build(tooling): replace proto with mise and run moon on system binaries

.github/workflows/ci.yml

@@ -21,19 +21,24 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    env:
+      # Never auto-download a Go toolchain other than the mise-pinned one
+      # (mise [env] is not carried by the action's shims, so set it on the job).
+      GOTOOLCHAIN: local
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Moon Toolchain
-        uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0.6.4
+      - name: Setup mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
         with:
-          auto-install: true
-          auto-setup: true
-          cache-base: ${{ github.event.repository.default_branch }}
+          version: 2026.6.14
+          cache: true
+          # Installs every tool from mise.toml honoring mise.lock (locked → fail
+          # closed), including moon, and prepends the shim dir to PATH.
 
       - name: Cache Go modules
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
@@ -47,18 +52,18 @@ jobs:
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.cache/go-build
-          key: ${{ runner.os }}-go-build-${{ hashFiles('.go-version', 'go.sum') }}-${{ github.run_id }}
+          key: ${{ runner.os }}-go-build-${{ hashFiles('mise.lock', 'go.sum') }}-${{ github.run_id }}
           restore-keys: |
-            ${{ runner.os }}-go-build-${{ hashFiles('.go-version', 'go.sum') }}-
+            ${{ runner.os }}-go-build-${{ hashFiles('mise.lock', 'go.sum') }}-
             ${{ runner.os }}-go-build-
 
       - name: Cache golangci-lint
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.cache/golangci-lint
-          key: ${{ runner.os }}-golangci-lint-${{ hashFiles('.go-version', '.golangci.yml', '.prototools', '.moon/proto/golangci-lint.toml', 'go.sum') }}-${{ github.run_id }}
+          key: ${{ runner.os }}-golangci-lint-${{ hashFiles('mise.lock', '.golangci.yml', 'go.sum') }}-${{ github.run_id }}
           restore-keys: |
-            ${{ runner.os }}-golangci-lint-${{ hashFiles('.go-version', '.golangci.yml', '.prototools', '.moon/proto/golangci-lint.toml', 'go.sum') }}-
+            ${{ runner.os }}-golangci-lint-${{ hashFiles('mise.lock', '.golangci.yml', 'go.sum') }}-
             ${{ runner.os }}-golangci-lint-
 
       - name: Run static checks

.github/workflows/release-dry-run.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: .go-version
+          go-version-file: go.mod
           cache: true
 
       - name: Install Syft
@@ -258,12 +258,11 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      - name: Set up Moon toolchain
-        uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0.6.4
+      - name: Setup mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
         with:
-          auto-install: true
-          auto-setup: true
-          cache-base: ${{ github.event.repository.default_branch }}
+          version: 2026.6.14
+          cache: true
 
       - name: Package chart without publishing
         env:

.github/workflows/release.yml

@@ -98,7 +98,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: .go-version
+          go-version-file: go.mod
           cache: true
 
       - name: Install Syft
@@ -428,12 +428,11 @@ jobs:
           RELEASE_TAG: ${{ needs.resolve-release.outputs.tag }}
         run: git checkout --detach "$RELEASE_TAG"
 
-      - name: Set up Moon toolchain
-        uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0.6.4
+      - name: Setup mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
         with:
-          auto-install: true
-          auto-setup: true
-          cache-base: ${{ github.event.repository.default_branch }}
+          version: 2026.6.14
+          cache: true
 
       - name: Package Helm chart
         id: package-chart