Repository navigation
ci: bump toolchains and upgrade mise-action to v5 - #7285
Merged
kanadgupta merged 8 commits intoOct 23, 2026
Merged
Conversation
kanadgupta
added
the
run-ci
kanadgupta
marked this pull request as ready for review
October 23, 2026 00:36
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🤖 AI Review
Both independent reviews completed with no findings. An additional code and diff review found no actionable issues in the toolchain upgrades, workflow changes, or direct Bun invocations, and no fundamental conflict with the supplied next-branch work. Toolchain manifests and lockfile pins passed static consistency checks; external actions were not executed.
Findings
No issues found.
Stats
Claude findings: 0 · Codex findings: 0 · Confirmed: 0 · Refuted: 0 · Uncertain: 0
Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run
This review runs once per PR. A maintainer can request another with a /ai-review comment.
avallete
approved these changes
Oct 23, 2026
kanadgupta
added this pull request to stack #7305
October 23, 2026 14:34
The plan and report jobs only need bun. setup-bun restores a 34 MB cache holding just the bun binary, while mise-action restored a 68 MB mise data directory and then ran a locked install and a listing on top, roughly twice the step time on a cache hit and more on a miss. Every other bun-only step in the repository already uses setup-bun. Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
Every step pins a mise version, so the new release-age default does not apply, and the pinned mise ships the signed packslip the action now requires. The action no longer exports MISE_GITHUB_TOKEN to later steps; the one later mise install, in the sync check, fetches release metadata through mise's relay and downloads assets directly, so it never used it. Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
mise-action's default key already hashes mise.toml and mise.lock and includes the requested tool subset, the runner image and the mise version. The lockfile pins the node, bun and pnpm versions the version files select, and a locked install refuses a version the lockfile does not carry, so the extra version-file hashes could not catch anything the lockfile hash misses. Generated with AI Co-Authored-By: Claude <noreply@anthropic.com>
kanadgupta
force-pushed
the
kanad-claude/mise-bun-actions-optimize-a0c03b
branch
from
October 23, 2026 14:34
3e0ab0b to
073596e
Compare
kanadgupta
enabled stacked auto-merge
October 23, 2026 14:34
TFSebben
pushed a commit
to TFSebben/supabase_cli
that referenced
this pull request
Oct 23, 2026
…ase#7287) Stacked on supabase#7285. ## Bump - `jactionlint` moves from 1.8.2 to 2.3.0 (`"2"` in mise.toml, pinned in `mise.lock`). - The config's deprecated `require-commit-hash` key becomes `rules: unpinned-uses: error`, the vendored `.repos/**` submodules are excluded, and the `missing-timeout` and `concurrency-limits` policy rules are turned off. ## Fixes, one commit per rule - **excessive-permissions**: single-job workflows grant their write scopes on the job instead of the workflow. contribution-gate grants both jobs the scopes its script needs. release-smoke-test's caller job keeps the four scopes release-shared's job tree declares. - **github-app**: the three release-notes App tokens request only the permissions their jobs use, confirmed against GitHub's REST permission tables. - **superfluous-actions**: both `softprops/action-gh-release` steps become `gh release create`, skipping when the release already exists and verifying the tag the earlier step pushed. - **pipeline-without-pipefail**, **github-env**, **artipacked**, **unused-job-output**: small mechanical fixes. ## Accepted findings, one commit per rule Each carries an inline `# jactionlint ignore=` comment with a plain-English reason: `dangerous-triggers`, `adhoc-packages`, `unverified-download`, `cache-poisoning` (run-scoped key), `unpinned-images` (smoke-test container), `bot-conditions` (the author check is already present), and `issues: write` on reopen-stale-issue. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Toolchain bumps
mise.lockandpnpm-lock.yamlare updated to match.pnpm execfrombuncommands. The toolchain setup already puts bun onPATH, so running it through pnpm only added a process hop and a pnpm lookup. Calling bun directly removes that overhead and complexity.Workflow changes
flaky-check installs bun with
oven-sh/setup-bunIts plan and report jobs only need bun. setup-bun restores a 34 MB cache with just the bun binary. mise-action restored a 68 MB mise data directory and then ran a locked install and a listing on top, which took about twice as long on a cache hit. Every other bun-only step in the repository already uses setup-bun, so this makes them consistent.
jdx/mise-actionmoves from v4.3.0 to v5.2.2What we gain:
What does not change for us: every step pins a mise version, so the new release-age default does not apply, and the pinned mise ships the signed manifest the action now requires.
One thing to expect: the default cache key format changed, so each mise cache misses once after this lands. The sync check job runs
mise installin a later step. It no longer gets the token, but it fetches release metadata through mise's own relay and downloads assets directly from GitHub releases, so it never used the token.The shared setup action drops its custom
cache_keyThe custom key hashed
mise.toml,mise.lock,.node-version,.bun-version, andpackage.json. mise-action's default key already coversmise.tomlandmise.lock, plus the requested tool subset, the runner image, and the mise version. The lockfile pins the node, bun, and pnpm versions the version files select, and a locked install refuses any version the lockfile does not have. So the extra hashes could not catch anything the lockfile hash misses, and the default key is strictly better.🤖 Generated with Claude Code