0"

[env]
# Pin the Go toolchain: never auto-download a toolchain other than the one above.
# The version here is authoritative and matches go.mod's `go 1.26.6`.
GOTOOLCHAIN = "local"

[settings]
# Read/write mise.lock, and fail closed if a tool lacks a pre-resolved URL for the
# current platform — integrity enforcement for every tool.
lockfile = true
locked = true