[dependabot]

Bumps jdx/mise-action from 5.1.1 to 5.2.0.

Release notes

Sourced from jdx/mise-action's releases.

v5.2.0: Periodic cache rebuilds, signed packslip verification, and monorepo installs

The default cache key now rolls over every 30 days, so long-lived caches pick up newer mise releases. The action also checks the downloaded mise binary against the release's signed packslip, and it runs mise install --monorepo automatically in monorepos. Existing caches miss once after you upgrade, because the default cache key format has changed.

Added

• The cache is rebuilt every 30 days by default. GitHub never evicts a cache that keeps getting hits. Before this release, an active repo could keep the same mise binary and tools for months, until a config file changed. The default cache key now includes a period suffix (-p<N>), so the cache is rebuilt from scratch at least once per period. All repos roll over on the same calendar boundary. Use the new cache_max_age_days input to change the period, or set it to 0 to keep the old key that never expires. Custom cache_key templates can use the new {{cache_period}} variable, which {{default}} already includes. A custom key that doesn't use it behaves as before. On self-hosted runners that keep mise data between runs, you may also need auto_update: true to pick up a newer mise. (#689 by @​jdx, fixes #688)

  - uses: jdx/mise-action@v5
    with:
      cache_max_age_days: 14 # default 30; 0 disables periodic rebuilds

• Throttled cache restores and saves can be retried. Before this release, when GitHub's cache service returned HTTP 429, the action gave up right away: a restore counted as a miss and a save was skipped. The new cache_restore_retry_budget and cache_save_retry_budget inputs set how long the action may wait. Each retry waits for the Retry-After value plus some random jitter. Once the budget runs out, the action falls back to the old behavior. Retries apply to the main cache, the post-step save and the binary cache. Real cache misses and reservation conflicts are never retried. Both budgets default to 0s (no retries). @actions/cache doesn't report 429 errors directly, so the action detects throttling from its warning messages. If those messages change in a future @actions/cache release, throttling won't be detected and nothing will be retried. (#692 by @​jdx, fixes #691)

  - uses: jdx/mise-action@v5
    with:
      cache_restore_retry_budget: 60s
      cache_save_retry_budget: 120s

• The latest mise binary can fall back to a second download source. When the action downloads the latest mise version, it can fall back between GitHub and mise.jdx.dev if the first source fails. The fetch_from_github setting decides which source it tries first. Pinned versions and minimum_release_age installs are only downloaded from GitHub. The binary is still checked against the signed checksums for the resolved version, whichever source it came from. (#692 by @​jdx)
• The mise binary is checked against its signed packslip. If a mise release includes packslip.sigstore.json, the action checks the downloaded binary against it. The bundle must be signed by mise's release workflow for that exact tag. After a successful check, the log shows Verified <asset> against the signed packslip. If the check fails, the install stops instead of falling back to a weaker check. Releases without a packslip use the existing minisign and SHASUMS256 check. An explicit sha256 input still takes precedence. (#693 by @​jdx)
• Monorepo-aware installs. If your mise config sets [monorepo].config_roots, the action now adds --monorepo to mise install, so tools configured anywhere in the monorepo get installed. Repos without that setting aren't affected. To opt out, set monorepo: false. (#679 by @​zeitlinger)

Fixed

• Tool directories that mise moves to the front of PATH are now exported. The action used to find mise's PATH changes by comparing mise's PATH with the runner's. If a tool's bin directory was already on the runner's PATH, such as ~/.cargo/bin, mise only moved it to the front, so the action didn't export it. Later steps then found the mise shim first. For example, rustup resolved to the shim instead of ~/.cargo/bin/rustup. The action now asks mise for its entries with mise env --paths and exports them in the order mise reports. This fix needs a mise version that supports --paths. With older versions, the action uses the old comparison. (#685 by @​jdx)

Documentation

• The new "Release workflows" section of the README says that jobs that publish releases shouldn't restore caches. A lower-trust workflow that can write to default-branch caches could otherwise slip files into a release. In those jobs, use cache: false or GitHub's cache-mode: none. (#682 by @​jdx)
• The README explains how to cache mise's downloads, keyed on mise.lock, instead of installed tools. It includes a Windows example that sets MISE_CACHE_DIR from ${{ runner.temp }}, because actions/cache doesn't expand %TEMP%. (#686, #690 by @​zeitlinger)

Breaking Changes

• The default cache key has a new format, so the first run after upgrading is a cache miss and saves a fresh cache. After that, the cache is rebuilt every 30 days by default. To keep the old cache key that never expires, set cache_max_age_days: 0. Workflows that set a custom cache_key without {{default}} or {{cache_period}} aren't affected.

Full Changelog: jdx/mise-action@v5.1.2...v5.2.0

v5.1.2: mise_dir now sets MISE_DATA_DIR; auto_update handles a locked mise binary

The mise_dir input now also sets where mise installs tools, so those tools end up in the cache. With auto_update: true, the action no longer crashes on Windows when the mise binary is still in use.

Fixed

• mise_dir now exports MISE_DATA_DIR. Before this release, mise_dir moved the mise binary and the cache path, but mise kept installing tools to ~/.local/share/mise. The saved cache didn't include the tools. On runners where ~/.local isn't writable, the step failed with EACCES: permission denied. When mise_dir is set, the action now exports MISE_DATA_DIR=<mise_dir>, so tools are installed into the directory that gets cached. If your workflow sets a different MISE_DATA_DIR, the mise_dir input overrides it. If mise_dir isn't set, nothing changes. mise's state directory (~/.local/state/mise) stays where it is. If that path also can't be written, set MISE_STATE_DIR yourself. (#672 by @​jdx, fixes #668)

  - uses: jdx/mise-action@v5
    with:
      mise_dir: ${{ runner.tool_cache }}/mise/data

• auto_update no longer crashes when it can't replace mise.exe. On Windows, the step used to fail with a bare EPERM: operation not permitted, unlink '…\mise.exe' if another process was still using the binary. Now, if version isn't pinned and the existing binary passes verification against its recorded version, the action prints a warning and continues with that version. In any other case, the step fails with a message that says the file is in use and how to fix it. A pinned version never quietly keeps an older binary. (#665 by @​jdx, fixes #664)

... (truncated)

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

5.2.2 - 2026-10-21

🐛 Bug Fixes

• hash conf.d config fragments in cache key (#698) by @​rileymichael in #698

New Contributors

• @​rileymichael made their first contribution in #698

---

5.2.1 - 2026-10-19

🐛 Bug Fixes

• require the signed packslip for mise 2026.9.3 and later (#695) by @​jdx in #695

---

5.2.0 - 2026-10-16

🚀 Features

• (cache) rebuild the cache every 30 days by default (#689) by @​jdx in #689
• (cache) retry throttled cache restores and saves (#692) by @​jdx in #692
• verify the mise binary against its signed packslip (#693) by @​jdx in #693

🐛 Bug Fixes

• export the PATH entries mise reports with mise env --paths (#685) by @​jdx in #685

🔍 Other Changes

• Use monorepo install when configured (#679) by @​zeitlinger in #679
• Change minimum age for auto-merging release PRs by @​jdx in b511e8d

📚 Documentation

• tell release workflows not to use the cache (#682) by @​jdx in #682
• explain caching mise downloads instead of installs (#686) by @​zeitlinger in #686
• use resolved Windows downloads cache path (#690) by @​zeitlinger in #690

⚙️ Miscellaneous Tasks

• stop restoring caches in release jobs (#683) by @​jdx in #683
• replace prettier with oxfmt (#694) by @​jdx in #694

---

... (truncated)

Commits

• 9b200bc chore: release v5.2.0 (#680)
• b511e8d Change minimum age for auto-merging release PRs
• 887d1f4 docs: use resolved Windows downloads cache path (#690)
• 93c62ad chore: replace prettier with oxfmt (#694)
• 04716d4 feat: verify the mise binary against its signed packslip (#693)
• 5108104 feat(cache): retry throttled cache restores and saves (#692)
• d401260 docs: explain caching mise downloads instead of installs (#686)
• e7cf35f feat(cache): rebuild the cache every 30 days by default (#689)
• cd02696 fix: export the PATH entries mise reports with mise env --paths (#685)
• 6784481 docs: tell release workflows not to use the cache (#682)
• Additional commits viewable in compare view

[qawatake]

@dependabot rebase

[qawatake]

Update review: jdx/mise-action 5.1.1 → 5.2.0

Reviewed head: 5aa89bb5dd7b5164b6ae2742ac6171150deb955e (base 678a301fa6a8b17176ef966e16cdb55d174c7908, after @dependabot rebase onto main with the tagpr 1.21.3 bump)

Final verdict: Proceed
Risk: Medium — axes hit: change type (minor release with several default-behavior changes: cache key format, PATH export method, monorepo auto-detection, release verification; none applies to this repo's code beyond a one-time cache miss, see table), supply chain (v5.2.0 was published 2026-10-16, 8 days ago, below the 1–2 week guideline; the action bundles a new runtime dependency packslip from the same owner), test coverage (the PR's CI exercises the new action in ci.yml and release-label.yml; the tagpr.yml release job is only exercised at the next release). Other axes low: CI-only tooling, no external input, rollback is reverting three pins, license unchanged.
Review type: Approve
Release/deploy: Not needed (no-release) — reason: the PR only changes uses: pins in three workflow files. The shipped artifact is the committed main.js / manifest.json / styles.css, none of which is touched. The CI artifact-diff job on this head (running under mise-action 5.2.0 itself) built base and head and got identical hashes ("成果物は同一 (no-release)"); I read that job's log. The existing no-release label (re-applied by release-label-apply for this head) is kept.

Changes reviewed (2.1)

• Primary sources read: release notes for v5.1.2 (https://github.com/jdx/mise-action/releases/tag/v5.1.2) and v5.2.0 (https://github.com/jdx/mise-action/releases/tag/v5.2.0), CHANGELOG.md, the compare jdx/mise-action@v5.1.1...v5.2.0 (29 commits), and action.yml at the pinned commit.
• Version range covered: v5.1.1 → v5.1.2 → v5.2.0.
• Breaking / behavior changes: (a) default cache key now carries a 30-day period suffix (-p<N>), so the first run after upgrading misses the cache and the cache is rebuilt every 30 days (#689; new input cache_max_age_days, 0 restores the old behavior); (b) new input monorepo (default true) adds --monorepo to mise install when the mise config has [monorepo].config_roots (#679); (c) PATH is exported from mise env --paths in mise's order instead of a PATH diff (#685); (d) mise binaries are verified against a sigstore-signed packslip when the release has one, falling back to the existing minisign SHASUMS256 check when it does not (#693); (e) latest-version lookup falls back between GitHub and mise.jdx.dev (#692; not used with a pinned version); (f) v5.1.2: mise_dir now exports MISE_DATA_DIR, and a Windows auto_update crash fix. New inputs cache_restore_retry_budget / cache_save_retry_budget default to 0s (disabled). runs.using stays node24. No input removed or renamed, no new permissions.

Impact and adequacy of the PR (2.2, 2.3)

Change	Affected location / none	Evidence	PR handling adequate?
Cache key format (-p<N> suffix)	All three workflows use cache: true with the default cache_key	`git grep -E 'cache_key	cache_max_age_days' origin/main -- .github/workflows: no hits, so the default applies. CI log on this head: "mise cache not found for mise-v1-linux-x64-ubuntu24-2026.8.3-p691-…" followed by "Cache saved" (the expected one-time miss; 5.1.1 restored mise-v1-linux-x64-ubuntu24-2026.8.3-…` without the suffix)
mise version drift via cache rebuild	None	version: 2026.8.3 is set in all three mise-action steps; CI log: "minimum_release_age is ignored because an explicit mise version was provided", mise --version → 2026.8.3	Yes
monorepo auto-detection	None	grep monorepo mise.toml: no [monorepo] section; CI log shows mise install without --monorepo and installs node 24.22.1 / pnpm 10.34.7 as before	Yes
PATH export order	None observed	`git grep -E 'rustup	cargo' origin/main -- .github: no hits. Steps after mise-action only call pnpm/nodefrom mise; CI log "Done in … using pnpm v10.34.7" andcheck-toolchain.mjs` "ok (pnpm 10.34.7, node 24)" confirm the mise-managed binaries resolve
Packslip verification / fallback gap in v5.2.0 (fixed in v5.2.1)	None	mise 2026.8.3 (pinned) predates packslips, so the action uses the same minisign path as 5.1.1: CI log "Verified mise-v2026.8.3-linux-x64.tar.zst against signed checksums". Not a regression versus 5.1.1	Yes
GitHub → mise.jdx.dev fallback	None	Only used for latest-version lookup; version is pinned. Runner is GitHub-hosted with no egress allowlist	Yes
mise_dir / MISE_DATA_DIR	None	`git grep -E 'mise_dir	MISE_DATA_DIR' origin/main -- .github`: no hits
SHA pin and comment (three files)	ci.yml, release-label.yml, tagpr.yml	git ls-remote of refs/tags/v5.2.0 → 9b200bcecbfd6303e69a4a261b2e09e3757440a7 (lightweight tag); all three lines use that SHA with # v5.2.0; gh pr diff shows exactly 3 removed / 3 added lines. CI check-actions-pinned.mjs passed	Yes

Verification (2.4)

• CI on this head: ci / build passed under mise-action 5.2.0 (frozen install with pnpm 10.34.7, toolchain / actions-pinned / config-schema checks, pnpm audit "No known vulnerabilities found", biome lint, tsc --noEmit, esbuild build, bundled-deps check) and release-label / artifact-diff passed under 5.2.0 with identical artifact hashes. I read both logs; the only new lines are the cache miss / save with the new key.
• Not covered by CI: the release job in tagpr.yml runs only when a tag is cut. It uses the same mise-action inputs as ci.yml, so the behavior verified above carries over, but it has not been executed with 5.2.0 yet.
• Additional checks I did: compared the cache-key lines between the 5.1.1 and 5.2.0 CI logs; resolved the tag SHA upstream.

Rollback, supply chain, license (2.5, 2.6, 2.7)

• Rollback: revert the three pin lines. Caches under the new key are harmless. No persistent data involved.
• Supply chain: tag commit 9b200bce is a GPG-verified commit by the owner jdx (chore: release v5.2.0), contained in main; the release was created by github-actions[bot] via the same release workflow as v5.1.1. 27 of 29 commits are GPG verified (the two unsigned ones only touch CI policy files). dist/index.js grows by ~47k lines because of the new runtime dependency packslip@1.8.0 (exact pin) and its sigstore dependency tree; packslip is published by jdx's npm account with npm provenance, from the same owner as the action. The action is a JavaScript action (node24), so what runs is the committed dist/. Published 8 days ago, no maintainer change.
• License: MIT → MIT (LICENSE blob unchanged). New bundled transitive deps are MIT / ISC / Apache-2.0 / BSD-2-Clause / BlueOak-1.0.0, all permissive.

Blocking conditions

• Hit: none.

Requests

• None. Note for later: v5.2.1 closes the "no packslip → silently fall back" gap; it becomes relevant once version: is moved to a mise release that ships a packslip (2026.9.3+). The next dependabot bump will cover it.

Unverified / notes for other reviewers (2.9)

• The committed dist/index.js was not rebuilt from src/ to confirm it matches; trust rests on the verified tag commit and the owner's release workflow.
• The packslip verification path (#693) was not exercised, because the pinned mise 2026.8.3 has no packslip.
• The tagpr.yml release job has not run with 5.2.0 yet (first exercised at the next release).
• main moved again after this rebase (the @types/node 24.19.2 merge, package.json / lockfile only). It does not touch workflow files, so this head was reviewed as-is.