chore(deps): update dependency aube to v1.9.1 (#478)

This PR contains the following updates:

| Package | Update | Change | Pending |
|---|---|---|---|
| [aube](https://redirect.github.com/endevco/aube) | minor | `v1.6.2` →
`v1.9.1` | `v1.14.1` (+10) |

---

### Release Notes

<details>
<summary>endevco/aube (aube)</summary>

###
[`v1.9.1`](https://redirect.github.com/endevco/aube/releases/tag/v1.9.1):
: Cold install overhaul, HTTP prefetch, and workspace fixes

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.9.0...v1.9.1)

A performance- and correctness-focused patch release. Cold installs get
a streaming tarball pipeline, Linux gets an `O_TMPFILE`+`linkat` CAS
fast path, and the resolver's cold path overlaps DNS, TLS, and packument
prefetch with the manifest/workspace/lockfile work that used to
serialize them. On the fix side, `aube run` once again finds `node-gyp`
for package scripts, and `aube update` / `aube outdated` stop trying to
fetch unpublished `workspace:` deps from the registry.

#### Added

- **Pre-resolver packument prefetch + shared HTTP utilities**
([#&#8203;529](https://redirect.github.com/endevco/aube/pull/529) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) — a new
`aube-util::http` module consolidates client-side primitives (`prewarm`,
`priority`, `race`, `resolve`, `ticket_cache`) so leaf crates share one
warm-pool surface with consistent killswitch semantics. On install
entry, aube now reads `package.json` and fires fire-and-forget packument
GETs for every registry-shaped direct dep before workspace yaml load,
settings resolve, lockfile parse, and resolver construction — by the
time the resolver pops its first task, the packument cache and reqwest
pool are warm. `RegistryClient::prewarm_connection` now covers the
default registry **plus** every scoped (`@org:registry=...`) and per-uri
auth registry, with parallel DNS preresolve so DNS RTT hides behind the
TLS handshake. Abbreviated packument GETs also send `Priority: u=0` (RFC
9218 Critical) so H2 schedulers prioritize resolver-blocking metadata
over pending tarball frames. New killswitches:
`AUBE_DISABLE_DNS_PRERESOLVE`, `AUBE_DISABLE_REQUEST_RACING`,
`AUBE_DISABLE_PREFETCH`, `AUBE_DISABLE_TLS_TICKET_CACHE`. Prefetch is a
no-op when offline or when any lockfile is present.

- **Cold install pipeline overhaul**
([#&#8203;522](https://redirect.github.com/endevco/aube/pull/522) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) —
several overlapping wins on the cold-cache path:

- **Streaming tarball pipeline** (opt-in via `AUBE_TARBALL_STREAM=1`,
killswitch `AUBE_DISABLE_TARBALL_STREAM`) — HTTP body chunks pipe
through SHA-512 + gz + tar + CAS via an mpsc bridge instead of buffering
the whole tarball; non-SHA-512 SRI falls back to buffered. Bounded by
the registry's `tarball_max_bytes` cap.
- **Linux `O_TMPFILE` + `linkat` CAS publish** with `EOPNOTSUPP`
fallback to the tempfile path, `posix_fallocate` to avoid ext4
fragmentation, and `posix_fadvise(DONTNEED)` to free page cache after
publish. Killswitch: `AUBE_DISABLE_O_TMPFILE`.
- **Materialize-stream into the lockfile fast path** — both lockfile and
no-lockfile branches now share the GVS prewarm materializer, hiding
30-200ms of GVS reflinks behind the in-flight download tail.
- **Resolver tuning** — foldhash on `graph_hash` hot maps, pre-sized
resolver caches, thread-local `node_semver::Version` parse cache,
`PARALLEL_IMPORT_THRESHOLD` lowered from 256 to 16 (median npm tarball
is 7 files), and pinned tokio `worker_threads` (`cpu.min(8)`) /
`max_blocking_threads(64)` (tunable via `AUBE_TOKIO_WORKERS` /
`AUBE_TOKIO_BLOCKING`).
- **Windows** gets `FILE_ATTRIBUTE_NOT_CONTENT_INDEXED` on the store
root; cross-volume detection (drive letters on Windows, `dev` id on
Unix) is gated per-platform.

Reported same-volume Windows cold-install ratios: 1.80x-8.75x faster
than Bun across svelte/vite/next/babylon.

- **Per-project materialize pipelined into fetch**
([#&#8203;527](https://redirect.github.com/endevco/aube/pull/527) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) — when
GVS is off, each fetched `(canonical_key, PackageIndex)` triggers
`materialize_into` against `.aube/<dep_path>/` immediately, so by the
time fetch finishes the dedicated link phase only has to create
top-level `node_modules/<name>` symlinks. The driver now uses `JoinSet`
instead of `Vec<JoinHandle>`, so on early-return all in-flight tasks
abort instead of detaching and racing install cleanup. \~10% improvement
on warm fresh installs in the local benchmark matrix.

#### Fixed

- **`aube run` / `aube test` find `node-gyp`**
([#&#8203;518](https://redirect.github.com/endevco/aube/pull/518) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — package scripts only
had `node_modules/.bin` prepended to `PATH`, so `aube test` would fail
with `node-gyp: not found` on hosts that didn't already ship it. Script
execution now reuses aube's existing node-gyp bootstrap (via a lazy shim
bin dir + `AUBE_NODE_GYP_EXE` / `AUBE_NODE_GYP_PROJECT_DIR`), matching
pnpm/npm behavior. Ports pnpm's `lifecycleScripts.ts:128` coverage into
the offline node-gyp bootstrap bats suite.

- **`workspace:` deps in `aube update` / `aube outdated`**
([#&#8203;523](https://redirect.github.com/endevco/aube/pull/523) by
[@&#8203;jdx](https://redirect.github.com/jdx), fixes
[#&#8203;520](https://redirect.github.com/endevco/aube/discussions/520))
— `aube update` now discovers workspace package `name`/`version` pairs
and passes them into resolver workspace resolution so `workspace:` deps
from `package.json#workspaces` resolve locally instead of triggering
registry packument fetches. `aube outdated` filters out direct deps with
`workspace:` specifiers and reports "no matching dependencies" rather
than attempting a packument fetch. Adds a new
`WARN_AUBE_WORKSPACE_PACKAGE_MISSING_NAME` warning code for workspace
packages without a `name` field.

- **Resolver peer-context divergence is fatal**
([#&#8203;522](https://redirect.github.com/endevco/aube/pull/522) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) —
`apply_peer_contexts` hitting `MAX_ITERATIONS` used to log a warning and
ship a broken graph; it now returns a fatal
`Error::PeerContextDivergence(usize)`. `state::remove_state` errors at
`--force` and GVS-transition sites also propagate instead of being
silently swallowed, so permission-denied or Windows-locked sidecars no
longer defeat the freshness check.

- **Tarball hardening**
([#&#8203;522](https://redirect.github.com/endevco/aube/pull/522) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) —
entries declared as 0 bytes with non-zero stream payload are now
rejected (synthetic-entry injection guard), and GNU `LongName` /
`LongLink` metadata records are correctly accepted.

- **Patches loaded once per cwd**
([#&#8203;529](https://redirect.github.com/endevco/aube/pull/529) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) —
`load_patches_for_linker` walked `patches/` from disk 2-3 times per
install (lockfile-prewarm, no-lockfile-prewarm, and link-phase sites).
Now cached per cwd via `OnceLock<Mutex<HashMap<PathBuf, ...>>>`.

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.9.0...v1.9.1>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

###
[`v1.9.0`](https://redirect.github.com/endevco/aube/releases/tag/v1.9.0):
: Comment-preserving workspace edits, deploy bundling, and node
--inspect

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.8.0...v1.9.0)

A focused release: `aube deploy` learns to bundle workspace siblings and
local-path deps into the deploy artifact, workspace-yaml writers stop
eating user comments, aube-owned settings move out of `.npmrc`, and
`aube run` forwards Node debugger flags.

#### Added

- **Aube settings move out of `.npmrc`**
([#&#8203;517](https://redirect.github.com/endevco/aube/pull/517) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — known aube-owned
settings now live in `~/.config/aube/config.toml` (XDG-aware), while
registry, auth, and unknown keys keep using `.npmrc`. `aube config
get/set/list/delete` reads and writes the right file automatically, and
migrating a known setting cleans up the stale `.npmrc` entry. `.npmrc`
writes are also atomic against the **symlink target** now, so dotfile
setups that symlink `~/.npmrc` into a managed config repo stop having
the symlink replaced by a regular file.

- **`aube run --inspect` / `--inspect-brk`**
([#&#8203;515](https://redirect.github.com/endevco/aube/pull/515) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — both flags accept an
optional `[host:]port` (e.g. `--inspect=9229`,
`--inspect-brk=0.0.0.0:9230`) and are forwarded as explicit Node argv
when aube can identify a Node-backed target — direct `node ...` scripts
in `package.json` and local `node_modules/.bin` fallbacks resolved
through shims/symlinks. The flags are passed as argv rather than via
`NODE_OPTIONS`, so the debugger doesn't attach to nested Node processes
spawned by the script.

- **`aube deploy --no-prod`**
([#&#8203;507](https://redirect.github.com/endevco/aube/pull/507) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — opt out of the default
`--prod` filter for deploys that need devDependencies at runtime
(test-harness staging, build-step artifacts). Mutually exclusive with
`--prod` / `--dev`; combine with `--no-optional` to keep prod + dev but
drop optionals.

- **Comment-preserving workspace yaml writes**
([#&#8203;511](https://redirect.github.com/endevco/aube/pull/511) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — every workspace-yaml
writer (`approve-builds`, `patch-commit`, `patch-remove`, the daily
`cleanupUnusedCatalogs` install pass, and `aube config set --location
workspace`) now routes through `yamlpatch` instead of round-tripping the
file through a serializer. Keys, comments, and whitespace the edit
didn't touch land back on disk byte-identical, so user annotations on
adjacent entries survive. Empty/missing files still go through the
regular serializer since there are no comments to preserve.

#### Fixed

- **`aube deploy` bundles local dependencies**
([#&#8203;507](https://redirect.github.com/endevco/aube/pull/507) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — fixes two real bugs
reported in
[#&#8203;345](https://redirect.github.com/endevco/aube/discussions/345):

- **`workspace:*` siblings tried to fetch from the registry.** Deploy
used to rewrite `workspace:*` to a concrete version and ask install to
resolve it — fine for published siblings, broken for the (very common)
unpublished case. Reachable workspace siblings are now copied into
`<target>/.aube-deploy-injected/<id>/` and the manifest spec becomes a
relative `file:` pointer. Recursion handles sibling chains where a
sibling's own deps are workspace siblings.
- **`file:` deps resolved relative to the deploy output dir.** A
`file:../local-vendor` spec used to ride along unchanged in the deployed
manifest, pointing at `<target>/../local-vendor` instead of the source
workspace's `local-vendor`. Local-path deps now go through the same
staging pipeline.

When bundling occurs the lockfile-subset path is skipped, since the
rewritten `file:` pointers don't appear in the source lockfile and would
otherwise trip a frozen install.

- **`aube remove` preserves dependency order**
([#&#8203;511](https://redirect.github.com/endevco/aube/pull/511) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — dropping one dep used
to alphabetize the remaining entries in the affected `package.json`
section as a side effect. Surviving entries now stay in their original
on-disk order, matching pnpm/npm. (`aube add` is unaffected — sorted
inserts there are intentional.)

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.8.0...v1.9.0>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

###
[`v1.8.0`](https://redirect.github.com/endevco/aube/releases/tag/v1.8.0):
: Stable error codes, smarter run/dlx, and a new install progress UI

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.7.0...v1.8.0)

A polish-and-plumbing release: install progress gets a from-scratch
redesign, errors and warnings now carry stable identifiers (with bespoke
exit codes and dep-chain context), `aube run` / `aube dlx` prefer
locally-installed binaries, and a handful of workspace-from-subpackage
and `aube add` ergonomics get fixed.

#### Added

- **Redesigned install progress UI**
([#&#8203;501](https://redirect.github.com/endevco/aube/pull/501) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — fixed 15-char bar on
the left, stats on the right, phase-aware label (`resolving` /
`fetching` / `linking`), ETA, transfer rate, and an estimated install
size derived from the resolve stream:

  ```
  aube 1.8.0 by en.dev
  █████░░░░░░░░░░ 23/142 pkgs · 4.2 MB / ~13.8 MB · 1.4 MB/s · ETA 5s
  ███████████████ 1230/1230 pkgs · linking
  ✓ resolved 1230 · reused 98 · downloaded 1132 (54.6 MB) in 6.8s
  ```

Installs that finish before the first 2s heartbeat now print a single
self-identifying summary line (`✓ installed 5 packages in 423ms`)
instead of a partial bar. Also fixes two real bookkeeping bugs (a `2/1
packages` overflow on platform-mismatched non-optional deps, and the
"stuck at 90%" undercount caused by `filter_graph` dropping packages
after the denominator was inflated).

- **Local bins for `aube run` and `aube dlx`**
([#&#8203;502](https://redirect.github.com/endevco/aube/pull/502) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — `aube run <name>`
falls back to `node_modules/.bin/<name>` when no `package.json` script
matches, and `aube dlx` / `aubx` will execute an already-installed local
binary instead of doing a throwaway install. Pass `-p` / `--package` (or
a versioned spec) to force the install path.

- **Stable error and warning codes**
([#&#8203;492](https://redirect.github.com/endevco/aube/pull/492) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — every error and
warning aube emits now carries an `ERR_AUBE_*` or `WARN_AUBE_*`
identifier in a structured field, so CI scripts and ndjson consumers can
branch on the code instead of substring-matching English messages. A
curated subset maps to bespoke Unix exit codes (10–99 in 10-wide ranges
by category) so shells can react to specific failures without parsing
stderr — e.g. `aube install --frozen-lockfile` in an empty dir exits
with `10` (`ERR_AUBE_NO_LOCKFILE`). Post-resolver errors that mention a
specific package now also include the dependency chain back to the
importer (`chain: a@1 > b@2 > leaf@3`) so a tarball-integrity or fetch
failure tells you *why* your install pulled that transitive dep. The
full code list lives at `docs/error-codes.md`.

#### Fixed

- **`aube why` / `list` / `query` from a workspace subpackage**
([#&#8203;504](https://redirect.github.com/endevco/aube/pull/504) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — these commands
resolved cwd via the nearest `package.json`, so running them inside
`packages/foo/` errored with `No lockfile found. Run aube install
first.` even though the workspace lockfile sat one level up. They now
walk up to the workspace root when one is present.

- **Workspace lifecycle scripts and pnpm-lock npm aliases**
([#&#8203;500](https://redirect.github.com/endevco/aube/pull/500) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — recursive workspace
installs now run `preinstall`/`install`/`postinstall`/`prepare` for each
linked workspace importer in dependency order (not just the root), and
the build-script policy merges `pnpm.allowBuilds` /
`onlyBuiltDependencies` / `neverBuiltDependencies` across all
participating manifests so a member can approve its own dep's builds.
`pnpm-lock.yaml` now writes npm aliases in pnpm's native
`<real>@&#8203;<version>` encoding instead of leaking aube's internal
`aliasOf` field.

- **`aube add` auto-detects local paths**
([#&#8203;499](https://redirect.github.com/endevco/aube/pull/499) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — `aube add
/path/to/lib`, `./lib`, `~/lib`, `file:./lib`, and `link:./lib` no
longer fall through to the registry path with a confusing `HTTP 405
Method Not Allowed`. Bare paths default to `link:` for directories and
`file:` for tarballs (pnpm parity); explicit prefixes are preserved.
Tarball-suffix paths emit a clear "not yet supported in `aube add`" hint
instead of a 405.

#### Changed

- **Per-command `--help` is bucketed**
([#&#8203;505](https://redirect.github.com/endevco/aube/pull/505) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — `--frozen-lockfile` /
`--prefer-frozen-lockfile`, `--registry` + `--fetch-*`, and
`--disable/--enable-global-virtual-store` moved off the global flag set
into per-command groups under `Lockfile` / `Network` / `Virtual store`
headings, and now appear only on commands that consume them. Seven
pnpm-compat no-op flags (`--workspace-packages`, `--ignore-workspace`,
`--include-workspace-root`, `--aggregate-output`, `--stream`,
`--use-stderr`, `--yes`) are still parsed but hidden from `--help`.
Pre-subcommand placement still works (`aube --frozen-lockfile install`,
`aube --registry=URL install`) via an argv pre-pass.

One caveat: implicit-script invocations like `aube --frozen-lockfile
dev` (where `dev` is a `package.json` script) no longer apply the flag —
write `aube run --frozen-lockfile dev` instead.

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.7.0...v1.8.0>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

###
[`v1.7.0`](https://redirect.github.com/endevco/aube/releases/tag/v1.7.0):
: Local & git specs in aube add, faster cold installs

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.6.2...v1.7.0)

A feature-heavy release: `aube add` learns git and local-path specs,
workspace commands gain support for yaml-only "coordinator" monorepos,
`aube update` and `aube rebuild` get pnpm-parity polish, and a deep
performance pass speeds up cold installs by up to \~1.9×.

#### Highlights

- **`aube add` is now a one-stop shop** for git, GitHub-shorthand, and
`link:` / `file:` local-path dependencies — not just registry packages.
- **Performance pass on the install hot path**
([#&#8203;469](https://redirect.github.com/endevco/aube/pull/469)) lands
streaming SHA-512, parallel CAS imports, TLS prewarm, fetch reordering,
and a long tail of cold-path cleanups, with measured cold-install
speedups up to \~1.9× vs v1.6.2.
- **Workspace and pnpm parity polish** across `update`, `rebuild`,
yaml-only roots, unversioned members, and nested `link:` / `file:`
resolution.

#### Added

- **`aube add file:./pkg` / `link:../sibling`**
([#&#8203;487](https://redirect.github.com/endevco/aube/pull/487) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — local-path specs are
routed through a non-registry branch, with the manifest key derived from
the path basename (with `.tgz` / `.tar.gz` stripped) or from an explicit
alias. `aube add my-bundle@file:./bundle.tgz` works too.

- **`aube add` supports git specs**
([#&#8203;483](https://redirect.github.com/endevco/aube/pull/483) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — bare GitHub shorthand,
`github:` / `gitlab:` / `bitbucket:` prefixes, full `git+ssh` /
`git+https` URLs, and aliases. The verbatim spec is written to
`package.json` and the resolver handles the rest:

  ```bash
  aube add kevva/is-negative
  aube add github:kevva/is-positive
  aube add my-alias@git+https://github.com/kevva/is-negative.git
  ```

- **Yaml-only workspace roots**
([#&#8203;486](https://redirect.github.com/endevco/aube/pull/486) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — `install`, `list`,
`run -r`, `query`, and `why` now work in pure-coordinator monorepos that
have `pnpm-workspace.yaml` / `aube-workspace.yaml` at the root but no
root `package.json` (Turborepo-style layouts). Single-project commands
like `add` / `remove` still hard-error without a manifest.

- **`aube update <pkg>` rewrites manifest ranges by default**
([#&#8203;479](https://redirect.github.com/endevco/aube/pull/479) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — caret/tilde ranges
(`^1.2.0`, `~1.2.0`) are rewritten to track the resolved in-range max,
matching pnpm. Other shapes (`>=`, exact pins, dist-tags, git,
`workspace:`) stay frozen. Set `update-rewrites-specifier=false` to keep
the previous behavior.

- **`aube rebuild <pkg>...`**
([#&#8203;477](https://redirect.github.com/endevco/aube/pull/477) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — runs lifecycle scripts
only for the named deps, bypasses the `allowBuilds` /
`onlyBuiltDependencies` policy, and skips root hooks. Composes with
`--filter`. Bare `aube rebuild` continues to do a full policy-respecting
rebuild.

- **Persistent unreviewed-builds warning**
([#&#8203;476](https://redirect.github.com/endevco/aube/pull/476) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — repeat warm-path
installs no longer swallow the "ignored build scripts for N package(s)"
nudge; the spec keys are persisted in `.aube-state` and re-emitted on
every install.

- **`aube update --depth` no longer silently ignored**
([#&#8203;473](https://redirect.github.com/endevco/aube/pull/473) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — emits a one-line
warning pointing at `rm aube-lock.yaml && aube install` for the only
useful semantic case.

#### Fixed

- **Faster cold installs**
([#&#8203;469](https://redirect.github.com/endevco/aube/pull/469) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) — a wide
hot-path pass with measurable wins on real registries:

  | Project           |    v1.6.2 |  v1.7.0 | Speedup |
  | ----------------- | --------: | ------: | ------: |
  | svelte (56 pkg)   |   1393 ms | 1386 ms |   1.01× |
  | vue (117 pkg)     |   1590 ms | 1360 ms |   1.17× |
  | next.js (336 pkg) |  14071 ms | 9160 ms |   1.54× |
  | babylon (21 pkg)  | \~6000 ms | 3186 ms |  \~1.9× |

Highlights: streaming SHA-512 over the wire (no second buffered hash
pass), two-phase parallel CAS tar import, speculative TLS/HTTP/2 prewarm
behind manifest parse, native-build packages floated to the front of the
fetch queue, `Accept-Encoding: gzip, br, zstd` on packuments, in-process
DNS cache via `hickory-dns`, mmap+rayon BLAKE3 over 4 MiB, network
concurrency default raised 64 → 128, and zero-copy packument parsing.
Every change ships with an `AUBE_DISABLE_*` killswitch
(`AUBE_DISABLE_STREAMING_SHA512`, `AUBE_DISABLE_SPECULATIVE_TLS`,
`AUBE_DISABLE_CRITICAL_PATH`, `AUBE_DISABLE_PARALLEL_IMPORT`,
`AUBE_DISABLE_MMAP_BLAKE3`, `AUBE_DISABLE_SNAPSHOTS`) plus an
`AUBE_CONCURRENCY=N` clamp.
- **Nested `link:` / `file:` resolution**
([#&#8203;470](https://redirect.github.com/endevco/aube/pull/470) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — fixes the `transitive
local specifier link:./libs/foo cannot be resolved without the parent
package source root` install error in two cases: a `file:` / `link:`
parent declaring a transitive `link:`, and a root `pnpm.overrides`
rewriting a registry dep to a local path. Override paths now anchor at
the project root like pnpm does.
- **Workspace members without `version`**
([#&#8203;480](https://redirect.github.com/endevco/aube/pull/480) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — fall back to `0.0.0`
instead of hard-erroring. `workspace:*` / `^` / `~` siblings still link
locally; specific ranges like `workspace:^2.0.0` still correctly fail to
satisfy. Unblocks repos like
[tuist/tuist#10584](https://redirect.github.com/tuist/tuist/pull/10584).
- **Bare `user/repo` parsed as GitHub shorthand**
([#&#8203;472](https://redirect.github.com/endevco/aube/pull/472) by
[@&#8203;jdx](https://redirect.github.com/jdx)) in lockfile/spec
parsing, with `update --latest` now skipping git-spec deps so they can't
be silently rewritten into registry pins.
- **CLI short help wraps cleanly**
([#&#8203;478](https://redirect.github.com/endevco/aube/pull/478) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — many flags across
`add`, `install`, `publish`, `update`, `view`, etc. had multi-line doc
comments that clap merged into 120+ char paragraphs for `-h`. Now each
flag has a one-line summary followed by the longer prose, restoring
readable short help on standard terminals.

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.6.2...v1.7.0>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/Chicago)

- Branch creation
  - Only on Friday (`* * * * 5`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/jdx/mise-action).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzkuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE3OS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.eslintignore

@@ -1,4 +0,0 @@
-lib/
-dist/
-node_modules/
-coverage/

.github/renovate.json

@@ -1,14 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
+  "extends": ["github>jdx/renovate-config"],
-    "github>jdx/renovate-config"
+  "gitIgnoredAuthors": ["autofix.ci[bot] <autofix.ci[bot]@users.noreply.github.com>"],
-  ],
+  "rebaseWhen": "conflicted"
-  "postUpgradeTasks": {
-    "commands": ["npm run all"],
-    "fileFilters": ["dist/**/*"],
-    "executionMode": "branch"
-  },
-  "allowedPostUpgradeCommands": [
-    "^npm run all"
-  ]
 }

.github/workflows/check-dist.yml

@@ -12,11 +12,7 @@ on:
   push:
     branches:
       - main
-    paths-ignore:
-      - '**.md'
   pull_request:
-    paths-ignore:
-      - '**.md'
   workflow_dispatch:
 
 concurrency:
@@ -35,21 +31,19 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
         with:
-          node-version: 18
+          persist-credentials: false
-          cache: npm
+
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
 
       - name: Install Dependencies
         id: install
-        run: npm ci
+        run: aube ci
 
       - name: Build dist/ Directory
         id: build
-        run: npm run bundle
+        run: aubr bundle
 
       - name: Compare Expected and Actual Directories
         id: diff
@@ -62,7 +56,7 @@ jobs:
 
       # If index.js was different than expected, upload the expected version as
       # a workflow artifact.
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: ${{ failure() && steps.diff.conclusion == 'failure' }}
         with:
           name: dist

.github/workflows/ci.yml

@@ -7,6 +7,9 @@ on:
       - main
       - 'releases/*'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
@@ -19,26 +22,31 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Setup Node.js
-        id: setup-node
-        uses: actions/setup-node@v4
         with:
-          node-version: 18
+          persist-credentials: false
-          cache: npm
+
+      # `mise.toml` pins both Node and aube; mise-action installs
+      # whatever's listed there. Reads `package-lock.json`
+      # directly — no separate `aube-lock.yaml` to maintain.
+      # `.npmrc` pins `node-linker=hoisted` so the layout is
+      # npm-flat (rollup's `--configPlugin` resolution
+      # requires this).
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          cache: false
 
       - name: Install Dependencies
-        id: npm-ci
+        id: aube-ci
-        run: npm ci
+        run: aube ci
 
       - name: Check Format
-        id: npm-format-check
+        id: aube-format-check
-        run: npm run format:check
+        run: aubr format:check
 
       - name: Lint
-        id: npm-lint
+        id: aube-lint
-        run: npm run lint
+        run: aubr lint
 
       # - name: Test
       #   id: npm-ci-test

.github/workflows/codeql-analysis.yml

@@ -34,19 +34,21 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         id: initialize
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
         with:
           languages: ${{ matrix.language }}
           source-root: src
 
       - name: Autobuild
         id: autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
 
       - name: Perform CodeQL Analysis
         id: analyze
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4

.github/workflows/pr-closer.yml

@@ -0,0 +1,31 @@
+name: pr-closer
+
+on:
+  schedule:
+    - cron: "0 0 * * *" # daily at midnight
+  workflow_dispatch:
+
+jobs:
+  close-stale-prs:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Close stale PRs
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr list -R "${{ github.repository }}" --state open --json number,author,labels,updatedAt,statusCheckRollup --limit 100 | \
+          jq -r '.[] | select(
+            (.updatedAt | fromdateiso8601) < (now - 30*24*60*60) and
+            .author.login != "jdx" and
+            ([.labels[].name] | index("keep-open") | not)
+          ) | [.number, (if (.statusCheckRollup | length > 0) and (.statusCheckRollup | any(.conclusion == "FAILURE" or .conclusion == "failure")) then "failing" else "passing" end)] | @tsv' | \
+          while read -r pr status; do
+            echo "Closing PR #$pr (checks: $status)"
+            if [ "$status" = "failing" ]; then
+              gh pr close "$pr" -R "${{ github.repository }}" -c "This PR has been open for more than 30 days without activity. Note: CI checks were failing, which may be why it wasn't reviewed. Feel free to reopen or create a new PR if you'd like to continue working on this."
+            else
+              gh pr close "$pr" -R "${{ github.repository }}" -c "This PR has been open for more than 30 days without activity. Feel free to reopen or create a new PR if you'd like to continue working on this."
+            fi
+          done

.github/workflows/release-plz.yml

@@ -0,0 +1,34 @@
+name: release-plz
+
+permissions:
+  pull-requests: write
+  contents: write
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  NPM_CONFIG_FUND: false
+
+concurrency:
+  group: release-plz
+
+jobs:
+  release-plz:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+          submodules: recursive
+          token: ${{ secrets.RELEASE_PLZ_GITHUB_TOKEN }}
+          persist-credentials: false
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+      - run: mise run release-plz
+        env:
+          DRY_RUN: 0
+          GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,49 @@
+name: Release
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+
+permissions: {}
+
+jobs:
+  release:
+    if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+          persist-credentials: false
+
+      - name: Setup mise
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+
+      - name: Release
+        run: ./scripts/postversion.sh
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  enhance-release:
+    needs: [release]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+      - name: Enhance release notes with communique
+        run: |
+          TAG_NAME="v$(jq -r .version package.json)"
+          communique generate "$TAG_NAME" --github-release
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_GITHUB_TOKEN }}

.github/workflows/test-redacted-env.yml

@@ -0,0 +1,77 @@
+name: Test Redacted Environment Variables
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test-redacted-env:
+    runs-on: ubuntu-latest
+    
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      
+      - name: Create test mise config with sensitive values
+        run: |
+          cat > .mise.toml << 'EOF'
+          [env]
+          PUBLIC_VAR = "this-is-public"
+          API_KEY = {value = "secret-api-key-12345", redact = true}
+          SECRET_TOKEN = {value = "supersecret-token-xyz", redact = true}
+          DATABASE_PASSWORD = {value = "db-pass-789", redact = true}
+          EOF
+      
+      - name: Setup mise
+        uses: ./
+      
+      - name: Verify environment variables are exported
+        run: |
+          echo "Checking if environment variables are set..."
+          
+          # Check that public var is set
+          if [ "$PUBLIC_VAR" != "this-is-public" ]; then
+            echo "ERROR: PUBLIC_VAR not set correctly"
+            exit 1
+          fi
+          echo "✓ PUBLIC_VAR is set correctly"
+          
+          # Check that sensitive vars are set (but their values should be masked in logs)
+          if [ -z "$API_KEY" ]; then
+            echo "ERROR: API_KEY not set"
+            exit 1
+          fi
+          echo "✓ API_KEY is set"
+          
+          if [ -z "$SECRET_TOKEN" ]; then
+            echo "ERROR: SECRET_TOKEN not set"
+            exit 1
+          fi
+          echo "✓ SECRET_TOKEN is set"
+          
+          if [ -z "$DATABASE_PASSWORD" ]; then
+            echo "ERROR: DATABASE_PASSWORD not set"
+            exit 1
+          fi
+          echo "✓ DATABASE_PASSWORD is set"
+      
+      - name: Test that sensitive values are masked (will show *** if properly masked)
+        run: |
+          echo "Testing value masking..."
+          echo "API_KEY value: $API_KEY"
+          echo "SECRET_TOKEN value: $SECRET_TOKEN"
+          echo "DATABASE_PASSWORD value: $DATABASE_PASSWORD"
+          echo "PUBLIC_VAR value: $PUBLIC_VAR"
+          
+          # This should show the actual values in the step output,
+          # but GitHub Actions should mask them if core.setSecret was called
+      
+      - name: Verify mise version
+        run: mise --version

.github/workflows/test.yml

@@ -1,12 +1,16 @@
-name: 'build-test'
+name: "build-test"
 on: # rebuild any PRs and main branch changes
   pull_request:
+    branches:
+      - main
   push:
     branches:
       - main
-      - 'releases/*'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
@@ -15,49 +19,173 @@ jobs:
   build: # make sure build/ci work properly
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - run: |
+        with:
-          npm install
+          persist-credentials: false
-      - run: |
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
-          npm run all
+      - run: aube install
+      - run: aubr all
   test: # make sure the action works on a clean machine without building
     strategy:
       fail-fast: false
       matrix:
-        os:
+        include:
-          - macos-latest
+          - name: ubuntu
-          - ubuntu-latest
+            runs-on: ubuntu-latest
-          - windows-latest
+          - name: macos
-    runs-on: ${{ matrix.os }}
+            runs-on: macos-latest
+          - name: windows
+            runs-on: windows-latest
+          - name: alpine
+            runs-on: ubuntu-latest
+            container: alpine:latest
+            requirements: apk add --no-cache curl bash
+    name: ${{ matrix.name }}
+    runs-on: ${{ matrix.runs-on }}
+    container: ${{ matrix.container }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Install requirements
+        if: ${{ matrix.requirements }}
+        run: ${{ matrix.requirements }}
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - name: Setup mise
         uses: ./
         with:
           mise_toml: |
             [tools]
-            node = "22.0.0"
+            jq = "1.7.1"
+
+            [env]
+            MY_ENV_VAR = "abc"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - run: mise --version
-      - run: mise x node -- node -v
+      - run: mise x jq -- jq --version
-      - run: which node
+      - run: which jq
-      - run: node --version
+      - run: jq --version
+      - name: Check Windows shim binary
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $miseBinDir = Split-Path -Parent (Get-Command mise).Source
+          $miseShim = Join-Path $miseBinDir "mise-shim.exe"
+          if (!(Test-Path -LiteralPath $miseShim)) {
+            throw "mise-shim.exe was not installed next to mise.exe"
+          }
       - run: . scripts/test.sh
         shell: bash
+
   specific_version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - name: Setup mise
         uses: ./
         with:
           cache_save: ${{ github.ref_name == 'main' }}
           cache_key_prefix: mise-v1
-          version: 2024.9.6
+          version: 2025.7.3
+          sha256: d38d4993c5379a680b50661f86287731dc1d1264777880a79b786403af337948
           install_args: bun
           mise_toml: |
             [tools]
             bun = "1"
       - run: which bun
       - run: bun -v
+      - name: Update mise
+        uses: ./
+        with:
+          cache_save: ${{ github.ref_name == 'main' }}
+          cache_key_prefix: mise-v1
+          version: v2025.7.3 # should trim the `v`
+          sha256: d38d4993c5379a680b50661f86287731dc1d1264777880a79b786403af337948
+
+  checksum_failure:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - name: Setup mise
+        id: bad
+        uses: ./
+        with:
+          version: 2024.9.6
+          sha256: 1f0b8c3d2e4f5a6b7c8d9e0f1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t
+        continue-on-error: true
+      - name: Dump steps context
+        if: ${{ always() }}
+        env:
+          STEPS_CONTEXT: ${{ toJson(steps) }}
+        run: echo "$STEPS_CONTEXT"
+      - name: expect failure
+        run: echo "Failed as expected"
+        if: ${{ steps.bad.outcome == 'failure' }}
+      - name: not failed as expected
+        run: |
+          echo "Expected failure but the job was ${STEPS_BAD_OUTCOME}"
+          exit 1
+        if: ${{ steps.bad.outcome != 'failure' }}
+        env:
+          STEPS_BAD_OUTCOME: ${{ steps.bad.outcome }}
+
+  custom_cache_key:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - name: Setup mise with custom cache key
+        uses: ./
+        with:
+          cache_key: "custom-{{platform}}-{{install_args_hash}}-${{ github.run_id }}"
+          install_args: "jq@1.7.1"
+          mise_toml: |
+            [tools]
+            jq = "1.7.1"
+      - run: mise --version
+      - run: mise x jq -- jq --version
+      - run: which jq
+      - run: jq --version
+
+  fetch_from_github:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - name: Setup mise from mise.jdx.dev
+        uses: ./
+        with:
+          fetch_from_github: true
+          cache: false
+          cache_save: false
+          mise_toml: |
+            [tools]
+            jq = "1.7.1"
+      - run: mise --version
+      - run: mise x jq -- jq --version
+      - run: which jq
+      - run: jq --version
+
+  final:
+    needs:
+      - build
+      - test
+      - specific_version
+      - checksum_failure
+      - custom_cache_key
+      - fetch_from_github
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    # Run on success or upstream failure but skip when the workflow is cancelled
+    # — `always()` would override `cancel-in-progress` and waste a runner.
+    if: ${{ !cancelled() }}
+    steps:
+      - name: Check CI job results
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')
+        run: exit 1

.github/workflows/zizmor.yml

@@ -0,0 +1,22 @@
+name: zizmor
+on:
+  push:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  pull_request:
+    paths: ['.github/workflows/**']
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          advanced-security: false

.gitignore

@@ -101,3 +101,10 @@ __tests__/runner/*
 .idea
 .vscode
 *.code-workspace
+
+# Generated by `aube install` to record build-script approvals.
+# We've chosen not to commit our approval state — the build doesn't
+# need any package's install scripts to run, and the file gets
+# regenerated each install anyway. The harmless "ignored build
+# scripts" warning in `aube install` output is the cost.
+pnpm-workspace.yaml

.husky/pre-commit

@@ -1,4 +1,5 @@
 # shellcheck disable=SC1091
 
+npm ci
 npm run all
 git add dist

.npmrc

@@ -0,0 +1,11 @@
+# Forces a flat npm-style `node_modules/` layout instead of
+# aube's default symlink/virtual-store. Required for
+# deterministic `dist/index.js.map` source-map paths in CI:
+# without flat layout, rollup embeds absolute paths into
+# aube's per-user cache dir (`/home/runner/.cache/aube/...`),
+# which differ across machines and break the `check-dist`
+# workflow's byte-equality check.
+#
+# npm reads `.npmrc` too but ignores `node-linker` (npm
+# always installs flat), so the file is safe for both PMs.
+node-linker=hoisted

CHANGELOG.md

@@ -1,7 +1,503 @@
 # Changelog
 
 ---
-## [2.1.0](https://github.com/jdx/mise-action/compare/v2.0.6..2.1.0) - 2024-09-25
+## [4.0.1](https://github.com/jdx/mise-action/compare/v4.0.0..v4.0.1) - 2026-03-22
+
+### 🐛 Bug Fixes
+
+- run npm install in pre-commit hook before build (#410) by [@jdx](https://github.com/jdx) in [#410](https://github.com/jdx/mise-action/pull/410)
+
+### 🚜 Refactor
+
+- extract getCwd() helper to deduplicate working directory resolution (#403) by [@altendky](https://github.com/altendky) in [#403](https://github.com/jdx/mise-action/pull/403)
+
+### 📚 Documentation
+
+- bump versions listed im README.md (#407) by [@deining](https://github.com/deining) in [#407](https://github.com/jdx/mise-action/pull/407)
+- bump more versions listed in README.md (#408) by [@deining](https://github.com/deining) in [#408](https://github.com/jdx/mise-action/pull/408)
+
+### ⚙️ Miscellaneous Tasks
+
+- add workflow to auto-close stale PRs (#409) by [@jdx](https://github.com/jdx) in [#409](https://github.com/jdx/mise-action/pull/409)
+
+### New Contributors
+
+* @deining made their first contribution in [#408](https://github.com/jdx/mise-action/pull/408)
+
+---
+## [4.0.0](https://github.com/jdx/mise-action/compare/v3.6.3..v4.0.0) - 2026-03-13
+
+### 🚀 Features
+
+- **breaking** Update Node.js version from 20 to 24 (#395) by [@tumerorkun](https://github.com/tumerorkun) in [#395](https://github.com/jdx/mise-action/pull/395)
+
+### New Contributors
+
+* @tumerorkun made their first contribution in [#395](https://github.com/jdx/mise-action/pull/395)
+
+---
+## [3.6.3](https://github.com/jdx/mise-action/compare/v3.6.2..v3.6.3) - 2026-03-06
+
+### 🐛 Bug Fixes
+
+- pass cwd to all exec calls in exportMiseEnv() (#390) by [@andrewthauer](https://github.com/andrewthauer) in [#390](https://github.com/jdx/mise-action/pull/390)
+
+### New Contributors
+
+* @andrewthauer made their first contribution in [#390](https://github.com/jdx/mise-action/pull/390)
+
+---
+## [3.6.2](https://github.com/jdx/mise-action/compare/v3.6.1..v3.6.2) - 2026-03-02
+
+### 🐛 Bug Fixes
+
+- move file_hash to end of cache key template to prevent prefix matching (#384) by [@altendky](https://github.com/altendky) in [#384](https://github.com/jdx/mise-action/pull/384)
+
+### New Contributors
+
+* @altendky made their first contribution in [#384](https://github.com/jdx/mise-action/pull/384)
+
+---
+## [3.6.1](https://github.com/jdx/mise-action/compare/v3.6.0..v3.6.1) - 2026-01-20
+
+### 🔍 Other Changes
+
+- Revert "fix(cache): isolate cache keys per working_directory in monorepos" (#364) by [@jdx](https://github.com/jdx) in [#364](https://github.com/jdx/mise-action/pull/364)
+
+---
+## [3.6.0](https://github.com/jdx/mise-action/compare/v3.5.1..v3.6.0) - 2026-01-18
+
+### 🚀 Features
+
+- add option to disable shims in PATH (#340) by [@jdx](https://github.com/jdx) in [#340](https://github.com/jdx/mise-action/pull/340)
+
+### 🐛 Bug Fixes
+
+- **(cache)** isolate cache keys per working_directory in monorepos (#360) by [@chadxz](https://github.com/chadxz) in [#360](https://github.com/jdx/mise-action/pull/360)
+- use mise_dir input when specified (#339) by [@jdx](https://github.com/jdx) in [#339](https://github.com/jdx/mise-action/pull/339)
+- pass environment variables to mise commands (#341) by [@jdx](https://github.com/jdx) in [#341](https://github.com/jdx/mise-action/pull/341)
+- make mise self-update output visible in logs (#355) by [@nikobockerman](https://github.com/nikobockerman) in [#355](https://github.com/jdx/mise-action/pull/355)
+
+### 📚 Documentation
+
+- fix description for `mise_toml` input (#351) by [@quad](https://github.com/quad) in [#351](https://github.com/jdx/mise-action/pull/351)
+
+### New Contributors
+
+* @chadxz made their first contribution in [#360](https://github.com/jdx/mise-action/pull/360)
+* @nikobockerman made their first contribution in [#355](https://github.com/jdx/mise-action/pull/355)
+* @quad made their first contribution in [#351](https://github.com/jdx/mise-action/pull/351)
+
+---
+## [3.5.1](https://github.com/jdx/mise-action/compare/v3.5.0..v3.5.1) - 2025-11-24
+
+### 🔍 Other Changes
+
+- Revert "feat(action): moved save cache to post step" (#329) by [@jdx](https://github.com/jdx) in [#329](https://github.com/jdx/mise-action/pull/329)
+
+---
+## [3.5.0](https://github.com/jdx/mise-action/compare/v3.4.1..v3.5.0) - 2025-11-21
+
+### 🚀 Features
+
+- **(action)** moved save cache to post step (#321) by [@aamkye](https://github.com/aamkye) in [#321](https://github.com/jdx/mise-action/pull/321)
+
+### New Contributors
+
+* @aamkye made their first contribution in [#321](https://github.com/jdx/mise-action/pull/321)
+
+---
+## [3.4.1](https://github.com/jdx/mise-action/compare/v3.4.0..v3.4.1) - 2025-11-13
+
+### 🐛 Bug Fixes
+
+- avoid github token downstream issue (#317) by [@acesyde](https://github.com/acesyde) in [#317](https://github.com/jdx/mise-action/pull/317)
+
+### New Contributors
+
+* @acesyde made their first contribution in [#317](https://github.com/jdx/mise-action/pull/317)
+
+---
+## [3.4.0](https://github.com/jdx/mise-action/compare/v3.3.1..v3.4.0) - 2025-10-31
+
+### 🚀 Features
+
+- use autofix.ci to auto-update dist/ on all PRs by [@jdx](https://github.com/jdx) in [16e9fd5](https://github.com/jdx/mise-action/commit/16e9fd5251189c3d389adb836f243575c134d680)
+- use autofix.ci to auto-update dist/ on all PRs (#308) by [@jdx](https://github.com/jdx) in [#308](https://github.com/jdx/mise-action/pull/308)
+
+### 🐛 Bug Fixes
+
+- add missing `await` to `core.group` calls (#305) by [@smorimoto](https://github.com/smorimoto) in [#305](https://github.com/jdx/mise-action/pull/305)
+- auto-update dist folder in Renovate PRs via GitHub Actions (#306) by [@jdx](https://github.com/jdx) in [#306](https://github.com/jdx/mise-action/pull/306)
+- configure Renovate to ignore github-actions[bot] commits by [@jdx](https://github.com/jdx) in [993e7d0](https://github.com/jdx/mise-action/commit/993e7d0bb6f3422ef833a702b90e2a44909ec651)
+- run auto-update-dist workflow on all PRs by [@jdx](https://github.com/jdx) in [6d0fd75](https://github.com/jdx/mise-action/commit/6d0fd75ed51124702e37bfcf6e977da73f64b4e1)
+
+### 📚 Documentation
+
+- update to v3 in README (#290) by [@pdecat](https://github.com/pdecat) in [#290](https://github.com/jdx/mise-action/pull/290)
+
+### ⚙️ Miscellaneous Tasks
+
+- upgrade all workflows to Node 24 by [@jdx](https://github.com/jdx) in [c7b5f37](https://github.com/jdx/mise-action/commit/c7b5f37cadd1a385188a023510a966efa5eed247)
+- remove unused workflow by [@jdx](https://github.com/jdx) in [aecb23d](https://github.com/jdx/mise-action/commit/aecb23d92f0e50768578578f309255414a23561d)
+
+### New Contributors
+
+* @smorimoto made their first contribution in [#305](https://github.com/jdx/mise-action/pull/305)
+* @pdecat made their first contribution in [#290](https://github.com/jdx/mise-action/pull/290)
+
+---
+## [3.3.1](https://github.com/jdx/mise-action/compare/v3.3.0..v3.3.1) - 2025-10-06
+
+### 🐛 Bug Fixes
+
+- trim "v" prefix on update (#287) by [@zeitlinger](https://github.com/zeitlinger) in [#287](https://github.com/jdx/mise-action/pull/287)
+
+---
+## [3.3.0](https://github.com/jdx/mise-action/compare/v3.2.0..v3.3.0) - 2025-10-03
+
+### 🚀 Features
+
+- use self-update to modify version if mise is already installed (#277) by [@ImpSy](https://github.com/ImpSy) in [#277](https://github.com/jdx/mise-action/pull/277)
+
+### 🐛 Bug Fixes
+
+- **(cache)** replace `,` in `MISE_ENV` with `-` (#278) by [@risu729](https://github.com/risu729) in [#278](https://github.com/jdx/mise-action/pull/278)
+- correct Renovate allowedPostUpgradeCommands configuration by [@jdx](https://github.com/jdx) in [4313941](https://github.com/jdx/mise-action/commit/43139419dcaeb99e24c487d646766d014d0957a2)
+
+### ⚙️ Miscellaneous Tasks
+
+- **(config)** migrate renovate config (#263) by [@renovate[bot]](https://github.com/renovate[bot]) in [#263](https://github.com/jdx/mise-action/pull/263)
+- updated deps by [@jdx](https://github.com/jdx) in [5795893](https://github.com/jdx/mise-action/commit/5795893acedc0f2044498a21005c38f12dd5d8d3)
+
+### New Contributors
+
+* @mise-en-dev made their first contribution in [#284](https://github.com/jdx/mise-action/pull/284)
+* @ImpSy made their first contribution in [#277](https://github.com/jdx/mise-action/pull/277)
+
+---
+## [3.2.0](https://github.com/jdx/mise-action/compare/v3.1.0..v3.2.0) - 2025-08-22
+
+### 🚀 Features
+
+- add environment variable support to cache key templates (#250) by [@pepicrft](https://github.com/pepicrft) in [#250](https://github.com/jdx/mise-action/pull/250)
+
+### 🐛 Bug Fixes
+
+- redact secret values from env (#252) by [@jdx](https://github.com/jdx) in [#252](https://github.com/jdx/mise-action/pull/252)
+
+---
+## [3.1.0](https://github.com/jdx/mise-action/compare/v3.0.2..v3.1.0) - 2025-08-19
+
+### 🚀 Features
+
+- add configurable cache key with template variable support (#246) by [@pepicrft](https://github.com/pepicrft) in [#246](https://github.com/jdx/mise-action/pull/246)
+
+---
+## [3.0.2](https://github.com/jdx/mise-action/compare/v3.0.1..v3.0.2) - 2025-08-18
+
+### ⚙️ Miscellaneous Tasks
+
+- remove duplicate release-plz logic by [@jdx](https://github.com/jdx) in [7081572](https://github.com/jdx/mise-action/commit/70815728fdd7d32bad0deb6b33576cf791f1dafa)
+
+---
+## [3.0.1](https://github.com/jdx/mise-action/compare/v3.0.0..v3.0.1) - 2025-08-18
+
+### 📚 Documentation
+
+- add CLAUDE.md by [@jdx](https://github.com/jdx) in [729161f](https://github.com/jdx/mise-action/commit/729161fe32f196174ff956fbe3ce8743567cb9e1)
+- hide release entries in CHANGELOG by [@jdx](https://github.com/jdx) in [96680f6](https://github.com/jdx/mise-action/commit/96680f666f91bbcb5b4d76ff2ac0f465bb941dd0)
+
+### ⚙️ Miscellaneous Tasks
+
+- fix release-plz by [@jdx](https://github.com/jdx) in [3600b64](https://github.com/jdx/mise-action/commit/3600b6410713f6187847c1eb2bde38315e844484)
+- updated deps (#244) by [@jdx](https://github.com/jdx) in [#244](https://github.com/jdx/mise-action/pull/244)
+
+---
+## [3.0.0](https://github.com/jdx/mise-action/compare/v2.4.4..v3.0.0) - 2025-08-18
+
+### 🚀 Features
+
+- **breaking** export env vars from mise.toml (#241) by [@maelp](https://github.com/maelp) in [#241](https://github.com/jdx/mise-action/pull/241)
+
+### New Contributors
+
+* @maelp made their first contribution in [#241](https://github.com/jdx/mise-action/pull/241)
+
+---
+## [2.4.4](https://github.com/jdx/mise-action/compare/v2.4.3..v2.4.4) - 2025-07-27
+
+### 🐛 Bug Fixes
+
+- v2 release tag automation by [@jdx](https://github.com/jdx) in [07fb524](https://github.com/jdx/mise-action/commit/07fb524adc338a756d6ff7fa7a33f0e27bdc4d2d)
+- v2 release tag automation by [@jdx](https://github.com/jdx) in [0de6d11](https://github.com/jdx/mise-action/commit/0de6d11b95678b220019adc7929e4d9752b59355)
+- v2 release tag automation by [@jdx](https://github.com/jdx) in [75121b9](https://github.com/jdx/mise-action/commit/75121b9a3f21cd3b497f047d71a77d59099ff6b3)
+- v2 release tag automation by [@jdx](https://github.com/jdx) in [583fe7b](https://github.com/jdx/mise-action/commit/583fe7be9d688739c95cc32249344e9796f4eebe)
+- v2 release tag automation by [@jdx](https://github.com/jdx) in [7fa2a26](https://github.com/jdx/mise-action/commit/7fa2a26c1e3cf1b20bbf42f2d293912e90e71177)
+- v2 release tag automation by [@jdx](https://github.com/jdx) in [cf44a56](https://github.com/jdx/mise-action/commit/cf44a563b9a45de221b77d23cbc5621dc7e6b377)
+- v2 release tag automation by [@jdx](https://github.com/jdx) in [a35d5fc](https://github.com/jdx/mise-action/commit/a35d5fc6817dcb018e9e7a6613664fde7f5d4aaf)
+- v2 release tag automation by [@jdx](https://github.com/jdx) in [c37c932](https://github.com/jdx/mise-action/commit/c37c93293d6b742fc901e1406b8f764f6fb19dac)
+
+### ⚙️ Miscellaneous Tasks
+
+- add release workflow by [@jdx](https://github.com/jdx) in [eccbf00](https://github.com/jdx/mise-action/commit/eccbf00da17ac7d1d18017ead61bc54a442f3a38)
+- skip release script if no changes by [@jdx](https://github.com/jdx) in [eba59a9](https://github.com/jdx/mise-action/commit/eba59a9eefc99963516a3ff8be4c372c656f0215)
+
+---
+## [2.4.3](https://github.com/jdx/mise-action/compare/v2.4.2..v2.4.3) - 2025-07-27
+
+### 🐛 Bug Fixes
+
+- v2 release tag automation by [@jdx](https://github.com/jdx) in [5c24f96](https://github.com/jdx/mise-action/commit/5c24f96c0ff8577151a76e76344591427bcf28c5)
+
+---
+## [2.4.2](https://github.com/jdx/mise-action/compare/v2.4.0..v2.4.2) - 2025-07-24
+
+### 🚀 Features
+
+- allow fetching binary from mise.jdx.dev (#227) by [@jdx](https://github.com/jdx) in [#227](https://github.com/jdx/mise-action/pull/227)
+
+### 🔍 Other Changes
+
+- Fix flag passed to `mise reshim` (#208) by [@andrewdriggs](https://github.com/andrewdriggs) in [#208](https://github.com/jdx/mise-action/pull/208)
+
+### ⚙️ Miscellaneous Tasks
+
+- add semantic-pr-lint (#220) by [@jdx](https://github.com/jdx) in [#220](https://github.com/jdx/mise-action/pull/220)
+- added release-plz by [@jdx](https://github.com/jdx) in [bd8ba20](https://github.com/jdx/mise-action/commit/bd8ba20c5611a6ebc508d3c263444c97c5483bd1)
+- get postversion to work by [@jdx](https://github.com/jdx) in [954e13d](https://github.com/jdx/mise-action/commit/954e13db3e9329a8373a5d6cfa3718f7bc607149)
+- set release token by [@jdx](https://github.com/jdx) in [6d3ca74](https://github.com/jdx/mise-action/commit/6d3ca74ece306fcd7f501bd95086deaf8d0c3552)
+- use new release-plz token by [@jdx](https://github.com/jdx) in [1c87378](https://github.com/jdx/mise-action/commit/1c87378f400e5957e22607e2c938eac904a3e233)
+- fix check-dist by [@jdx](https://github.com/jdx) in [4dfd63f](https://github.com/jdx/mise-action/commit/4dfd63f0279a3418b93cbbfc4bc132ace1da2481)
+- add git add and git status commands to release script by [@jdx](https://github.com/jdx) in [0c56699](https://github.com/jdx/mise-action/commit/0c56699aa697e50cf8d17b7c07976b7c1e550c23)
+- update changelog extraction in release script to skip the section break line by [@jdx](https://github.com/jdx) in [714aa25](https://github.com/jdx/mise-action/commit/714aa2569b8097f175d58290710a86eefe2098d0)
+
+### New Contributors
+
+* @github-actions[bot] made their first contribution in [#221](https://github.com/jdx/mise-action/pull/221)
+
+---
+## [2.4.0](https://github.com/jdx/mise-action/compare/v2.3.1..v2.4.0) - 2025-07-12
+
+### 🔍 Other Changes
+
+- support checksum (#218) by [@zeitlinger](https://github.com/zeitlinger) in [#218](https://github.com/jdx/mise-action/pull/218)
+
+### ⚙️ Miscellaneous Tasks
+
+- updated deps (#219) by [@jdx](https://github.com/jdx) in [#219](https://github.com/jdx/mise-action/pull/219)
+
+---
+## [2.3.1](https://github.com/jdx/mise-action/compare/v2.3.0..v2.3.1) - 2025-06-25
+
+### 🔍 Other Changes
+
+- Revert "add all MISE_ env vars to cache key (#197)" by [@jdx](https://github.com/jdx) in [233d283](https://github.com/jdx/mise-action/commit/233d283dd63662f6e6072a0de98feba374d69616)
+
+---
+## [2.3.0](https://github.com/jdx/mise-action/compare/v2.2.3..v2.3.0) - 2025-06-25
+
+### 🚀 Features
+
+- pass github token for mise calls (#205) by [@matemoln](https://github.com/matemoln) in [#205](https://github.com/jdx/mise-action/pull/205)
+
+### 🔍 Other Changes
+
+- Add `reshim` flag to reshim after setup (#202) by [@andrewdriggs](https://github.com/andrewdriggs) in [#202](https://github.com/jdx/mise-action/pull/202)
+- add all MISE_ env vars to cache key (#197) by [@zeitlinger](https://github.com/zeitlinger) in [#197](https://github.com/jdx/mise-action/pull/197)
+
+### ⚙️ Miscellaneous Tasks
+
+- node-24 by [@jdx](https://github.com/jdx) in [ec352a8](https://github.com/jdx/mise-action/commit/ec352a89164842ea9cc8b6f67d1829660d9f1f78)
+- update deps (#203) by [@jdx](https://github.com/jdx) in [#203](https://github.com/jdx/mise-action/pull/203)
+- updated deps by [@jdx](https://github.com/jdx) in [7e5e321](https://github.com/jdx/mise-action/commit/7e5e321e56397b1b54f112ae65ce0c8f1d5dd8ca)
+
+### New Contributors
+
+* @matemoln made their first contribution in [#205](https://github.com/jdx/mise-action/pull/205)
+* @zeitlinger made their first contribution in [#197](https://github.com/jdx/mise-action/pull/197)
+* @andrewdriggs made their first contribution in [#202](https://github.com/jdx/mise-action/pull/202)
+
+---
+## [2.2.3](https://github.com/jdx/mise-action/compare/v2.2.2..v2.2.3) - 2025-05-27
+
+### 🔍 Other Changes
+
+- Add MISE_ENV to cache key if set (#196) by [@prashantv](https://github.com/prashantv) in [#196](https://github.com/jdx/mise-action/pull/196)
+
+### New Contributors
+
+* @prashantv made their first contribution in [#196](https://github.com/jdx/mise-action/pull/196)
+
+---
+## [2.2.2](https://github.com/jdx/mise-action/compare/v2.2.1..v2.2.2) - 2025-05-12
+
+### 🔍 Other Changes
+
+- Fix alpine container installation (#189) by [@vic1707](https://github.com/vic1707) in [#189](https://github.com/jdx/mise-action/pull/189)
+
+### 📚 Documentation
+
+- hide version commits in CHANGELOG by [@jdx](https://github.com/jdx) in [570a9c6](https://github.com/jdx/mise-action/commit/570a9c6467a0d2735b79d8a719a75229adc179e6)
+- hide version commits in CHANGELOG by [@jdx](https://github.com/jdx) in [d20b46e](https://github.com/jdx/mise-action/commit/d20b46e041ee9e28e7b67d713f4df93a72358b54)
+
+### ⚙️ Miscellaneous Tasks
+
+- updated deps by [@jdx](https://github.com/jdx) in [69bf3f1](https://github.com/jdx/mise-action/commit/69bf3f1a1ff387ad74d841595f9c5f9e4d8816be)
+
+### New Contributors
+
+* @vic1707 made their first contribution in [#189](https://github.com/jdx/mise-action/pull/189)
+
+---
+## [2.2.1](https://github.com/jdx/mise-action/compare/v2.2.0..v2.2.1) - 2025-04-23
+
+### 🐛 Bug Fixes
+
+- show message when saving cache by [@jdx](https://github.com/jdx) in [4a07a7c](https://github.com/jdx/mise-action/commit/4a07a7ced07f3f5ba2bcafcfe1954eef43fda3c0)
+
+---
+## [2.2.0](https://github.com/jdx/mise-action/compare/v2.1.11..v2.2.0) - 2025-04-23
+
+### 🚀 Features
+
+- run mise ls (#163) by [@scop](https://github.com/scop) in [#163](https://github.com/jdx/mise-action/pull/163)
+
+### 🐛 Bug Fixes
+
+- save cache when build fails by [@jdx](https://github.com/jdx) in [81d53cf](https://github.com/jdx/mise-action/commit/81d53cf96809b887a4903446d5466da5e25ffe37)
+
+### 📚 Documentation
+
+- restore estranged comment for tool_versions (#164) by [@mfilej](https://github.com/mfilej) in [#164](https://github.com/jdx/mise-action/pull/164)
+
+### ⚙️ Miscellaneous Tasks
+
+- updated deps by [@jdx](https://github.com/jdx) in [ff329b7](https://github.com/jdx/mise-action/commit/ff329b72aca0adb59abbbf545f488bac2a11bda9)
+- renovate by [@jdx](https://github.com/jdx) in [83232dd](https://github.com/jdx/mise-action/commit/83232dd5706c1ad3d58a22ac8b0e9852c80eb748)
+
+### New Contributors
+
+* @mfilej made their first contribution in [#164](https://github.com/jdx/mise-action/pull/164)
+* @scop made their first contribution in [#163](https://github.com/jdx/mise-action/pull/163)
+
+---
+## [2.1.11](https://github.com/jdx/mise-action/compare/v2.1.10..v2.1.11) - 2024-12-30
+
+### 🐛 Bug Fixes
+
+- use tar.gz if zstd is not available (#159) by [@jdx](https://github.com/jdx) in [#159](https://github.com/jdx/mise-action/pull/159)
+
+---
+## [2.1.10](https://github.com/jdx/mise-action/compare/v2.1.9..v2.1.10) - 2024-12-23
+
+### ⚙️ Miscellaneous Tasks
+
+- use github releases (#154) by [@jdx](https://github.com/jdx) in [#154](https://github.com/jdx/mise-action/pull/154)
+
+---
+## [2.1.9](https://github.com/jdx/mise-action/compare/v2.1.8..v2.1.9) - 2024-12-23
+
+### 🚀 Features
+
+- fetch tarball with zst compression (#153) by [@jdx](https://github.com/jdx) in [#153](https://github.com/jdx/mise-action/pull/153)
+
+### ⚙️ Miscellaneous Tasks
+
+- loosen node version by [@jdx](https://github.com/jdx) in [5f7b5f7](https://github.com/jdx/mise-action/commit/5f7b5f779deed7c1cf8a300d07d84f8524941f6e)
+
+---
+## [2.1.8](https://github.com/jdx/mise-action/compare/v2.1.7..v2.1.8) - 2024-12-13
+
+### ⚙️ Miscellaneous Tasks
+
+- updated deps by [@jdx](https://github.com/jdx) in [52c535f](https://github.com/jdx/mise-action/commit/52c535ffc8ef0cdf90fd762af1e5e85ebb6933e3)
+- updated deps by [@jdx](https://github.com/jdx) in [3601336](https://github.com/jdx/mise-action/commit/3601336acb5ec1d3b05fcf483769cdbebd8197bf)
+
+---
+## [2.1.7](https://github.com/jdx/mise-action/compare/v2.1.6..v2.1.7) - 2024-11-18
+
+### 🐛 Bug Fixes
+
+- fix cache_save option (#144) by [@risu729](https://github.com/risu729) in [#144](https://github.com/jdx/mise-action/pull/144)
+
+### ⚙️ Miscellaneous Tasks
+
+- updated deps by [@jdx](https://github.com/jdx) in [6c29640](https://github.com/jdx/mise-action/commit/6c296408362b673546bb400d2ab09f8aabf439b8)
+- added pre-commit task by [@jdx](https://github.com/jdx) in [793f8df](https://github.com/jdx/mise-action/commit/793f8df48436e9c0f72668b834ee7847dfdea74b)
+
+---
+## [2.1.6](https://github.com/jdx/mise-action/compare/v2.1.5..v2.1.6) - 2024-11-06
+
+### 🐛 Bug Fixes
+
+- use correct glob format for cache key file hash (#139) by [@Syquel](https://github.com/Syquel) in [#139](https://github.com/jdx/mise-action/pull/139)
+
+### New Contributors
+
+* @Syquel made their first contribution in [#139](https://github.com/jdx/mise-action/pull/139)
+
+---
+## [2.1.5](https://github.com/jdx/mise-action/compare/v2.1.4..v2.1.5) - 2024-11-04
+
+### 🐛 Bug Fixes
+
+- overwrite MISE_LOG_LEVEL when in debug mode (#138) by [@xremming](https://github.com/xremming) in [#138](https://github.com/jdx/mise-action/pull/138)
+- use lockfile for cache key by [@jdx](https://github.com/jdx) in [57eda1a](https://github.com/jdx/mise-action/commit/57eda1a45f7d845430bae3b1767b84cf842802c9)
+
+### 📚 Documentation
+
+- updated README by [@jdx](https://github.com/jdx) in [12823cc](https://github.com/jdx/mise-action/commit/12823cc980f4f0814006dfbc26812972f3029d2a)
+
+### ⚙️ Miscellaneous Tasks
+
+- update deps by [@jdx](https://github.com/jdx) in [239a5da](https://github.com/jdx/mise-action/commit/239a5da37ca9a5534f590a6f92901c199714391f)
+
+---
+## [2.1.4](https://github.com/jdx/mise-action/compare/v2.1.3..v2.1.4) - 2024-10-28
+
+### ⚙️ Miscellaneous Tasks
+
+- fetch mise compressed by [@jdx](https://github.com/jdx) in [c20c9eb](https://github.com/jdx/mise-action/commit/c20c9ebb8b821ea3a64ef94f4144321702665fc4)
+- fetch mise compressed by [@jdx](https://github.com/jdx) in [86b003e](https://github.com/jdx/mise-action/commit/86b003e69f7ac106f303afe7cf016b87641704d0)
+- npm update by [@jdx](https://github.com/jdx) in [534e1f8](https://github.com/jdx/mise-action/commit/534e1f8448d3180fb23336b416d07e78ee67b9b7)
+
+---
+## [2.1.3](https://github.com/jdx/mise-action/compare/v2.1.2..v2.1.3) - 2024-10-26
+
+### 🐛 Bug Fixes
+
+- add `install_args` hash to cache key (#136) by [@risu729](https://github.com/risu729) in [#136](https://github.com/jdx/mise-action/pull/136)
+
+---
+## [2.1.2](https://github.com/jdx/mise-action/compare/v2.1.1..v2.1.2) - 2024-10-25
+
+### 🚀 Features
+
+- use debug logging when in debug mode (#128) (#129) by [@xremming](https://github.com/xremming) in [#129](https://github.com/jdx/mise-action/pull/129)
+
+### 🐛 Bug Fixes
+
+- cache_save boolean bug (#135) by [@jdx](https://github.com/jdx) in [#135](https://github.com/jdx/mise-action/pull/135)
+- renovate artifact updates by [@jdx](https://github.com/jdx) in [e3088a5](https://github.com/jdx/mise-action/commit/e3088a551cec0996df9a8c8865dd72bde3ce9db0)
+
+### New Contributors
+
+* @xremming made their first contribution in [#129](https://github.com/jdx/mise-action/pull/129)
+
+---
+## [2.1.1](https://github.com/jdx/mise-action/compare/v2.1.0..v2.1.1) - 2024-10-24
+
+### 🐛 Bug Fixes
+
+- cache mise bin (#134) by [@jdx](https://github.com/jdx) in [#134](https://github.com/jdx/mise-action/pull/134)
+
+### ⚙️ Miscellaneous Tasks
+
+- migrate away from deprecated git-cliff syntax by [@jdx](https://github.com/jdx) in [9395297](https://github.com/jdx/mise-action/commit/9395297141532d18a614dde9f37875907cf2b5a6)
+
+---
+## [2.1.0](https://github.com/jdx/mise-action/compare/v2.0.6..v2.1.0) - 2024-09-25
 
 ### 🚀 Features
 
@@ -29,10 +525,6 @@
 
 - added config filenames to hashFiles (#86) by [@risu729](https://github.com/risu729) in [#86](https://github.com/jdx/mise-action/pull/86)
 
-### 🔍 Other Changes
-
-- 2.0.6 by [@jdx](https://github.com/jdx) in [d6e32c1](https://github.com/jdx/mise-action/commit/d6e32c1796099e0f1f3ac741c220a8b7eae9e5dd)
-
 ### ⚙️ Miscellaneous Tasks
 
 - rebuild by [@jdx](https://github.com/jdx) in [d0dc8c8](https://github.com/jdx/mise-action/commit/d0dc8c81e39f1b4571ed0668cd7fa6be57534ad2)
@@ -54,10 +546,6 @@
 - fix: rename "install_dir" config to "working_directory" by [@jdx](https://github.com/jdx) in [4541e25](https://github.com/jdx/mise-action/commit/4541e25ef8810d37ad00a583c84cc582701049c0)
 - deprecated install_dir by [@jdx](https://github.com/jdx) in [2e6a26b](https://github.com/jdx/mise-action/commit/2e6a26bb550e828ee46768dd1507028b4e2b8702)
 
-### 🔍 Other Changes
-
-- 2.0.5 by [@jdx](https://github.com/jdx) in [b02b057](https://github.com/jdx/mise-action/commit/b02b0576a303103155c986ce4e0ee322dcda8f72)
-
 ### 📚 Documentation
 
 - changelog by [@jdx](https://github.com/jdx) in [f8de9e3](https://github.com/jdx/mise-action/commit/f8de9e38d34fe5aee1b8430c404c6f9a08379f90)
@@ -70,10 +558,6 @@
 ---
 ## [2.0.4](https://github.com/jdx/mise-action/compare/v2.0.3..v2.0.4) - 2024-04-13
 
-### 🔍 Other Changes
-
-- 2.0.4 by [@jdx](https://github.com/jdx) in [0c39a52](https://github.com/jdx/mise-action/commit/0c39a522dfbced3ed83924152c45804a71ce216f)
-
 ### ⚙️ Miscellaneous Tasks
 
 - **(eslint)** updated eslint@8 by [@jdx](https://github.com/jdx) in [0f558f8](https://github.com/jdx/mise-action/commit/0f558f87e146e155e5bd79c9f134bc09e95090a5)
@@ -85,7 +569,6 @@
 
 - recompile by [@jdx](https://github.com/jdx) in [5173b58](https://github.com/jdx/mise-action/commit/5173b58ce80d4fcb06718136d9549d8180441a91)
 - npm update by [@jdx](https://github.com/jdx) in [e1f00a0](https://github.com/jdx/mise-action/commit/e1f00a0bf8dfe2cc7167344fde559956e187e92a)
-- 2.0.3 by [@jdx](https://github.com/jdx) in [3e282fc](https://github.com/jdx/mise-action/commit/3e282fcd55c8de21f232397e9fb876cd33e612f1)
 
 ### 📚 Documentation
 
@@ -114,7 +597,6 @@
 - added more config filenames to cache key by [@jdx](https://github.com/jdx) in [5424b1f](https://github.com/jdx/mise-action/commit/5424b1f50b5bd5e9c7f2cfe5d56c523694e2ab9b)
 - mise task by [@jdx](https://github.com/jdx) in [c80fa4f](https://github.com/jdx/mise-action/commit/c80fa4f4ef8ad8389663596a388f9f57cba1f9cf)
 - mise task by [@jdx](https://github.com/jdx) in [5e6031b](https://github.com/jdx/mise-action/commit/5e6031b380e8dc1e2a1c60f53fd15233762a5056)
-- 2.0.2 by [@jdx](https://github.com/jdx) in [3bc8539](https://github.com/jdx/mise-action/commit/3bc85396a273ed82bba5e53a15174bbf9dba095c)
 
 ### 🧪 Testing
 
@@ -129,7 +611,6 @@
 - Merge pull request #2 from jdx/dependabot/npm_and_yarn/typescript-eslint/eslint-plugin-6.17.0 by [@jdx](https://github.com/jdx) in [#2](https://github.com/jdx/mise-action/pull/2)
 - remove dependabot by [@jdx](https://github.com/jdx) in [a1a7a37](https://github.com/jdx/mise-action/commit/a1a7a3754501cc8ce7668c6e1bef0d5d29e94d36)
 - npm update by [@jdx](https://github.com/jdx) in [5f39af9](https://github.com/jdx/mise-action/commit/5f39af9fe65adde21286731b4c5e462c3b008ac9)
-- 2.0.1 by [@jdx](https://github.com/jdx) in [052520c](https://github.com/jdx/mise-action/commit/052520c41a328779551db19a76697ffa34f3eabc)
 
 ---
 ## [2.0.0](https://github.com/jdx/mise-action/compare/v1.3.2..v2.0.0) - 2024-01-02
@@ -154,6 +635,10 @@
 - Merge pull request #4 from jdx/renovate/eslint-plugin-jest-27.x-lockfile by [@jdx](https://github.com/jdx) in [#4](https://github.com/jdx/mise-action/pull/4)
 - rename rtx -> mise by [@jdx](https://github.com/jdx) in [a05bde4](https://github.com/jdx/mise-action/commit/a05bde45a6ad8ed7dc182eb5be10060413fa69fa)
 
+### New Contributors
+
+* @renovate[bot] made their first contribution
+
 ---
 ## [1.3.2](https://github.com/jdx/mise-action/compare/v1.3.1..v1.3.2) - 2023-12-24
 
@@ -163,7 +648,6 @@
 - **(deps-dev)** bump @types/node from 20.10.4 to 20.10.5 (#216) by [@dependabot[bot]](https://github.com/dependabot[bot]) in [867a9c3](https://github.com/jdx/mise-action/commit/867a9c3ff59c3ae0c40cfe2e431b556b72a0dbb6)
 - push changes to github by [@jdx](https://github.com/jdx) in [1d64270](https://github.com/jdx/mise-action/commit/1d64270fb5326ff37631ab8130c8e2ae80012f1c)
 - Add API to enable the experimental features (#220) by [@pepicrft](https://github.com/pepicrft) in [10161a1](https://github.com/jdx/mise-action/commit/10161a135f813482311399a5fc1bf495d7ea3f4a)
-- 1.3.2 by [@jdx](https://github.com/jdx) in [61c1bfb](https://github.com/jdx/mise-action/commit/61c1bfbed63c70a82ff0ce3301bde41875b17844)
 
 ### New Contributors
 
@@ -178,7 +662,6 @@
 - **(deps)** bump github/codeql-action from 2 to 3 (#218) by [@dependabot[bot]](https://github.com/dependabot[bot]) in [77393f7](https://github.com/jdx/mise-action/commit/77393f73ad0500e669f6bb4a65d137a786899320)
 - updated postversion script by [@jdx](https://github.com/jdx) in [015cd77](https://github.com/jdx/mise-action/commit/015cd77f75642e852fef408ca29ae2c9a24316b8)
 - updated postversion script by [@jdx](https://github.com/jdx) in [0e7eb33](https://github.com/jdx/mise-action/commit/0e7eb33465b60c603a9537cdcc7eae4f20421c87)
-- 1.3.1 by [@jdx](https://github.com/jdx) in [53fcce4](https://github.com/jdx/mise-action/commit/53fcce409295cd0a23a8818cd8c0e1758aece4c8)
 
 ---
 ## [1.3.0](https://github.com/jdx/mise-action/compare/v1.2.7..v1.3.0) - 2023-12-14
@@ -189,7 +672,6 @@
 - pinning (#213) by [@jdx](https://github.com/jdx) in [a545a9b](https://github.com/jdx/mise-action/commit/a545a9b90a525848406ce775c92be4002e823ed7)
 - added rtx_toml support (#214) by [@jdx](https://github.com/jdx) in [5ac4684](https://github.com/jdx/mise-action/commit/5ac46849accbeea2af455874c27379b56c4c89b6)
 - added rtx_dir config (#215) by [@jdx](https://github.com/jdx) in [55e5d18](https://github.com/jdx/mise-action/commit/55e5d18e746f7ad88a10e22c4fb18b87b44b4000)
-- 1.3.0 by [@jdx](https://github.com/jdx) in [0551aa6](https://github.com/jdx/mise-action/commit/0551aa6fd429bfb44a37cdd384fc9916765eaceb)
 
 ### New Contributors
 
@@ -429,7 +911,6 @@
 - Bump @types/node from 18.14.0 to 18.14.6 by [@dependabot[bot]](https://github.com/dependabot[bot]) in [6ceb321](https://github.com/jdx/mise-action/commit/6ceb3218c97906cd335f1872a762c6c84242fc4a)
 - Merge pull request #34 from jdxcode/dependabot/npm_and_yarn/types/node-18.14.6 by [@jdx](https://github.com/jdx) in [aec7905](https://github.com/jdx/mise-action/commit/aec7905dc83cf86e64228729bc45862ea4c3c076)
 - Clobber rtx binary if it already exists (#36) by [@mark-thm](https://github.com/mark-thm) in [c8026e2](https://github.com/jdx/mise-action/commit/c8026e294c36de62d50e4b0375cbac4d762bfc15)
-- 1.1.1 by [@jdx](https://github.com/jdx) in [69d9eb2](https://github.com/jdx/mise-action/commit/69d9eb201d34b9e85fd9038054b1ae79f5041f8c)
 - Bump @types/node from 18.14.6 to 18.15.1 (#37) by [@dependabot[bot]](https://github.com/dependabot[bot]) in [0051557](https://github.com/jdx/mise-action/commit/00515574a33c758902c6d230c0b637afd58b3f5c)
 - Bump eslint from 8.35.0 to 8.36.0 (#38) by [@dependabot[bot]](https://github.com/dependabot[bot]) in [961863c](https://github.com/jdx/mise-action/commit/961863c724e4c85f42320c43344901819c34df50)
 - Bump @typescript-eslint/parser from 5.54.0 to 5.54.1 (#39) by [@dependabot[bot]](https://github.com/dependabot[bot]) in [99a2e29](https://github.com/jdx/mise-action/commit/99a2e2983bd31f708843c3bf37a0a440b5cb411c)
@@ -520,4 +1001,9 @@
 
 - test node in workflow by [@jdx](https://github.com/jdx) in [51061c6](https://github.com/jdx/mise-action/commit/51061c69d3ef4f6d083aa901e1ed50b859443cb9)
 
+### New Contributors
+
+* @jdx made their first contribution
+* @dependabot[bot] made their first contribution
+
 <!-- generated by git-cliff -->

CLAUDE.md

@@ -0,0 +1,63 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+This is a GitHub Action that installs and configures mise, a polyglot runtime manager. The action is written in TypeScript and published to the GitHub Actions marketplace.
+
+## Development Commands
+
+This project uses [aube](https://aube.en.dev) as its package
+manager (en.dev's pnpm-compat PM, native Rust). It reads
+`package-lock.json` directly — no separate `aube-lock.yaml`.
+`mise install` will install the pinned aube version
+automatically; you can also use `npm` if you prefer (the
+`.npmrc`'s `node-linker=hoisted` pin is aube-specific and
+ignored by npm).
+
+```bash
+# Install dependencies
+aube install
+
+# Build, format, lint, and package
+aubr all
+
+# Individual commands
+aubr format:write  # Format code with Prettier
+aubr lint         # Run ESLint and format check
+aubr package      # Bundle with rollup for distribution
+
+# Testing
+aubr all          # Run full build pipeline
+./scripts/test.sh     # Integration test script
+```
+
+## Architecture
+
+The action follows GitHub's standard TypeScript action structure:
+
+1. **Entry Point**: `src/index.ts` - Main action logic that:
+   - Downloads and installs mise binary
+   - Manages caching through GitHub Actions cache
+   - Configures environment variables (MISE_*, GITHUB_TOKEN)
+   - Runs mise commands (install, reshim, etc.)
+   - Exports mise environment variables to GITHUB_ENV
+
+2. **Distribution**: `dist/index.js` - Compiled and bundled output (must be committed)
+
+3. **Action Definition**: `action.yml` - Defines inputs, outputs, and metadata
+
+## Key Implementation Details
+
+- **Cache Management**: Uses content-addressable caching based on mise config files (.mise.toml, .tool-versions, etc.)
+- **Binary Download**: Supports downloading from GitHub releases or mise.jdx.dev
+- **Platform Support**: Handles Linux (glibc/musl), macOS, and Windows
+- **Environment Setup**: Automatically adds mise bin and shims directories to PATH
+- **GitHub API**: Uses GITHUB_TOKEN to avoid rate limits when installing GitHub-hosted tools
+
+## Important Notes
+
+- Always run `aubr all` before committing to ensure dist/ is updated
+- The dist/ folder must be committed as GitHub Actions runs the compiled code
+- Test changes using the action itself (uses: ./) in test workflows

README.md

@@ -13,33 +13,102 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
-      - uses: jdx/mise-action@v2
+      - uses: jdx/mise-action@v4
         with:
-          version: 2023.12.0 # [default: latest] mise version to install
+          version: 2026.3.10 # [default: latest] mise version to install
           install: true # [default: true] run `mise install`
           install_args: "bun" # [default: ""] additional arguments to `mise install`
           cache: true # [default: true] cache mise using GitHub's cache
-          # automatically write this .tool-versions file
           experimental: true # [default: false] enable experimental features
           log_level: debug # [default: info] log level
+          # automatically write this .tool-versions file
           tool_versions: |
-            shellcheck 0.9.0
+            shellcheck 0.11.0
           # or, if you prefer .mise.toml format:
           mise_toml: |
             [tools]
-            shellcheck = "0.9.0"
+            shellcheck = "0.11.0"
           working_directory: app # [default: .] directory to run mise in
+          reshim: false # [default: false] run `mise reshim -f`
+          github_token: ${{ secrets.GITHUB_TOKEN }} # [default: ${{ github.token }}] GitHub token for API authentication
       - run: shellcheck scripts/*.sh
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
-      - uses: jdx/mise-action@v2
+      - uses: jdx/mise-action@v4
       # .tool-versions will be read from repo root
       - run: node ./my_app.js
 ```
 
+## Cache Configuration
+
+You can customize the cache key used by the action:
+
+```yaml
+- uses: jdx/mise-action@v4
+  with:
+    cache_key: "my-custom-cache-key"  # Override the entire cache key
+    cache_key_prefix: "mise-v1"       # Or just change the prefix (default: "mise-v0")
+```
+
+### Template Variables in Cache Keys
+
+When using `cache_key`, you can use template variables to reference internal values:
+
+```yaml
+- uses: jdx/mise-action@v4
+  with:
+    cache_key: "mise-{{platform}}-{{version}}-{{file_hash}}"
+    version: "2026.3.10"
+    install_args: "node python"
+```
+
+Available template variables:
+- `{{version}}` - The mise version (from the `version` input)
+- `{{cache_key_prefix}}` - The cache key prefix (from `cache_key_prefix` input or default)
+- `{{platform}}` - The target platform, including the runner image (e.g., "linux-x64-ubuntu24", "macos-arm64-macos15", "linux-x64-self-hosted"). The trailing segment is `process.env.ImageOS` on github-hosted runners and falls back to `"self-hosted"` elsewhere — preventing cache collisions when the same repo runs on different runner providers (github-hosted, namespace.so, self-hosted).
+- `{{file_hash}}` - Hash of all mise configuration files
+- `{{mise_env}}` - The MISE_ENV environment variable value
+- `{{install_args_hash}}` - SHA256 hash of the sorted tools from install args
+- `{{default}}` - The processed default cache key (useful for extending)
+
+Conditional logic is also supported using Handlebars syntax like `{{#if version}}...{{/if}}`.
+
+Example using multiple variables:
+```yaml
+- uses: jdx/mise-action@v4
+  with:
+    cache_key: "mise-v1-{{platform}}-{{install_args_hash}}-{{file_hash}}"
+    install_args: "node@24 python@3.14"
+```
+
+You can also extend the default cache key:
+```yaml
+- uses: jdx/mise-action@v4
+  with:
+    cache_key: "{{default}}-custom-suffix"
+    install_args: "node@24 python@3.14"
+```
+
+This gives you full control over cache invalidation based on the specific aspects that matter to your workflow.
+
+## GitHub API Rate Limits
+
+When installing tools hosted on GitHub (like `gh`, `node`, `bun`, etc.), mise needs to make API calls to GitHub's releases API. Without authentication, these calls are subject to GitHub's rate limit of 60 requests per hour, which can cause installation failures.
+
+```yaml
+- uses: jdx/mise-action@v4
+  with:
+    github_token: ${{ secrets.GITHUB_TOKEN }}
+    # your other configuration
+```
+
+**Note:** The action automatically uses `${{ github.token }}` as the default, so in most cases you don't need to explicitly provide it. However, if you encounter rate limit errors, make sure the token is being passed correctly.
+
+## Alternative Installation
+
 Alternatively, mise is easy to use in GitHub Actions even without this:
 
 ```yaml
@@ -47,7 +116,7 @@ jobs:
   build:
     steps:
     - run: |
-        curl https://mise.jdx.dev/install.sh | sh
+        curl https://mise.run | sh
         echo "$HOME/.local/share/mise/bin" >> $GITHUB_PATH
         echo "$HOME/.local/share/mise/shims" >> $GITHUB_PATH
 ```

action.yml

@@ -8,6 +8,9 @@ inputs:
   version:
     required: false
     description: The version of mise to use. If not specified, will use the latest release.
+  sha256:
+    required: false
+    description: The SHA256 checksum of the mise binary to verify the download.
   mise_dir:
     required: false
     description: |
@@ -19,7 +22,7 @@ inputs:
     description: If present, this value will be written to the .tool-versions file
   mise_toml:
     required: false
-    description: If present, this value will be written to the .mise.toml file
+    description: If present, this value will be written to the mise.toml file
   install:
     required: false
     default: "true"
@@ -40,8 +43,15 @@ inputs:
     description: if false, action will not write to cache
   cache_key_prefix:
     required: false
-    default: "mise-v0"
+    default: "mise-v1"
     description: The prefix key to use for the cache, change this to invalidate the cache
+  cache_key:
+    required: false
+    description: |
+      Override the complete cache key (ignores all other cache key options).
+      Supports template variables: {{version}}, {{cache_key_prefix}}, {{platform}}, {{file_hash}}, 
+      {{mise_env}}, {{install_args_hash}}, {{default}}, {{env.VAR_NAME}} for environment variables, 
+      and conditional logic like {{#if version}}...{{/if}}
   experimental:
     required: false
     default: "false"
@@ -53,11 +63,61 @@ inputs:
   working_directory:
     required: false
     description: The directory that mise runs in
+  reshim:
+    required: false
+    default: "false"
+    description: if true, will run `mise reshim --all` after setting up mise
+  add_shims_to_path:
+    required: false
+    default: "true"
+    description: if false, will not add mise shims directory to PATH
+  github_token:
+    required: false
+    description: |
+      GitHub token for API authentication to avoid rate limits when installing GitHub-hosted tools.
+      Defaults to the automatic GitHub token.
+    default: ${{ github.token }}
+  fetch_from_github:
+    required: false
+    default: "true"
+    description: If true (default), fetch the mise binary from GitHub. If false and using the latest version, fetch from mise.jdx.dev instead.
+  env:
+    description: "Automatically load mise env vars into GITHUB_ENV. Note that PATH modifications are not part of this."
+    required: false
+    default: "true"
+  wings_enabled:
+    description: |
+      [experimental] Opt in to the mise-wings asset cache
+      (https://mise-wings.en.dev) for this action invocation.
+
+      When `true`, the action exports `MISE_WINGS_ENABLED=1` so
+      the installed mise binary routes tool-install URLs (npm
+      tarballs, GitHub release artifacts) through the per-org
+      wings cache subdomains.
+
+      Authentication is automatic via the runner's GitHub OIDC
+      identity — no `mise wings login` step, no long-lived
+      secret to rotate. The workflow must declare
+      `permissions: id-token: write` so the OIDC token-issuer
+      env vars are populated; without that, mise falls through
+      to direct-origin fetches transparently.
+
+      Default `false` is the conservative posture: a workflow
+      with `id-token: write` (used for SLSA / AWS-OIDC /
+      Sigstore / etc.) should not have its OIDC token sent to
+      a third-party cache without explicit opt-in. Older mise
+      binaries that don't speak wings ignore the env var
+      entirely, so this is forward-compatible.
+
+      Requires an active mise-wings subscription on the Clerk
+      org linked to the GitHub org running the workflow;
+      without one, the proxy 402s and mise leaves the cache
+      off without affecting the workflow's success.
+    required: false
+    default: "false"
 outputs:
   cache-hit:
     description: A boolean value to indicate if a cache was hit.
 runs:
-  using: node20
+  using: node24
   main: dist/index.js
-  post: dist/cache-save/index.js
-  post-if: success()

cliff.toml

@@ -54,9 +54,9 @@ body = """
 {% if commit.scope %}**({{commit.scope}})** {% endif -%}
 {% if commit.breaking %}**breaking** {% endif -%}
 {{ commit.message | split(pat="\n") | first | trim }} by \
-{% if commit.github.username %}[@{{commit.github.username}}](https://github.com/{{commit.github.username}})\
+{% if commit.remote.username %}[@{{commit.remote.username}}](https://github.com/{{commit.remote.username}})\
 {% else %}{{commit.author.name}}{% endif %} in \
-{% if commit.github.pr_number %}[#{{ commit.github.pr_number }}]($REPO/pull/{{ commit.github.pr_number }})\
+{% if commit.remote.pr_number %}[#{{ commit.remote.pr_number }}]($REPO/pull/{{ commit.remote.pr_number }})\
 {% else %}[{{ commit.id | truncate(length=7, end="") }}]($REPO/commit/{{ commit.id }})\
 {%- endif %}
 {% endmacro commit -%}
@@ -88,6 +88,7 @@ commit_preprocessors = [
 ]
 # regex for parsing and grouping commits
 commit_parsers = [
+    { message = '^\d+\.\d+\.\d+$', skip = true },
     { message = '^(chore|fix)\(deps.*\):', skip = true },
     { message = '^feat', group = "<!-- 0 -->🚀 Features" },
     { message = '^fix', group = "<!-- 1 -->🐛 Bug Fixes" },
@@ -99,6 +100,7 @@ commit_parsers = [
     { message = '^chore\(release\): prepare for', skip = true },
     { message = '^chore\(pr\)', skip = true },
     { message = '^chore\(pull\)', skip = true },
+    { message = '^chore: release v\d+\.\d+\.\d+', skip = true },
     { message = '^chore: Release mise-action', skip = true },
     { message = '^chore|^ci', group = "<!-- 7 -->⚙️ Miscellaneous Tasks" },
     { body = '.*security', group = "<!-- 8 -->🛡️ Security" },

eslint.config.mjs

@@ -0,0 +1,15 @@
+import globals from "globals";
+import pluginJs from "@eslint/js";
+import tseslint from "typescript-eslint";
+
+
+/** @type {import('eslint').Linter.Config[]} */
+export default [
+  {files: ["**/*.{js,mjs,cjs,ts}"]},
+  {languageOptions: { globals: globals.browser }},
+  pluginJs.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    ignores: ["dist"],
+  },
+];

mise.lock

@@ -0,0 +1,166 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html
+
+[[tools.aube]]
+version = "1.6.2"
+backend = "github:endevco/aube"
+
+[tools.aube."platforms.linux-arm64"]
+checksum = "sha256:1c47d2c0a50cf80f49aedcc2f58ce8abcbdf763092e772c8961c6e5b18916e8b"
+url = "https://github.com/endevco/aube/releases/download/v1.6.2/aube-v1.6.2-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/endevco/aube/releases/assets/410164231"
+provenance = "github-attestations"
+
+[tools.aube."platforms.linux-arm64-musl"]
+checksum = "sha256:9780776921db3a54fc3237f50b9686489d93115e26584c7a85d54ce96a8e9b39"
+url = "https://github.com/endevco/aube/releases/download/v1.6.2/aube-v1.6.2-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/endevco/aube/releases/assets/410164229"
+provenance = "github-attestations"
+
+[tools.aube."platforms.linux-x64"]
+checksum = "sha256:16fcc40dfbaac110ce8f4e88728a440f2366094a45fd6c189bcbcc2b3ea31f06"
+url = "https://github.com/endevco/aube/releases/download/v1.6.2/aube-v1.6.2-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/endevco/aube/releases/assets/410164107"
+provenance = "github-attestations"
+
+[tools.aube."platforms.linux-x64-musl"]
+checksum = "sha256:2ee3821fd62b56bb39cb2ceffe6ad38975e35f82311ca7f9ec6ee28bc6d284b8"
+url = "https://github.com/endevco/aube/releases/download/v1.6.2/aube-v1.6.2-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/endevco/aube/releases/assets/410164199"
+provenance = "github-attestations"
+
+[tools.aube."platforms.macos-arm64"]
+checksum = "sha256:4ce92482500f77f0779f288328cb7411f7ae2441b8618eae36a2ab5ea7591a32"
+url = "https://github.com/endevco/aube/releases/download/v1.6.2/aube-v1.6.2-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/endevco/aube/releases/assets/410166750"
+provenance = "github-attestations"
+
+[tools.aube."platforms.windows-x64"]
+checksum = "sha256:916594efae8f8b59fc898913f96d199a21d212c7037043853ee04df7264611d0"
+url = "https://github.com/endevco/aube/releases/download/v1.6.2/aube-v1.6.2-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/endevco/aube/releases/assets/410174742"
+provenance = "github-attestations"
+
+[[tools.communique]]
+version = "1.1.2"
+backend = "github:jdx/communique"
+
+[tools.communique."platforms.linux-arm64"]
+checksum = "sha256:7bb0843207fc3d7b5df2a5c0198bb10539cf13a6b247b4adfbf6b302a68f03de"
+url = "https://github.com/jdx/communique/releases/download/v1.1.2/communique-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/jdx/communique/releases/assets/405964161"
+
+[tools.communique."platforms.linux-arm64-musl"]
+checksum = "sha256:b663407be77a370c209df40307b82e436f56a6bc23d4e423510d62ac6e1fedf4"
+url = "https://github.com/jdx/communique/releases/download/v1.1.2/communique-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/jdx/communique/releases/assets/405964743"
+
+[tools.communique."platforms.linux-x64"]
+checksum = "sha256:5e74ead7037f42940c7dba4f6aa4ed968920cbb55a047aa0d291b0c675c65676"
+url = "https://github.com/jdx/communique/releases/download/v1.1.2/communique-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/jdx/communique/releases/assets/405963914"
+provenance = "github-attestations"
+
+[tools.communique."platforms.linux-x64-musl"]
+checksum = "sha256:01a6a8b49e635a5a209fdaf6c7b2e976374debc2db1c846c033f567fdba0d86c"
+url = "https://github.com/jdx/communique/releases/download/v1.1.2/communique-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/jdx/communique/releases/assets/405964691"
+
+[tools.communique."platforms.macos-arm64"]
+checksum = "sha256:459993e31a6c4ccbd09882f5679a2bc1ea5d9068701ecefc411a00fb69ce82e6"
+url = "https://github.com/jdx/communique/releases/download/v1.1.2/communique-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/jdx/communique/releases/assets/405964098"
+
+[tools.communique."platforms.windows-x64"]
+checksum = "sha256:3cc0e880ac2168aed3163223627bbd1eee62e07a9901cb85cb507c6c8927bc93"
+url = "https://github.com/jdx/communique/releases/download/v1.1.2/communique-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/jdx/communique/releases/assets/405964430"
+
+[[tools.gh]]
+version = "2.92.0"
+backend = "aqua:cli/cli"
+
+[tools.gh."platforms.linux-arm64"]
+checksum = "sha256:c2248526dd0160c08d3fccca2332c3c1a07c15a78b23978e77735f1b5a18cfee"
+url = "https://github.com/cli/cli/releases/download/v2.92.0/gh_2.92.0_linux_arm64.tar.gz"
+provenance = "github-attestations"
+
+[tools.gh."platforms.linux-arm64-musl"]
+checksum = "sha256:c2248526dd0160c08d3fccca2332c3c1a07c15a78b23978e77735f1b5a18cfee"
+url = "https://github.com/cli/cli/releases/download/v2.92.0/gh_2.92.0_linux_arm64.tar.gz"
+provenance = "github-attestations"
+
+[tools.gh."platforms.linux-x64"]
+checksum = "sha256:b57848131bdf0c229cd35e1f2a51aa718199858b2e728410b37e89a428943ec4"
+url = "https://github.com/cli/cli/releases/download/v2.92.0/gh_2.92.0_linux_amd64.tar.gz"
+provenance = "github-attestations"
+
+[tools.gh."platforms.linux-x64-musl"]
+checksum = "sha256:b57848131bdf0c229cd35e1f2a51aa718199858b2e728410b37e89a428943ec4"
+url = "https://github.com/cli/cli/releases/download/v2.92.0/gh_2.92.0_linux_amd64.tar.gz"
+provenance = "github-attestations"
+
+[tools.gh."platforms.macos-arm64"]
+checksum = "sha256:b11c54f6bd7d15ed6590475079e5b2fcf36f45d3991a80041b29c9d0cc1f1d07"
+url = "https://github.com/cli/cli/releases/download/v2.92.0/gh_2.92.0_macOS_arm64.zip"
+provenance = "github-attestations"
+
+[tools.gh."platforms.windows-x64"]
+checksum = "sha256:b6a8df3c8c6b9c80f290906387673bc4d272840f3789c5650e0e4e6e75522785"
+url = "https://github.com/cli/cli/releases/download/v2.92.0/gh_2.92.0_windows_amd64.zip"
+provenance = "github-attestations"
+
+[[tools.git-cliff]]
+version = "2.13.1"
+backend = "aqua:orhun/git-cliff"
+
+[tools.git-cliff."platforms.linux-arm64"]
+checksum = "sha256:4054c124b926c117f3fa048939bc8be0a954f29f3b6f367627e8cb22c1971882"
+url = "https://github.com/orhun/git-cliff/releases/download/v2.13.1/git-cliff-2.13.1-aarch64-unknown-linux-musl.tar.gz"
+
+[tools.git-cliff."platforms.linux-arm64-musl"]
+checksum = "sha256:4054c124b926c117f3fa048939bc8be0a954f29f3b6f367627e8cb22c1971882"
+url = "https://github.com/orhun/git-cliff/releases/download/v2.13.1/git-cliff-2.13.1-aarch64-unknown-linux-musl.tar.gz"
+
+[tools.git-cliff."platforms.linux-x64"]
+checksum = "sha256:200d2535da6d9703f3bcc8a4d159c3b55eacdb01cf2148c55b3eee9dd04d5249"
+url = "https://github.com/orhun/git-cliff/releases/download/v2.13.1/git-cliff-2.13.1-x86_64-unknown-linux-musl.tar.gz"
+
+[tools.git-cliff."platforms.linux-x64-musl"]
+checksum = "sha256:200d2535da6d9703f3bcc8a4d159c3b55eacdb01cf2148c55b3eee9dd04d5249"
+url = "https://github.com/orhun/git-cliff/releases/download/v2.13.1/git-cliff-2.13.1-x86_64-unknown-linux-musl.tar.gz"
+
+[tools.git-cliff."platforms.macos-arm64"]
+checksum = "sha256:21547ae4a0421164070ab75c2522864ea5565858a011fabc5f583061b20f1226"
+url = "https://github.com/orhun/git-cliff/releases/download/v2.13.1/git-cliff-2.13.1-aarch64-apple-darwin.tar.gz"
+
+[tools.git-cliff."platforms.windows-x64"]
+checksum = "sha256:3ae3a5549e85c7ad5b20192ebcfee4371269deca51255f6f2f2e051c6541f5ca"
+url = "https://github.com/orhun/git-cliff/releases/download/v2.13.1/git-cliff-2.13.1-x86_64-pc-windows-msvc.zip"
+
+[[tools.node]]
+version = "24.15.0"
+backend = "core:node"
+
+[tools.node."platforms.linux-arm64"]
+checksum = "sha256:73afc234d558c24919875f51c2d1ea002a2ada4ea6f83601a383869fefa64eed"
+url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-arm64.tar.gz"
+
+[tools.node."platforms.linux-arm64-musl"]
+checksum = "sha256:31e98aa960a067da91edffd5d93bc46657b5d2a8029612c359f5f2ac0060152a"
+url = "https://unofficial-builds.nodejs.org/download/release/v24.15.0/node-v24.15.0-linux-arm64-musl.tar.gz"
+
+[tools.node."platforms.linux-x64"]
+checksum = "sha256:44836872d9aec49f1e6b52a9a922872db9a2b02d235a616a5681b6a85fec8d89"
+url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-x64.tar.gz"
+
+[tools.node."platforms.linux-x64-musl"]
+checksum = "sha256:f55af5bd489c5347b113ca6594cae00a54b30ba57ac5875324311bfc6f4762e3"
+url = "https://unofficial-builds.nodejs.org/download/release/v24.15.0/node-v24.15.0-linux-x64-musl.tar.gz"
+
+[tools.node."platforms.macos-arm64"]
+checksum = "sha256:372331b969779ab5d15b949884fc6eaf88d5afe87bde8ba881d6400b9100ffc4"
+url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-darwin-arm64.tar.gz"
+
+[tools.node."platforms.windows-x64"]
+checksum = "sha256:cc5149eabd53779ce1e7bdc5401643622d0c7e6800ade18928a767e940bb0e62"
+url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-win-x64.zip"

mise.toml

@@ -1,6 +1,14 @@
-tasks.lint = "bun run lint"
+tasks.pre-commit = ["aubr all", "git add dist"]
-tasks."lint:fix" = "bun run format:write"
+tasks.test.alias = ["t"]
-tasks.version = "npm version"
+tasks.test.run = ["aubr all"]
+tasks.lint = "aubr lint"
+tasks."lint:fix" = "aubr format:write"
+tasks.version = "aube version"
+tasks.release-plz = "./scripts/release-plz.sh"
 
 [tools]
-node = '20.17.0'
+node = '24'
+aube = 'v1.9.1'
+git-cliff = 'latest'
+gh = 'latest'
+communique = 'latest'

package.json

@@ -1,8 +1,9 @@
 {
   "name": "mise-action",
   "description": "mise tool setup action",
-  "version": "2.1.0",
+  "version": "4.0.1",
   "author": "jdx",
+  "type": "module",
   "private": true,
   "repository": {
     "type": "git",
@@ -21,34 +22,46 @@
     "bundle": "npm run format:write && npm run package",
     "format:check": "prettier --check **/*.ts",
     "format:write": "prettier --write **/*.ts",
-    "lint": "npx eslint . && npm run format:check",
+    "lint": "eslint . && npm run format:check",
-    "package": "ncc build -s src/index.ts --license licenses.txt && ncc -s build src/cache-save.ts -o dist/cache-save/",
+    "package": "rimraf ./dist && rollup --config rollup.config.mjs",
     "package:watch": "npm run package -- --watch",
     "version": "./scripts/version.sh",
-    "postversion": "./scripts/postversion.sh",
     "prepare": "husky"
   },
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "^3.2.2",
+    "@actions/cache": "^6.0.0",
-    "@actions/core": "^1.10.1",
+    "@actions/core": "^3.0.0",
-    "@actions/exec": "^1.1.1",
+    "@actions/exec": "^3.0.0",
-    "@actions/glob": "^0.5.0",
+    "@actions/glob": "^0.7.0",
-    "typescript-eslint": "^8.7.0"
+    "@actions/io": "^3.0.0",
+    "@types/handlebars": "^4.0.40",
+    "handlebars": "^4.7.8"
   },
   "devDependencies": {
-    "@eslint/js": "^9.8.0",
+    "@eslint/eslintrc": "^3.2.0",
+    "@eslint/js": "^10.0.0",
+    "@rollup/plugin-commonjs": "^29.0.0",
+    "@rollup/plugin-json": "^6.1.0",
+    "@rollup/plugin-node-resolve": "^16.0.0",
+    "@rollup/plugin-typescript": "^12.0.0",
     "@types/eslint__js": "^8.42.3",
-    "@types/node": "^22.7.0",
+    "@types/node": "^24",
-    "@vercel/ncc": "^0.38.1",
+    "eslint": "^10.0.0",
-    "eslint-plugin-github": "^5.0.0",
+    "globals": "^17.0.0",
-    "eslint-plugin-jest": "^28.0.0",
+    "husky": "^9.1.7",
-    "eslint-plugin-jsonc": "^2.11.2",
+    "jest": "^30",
-    "eslint-plugin-prettier": "^5.1.2",
-    "husky": "^9.0.0",
-    "jest": "^29.7.0",
     "js-yaml": "^4.1.0",
-    "prettier": "^3.1.1",
+    "prettier": "^3.4.1",
-    "typescript": "^5.5.4"
+    "rimraf": "^6.0.0",
+    "rollup": "^4.0.0",
+    "rollup-plugin-license": "^3.7.1",
+    "typescript": "^6.0.0",
+    "typescript-eslint": "^8.16.0"
+  },
+  "aube": {
+    "allowBuilds": {
+      "unrs-resolver": false
+    }
   }
 }

rollup.config.mjs

@@ -0,0 +1,29 @@
+import commonjs from '@rollup/plugin-commonjs'
+import json from '@rollup/plugin-json'
+import nodeResolve from '@rollup/plugin-node-resolve'
+import typescript from '@rollup/plugin-typescript'
+import license from 'rollup-plugin-license'
+import path from 'path'
+
+const config = {
+  input: 'src/index.ts',
+  output: {
+    esModule: true,
+    file: 'dist/index.js',
+    format: 'es',
+    sourcemap: true
+  },
+  plugins: [
+    typescript(),
+    nodeResolve({ preferBuiltins: true }),
+    commonjs({ ignoreTryCatch: false }),
+    json(),
+    license({
+      thirdParty: {
+        output: path.resolve('dist', 'licenses.txt')
+      }
+    })
+  ]
+}
+
+export default config

scripts/postversion.sh

@@ -2,14 +2,35 @@
 set -euxo pipefail
 
 VERSION=$(jq -r .version package.json)
+MAJOR_VERSION=$(echo "$VERSION" | cut -d. -f1)
+
+# Configure git to use gh's credential helper. The checkout step uses
+# persist-credentials: false (per zizmor's artipacked audit), so the
+# token isn't written to .git/config and raw `git push` would 403.
+gh auth setup-git
+
+# create the version tag (allow it to fail if it already exists)
+git tag "v$VERSION" || echo "Tag v$VERSION already exists locally"
 
 # push changes to github
 git push
 # push the current tag to github
-git push origin "v$VERSION"
+git push origin "v$VERSION" || echo "Tag v$VERSION already exists on remote"
-# set the v1 tag to this release
+
-git tag v2 -f
+# set the major version tag to this release
-# push the v1 tag to github
+git tag "v$MAJOR_VERSION" -f
-git push origin v2 -f
+# push the major version tag to github (retry with pull if it fails)
-# create a release on github
+if ! git push origin "v$MAJOR_VERSION" -f; then
-gh release create "v$VERSION" --generate-notes --verify-tag
+  echo "Failed to push v$MAJOR_VERSION tag, pulling and retrying..."
+  git fetch origin "refs/tags/v$MAJOR_VERSION:refs/tags/v$MAJOR_VERSION" -f
+  git tag "v$MAJOR_VERSION" -f
+  git push origin "v$MAJOR_VERSION" -f
+fi
+
+# check if release already exists before creating
+if gh release view "v$VERSION" >/dev/null 2>&1; then
+  echo "Release v$VERSION already exists, skipping creation"
+else
+  # create a release on github
+  gh release create "v$VERSION" --generate-notes --verify-tag
+fi

scripts/release-plz.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# shellcheck shell=bash
+set -euxo pipefail
+
+# Get the current package.json version before any modifications
+cur_pkg_version="$(jq -r .version package.json)"
+
+# Get the latest GitHub release version
+latest_release="$(gh release view --json tagName --jq .tagName 2>/dev/null || echo "")"
+latest_release_version="${latest_release#v}"
+
+# Check if package.json version is newer than the latest release
+if [ -n "$latest_release_version" ] && [ "$cur_pkg_version" = "$latest_release_version" ]; then
+	echo "Package version $cur_pkg_version matches latest release $latest_release. Nothing to release."
+	# Still check if we need to create a new PR for unreleased changes
+
+	# Get the latest released version tag
+	latest_tag="$(git tag --list | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$' | sort -V | tail -1)"
+
+	# Check if there are commits since the last release
+	if [ -n "$latest_tag" ]; then
+		commits_since_release="$(git rev-list "$latest_tag"..HEAD --count)"
+		if [ "$commits_since_release" -eq 0 ]; then
+			echo "No commits since last release $latest_tag"
+			exit 0
+		fi
+		echo "Found $commits_since_release commits since $latest_tag"
+	fi
+
+	# Get the next version and changelog from git-cliff
+	version="$(git cliff --bumped-version)"
+	changelog="$(git cliff --bump --unreleased | tail -n +2)"
+
+	if [ "${DRY_RUN:-1}" == 1 ]; then
+		echo "version: $version"
+		echo "changelog: $changelog"
+		exit 0
+	fi
+
+	# Check if there are any unreleased changes
+	if [ -z "$changelog" ] || [ "$changelog" = "<!-- generated by git-cliff -->" ]; then
+		echo "No unreleased changes found"
+		exit 0
+	fi
+
+	# Configure git for automated commits
+	git config user.name mise-en-dev
+	git config user.email 123107610+mise-en-dev@users.noreply.github.com
+
+	# Configure git to use gh's credential helper. The checkout step uses
+	# persist-credentials: false (per zizmor's artipacked audit), so the
+	# token isn't written to .git/config and raw `git push` would 403.
+	gh auth setup-git
+
+	# Create a PR with the version bump
+	npm version "${version#v}" --no-git-tag-version
+
+	git add package.json package-lock.json
+	git status
+
+	# Create release branch and commit
+	git checkout -B release
+	git commit -m "chore: release $version"
+
+	# Push to release branch
+	git push origin release --force
+
+	# Create or update PR
+	if gh pr create --title "chore: release $version" --body "$changelog" --label "release"; then
+		echo "Created new release PR"
+	else
+		gh pr edit --title "chore: release $version" --body "$changelog"
+		echo "Updated existing release PR"
+	fi
+elif [ -n "$cur_pkg_version" ] && [ "$cur_pkg_version" != "$latest_release_version" ]; then
+	# Package version is different from latest release
+	echo "Package version v$cur_pkg_version is newer than latest release $latest_release."
+	echo "Release will be created by the release.yml workflow when the PR is merged."
+	# Exit successfully - the release.yml workflow handles actual release creation
+	exit 0
+else
+	echo "No action needed"
+	exit 0
+fi

scripts/test.sh

@@ -2,16 +2,20 @@
 set -euxo pipefail
 
 function assert_equal() {
-  if [ "$1" != "$2" ]; then
+	if [ "$1" != "$2" ]; then
-    echo "Assertion failed: Expected '$1', got '$2'" >&2
+		echo "Assertion failed: Expected '$1', got '$2'" >&2
-    return 1
+		return 1
-  fi
+	fi
 }
+EXPECTED_OUTPUT="jq-1.7.1"
 
-assert_equal "v22.0.0" "$(mise exec -- node --version)"
+assert_equal "$EXPECTED_OUTPUT" "$(mise exec -- jq --version)"
-which node
+which jq
 
 # windows bash does not seem to work with shims
 if [[ "$(uname)" != "MINGW"* ]]; then
-  assert_equal "v22.0.0" "$(node --version)"
+	assert_equal "$EXPECTED_OUTPUT" "$(jq --version)"
 fi
+
+# checking that environment variables set in mise.toml are properly set
+assert_equal "${MY_ENV_VAR}" "abc"

scripts/version.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
 set -euxo pipefail
 
-git cliff -o CHANGELOG.md --tag "${npm_package_version:?}"
+git cliff -o CHANGELOG.md --tag "v${npm_package_version:?}"
 git add CHANGELOG.md

src/cache-save.ts

@@ -1,40 +0,0 @@
-import * as cache from '@actions/cache'
-import * as core from '@actions/core'
-import * as fs from 'fs'
-import { miseDir } from './utils'
-
-export async function run(): Promise<void> {
-  try {
-    await cacheMiseTools()
-  } catch (error) {
-    if (error instanceof Error) core.setFailed(error.message)
-    else throw error
-  }
-}
-
-async function cacheMiseTools(): Promise<void> {
-  if (!core.getState('CACHE')) {
-    core.info('Skipping saving cache')
-    return
-  }
-
-  const state = core.getState('CACHE_KEY')
-  const primaryKey = core.getState('PRIMARY_KEY')
-  const cachePath = miseDir()
-
-  if (!fs.existsSync(cachePath)) {
-    throw new Error(`Cache folder path does not exist on disk: ${cachePath}`)
-  }
-
-  if (primaryKey === state) {
-    core.info(`Cache hit occurred on key ${primaryKey}, not saving cache.`)
-    return
-  }
-
-  const cacheId = await cache.saveCache([cachePath], primaryKey)
-  if (cacheId === -1) return
-
-  core.info(`Cache saved from ${cachePath} with key: ${primaryKey}`)
-}
-
-run()

src/index.ts

@@ -3,28 +3,94 @@ import * as io from '@actions/io'
 import * as core from '@actions/core'
 import * as exec from '@actions/exec'
 import * as glob from '@actions/glob'
+import * as crypto from 'crypto'
 import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
-import { miseDir } from './utils'
+import * as Handlebars from 'handlebars'
+
+// Configuration file patterns for cache key generation
+const MISE_CONFIG_FILE_PATTERNS = [
+  `**/.config/mise/config.toml`,
+  `**/.config/mise/config.lock`,
+  `**/.config/mise/config.*.toml`,
+  `**/.config/mise/config.*.lock`,
+  `**/.config/mise.toml`,
+  `**/.config/mise.lock`,
+  `**/.config/mise.*.toml`,
+  `**/.config/mise.*.lock`,
+  `**/.mise/config.toml`,
+  `**/.mise/config.lock`,
+  `**/.mise/config.*.toml`,
+  `**/.mise/config.*.lock`,
+  `**/mise/config.toml`,
+  `**/mise/config.lock`,
+  `**/mise/config.*.toml`,
+  `**/mise/config.*.lock`,
+  `**/.mise.toml`,
+  `**/.mise.lock`,
+  `**/.mise.*.toml`,
+  `**/.mise.*.lock`,
+  `**/mise.toml`,
+  `**/mise.lock`,
+  `**/mise.*.toml`,
+  `**/mise.*.lock`,
+  `**/.tool-versions`
+]
+
+// Default cache key template
+const DEFAULT_CACHE_KEY_TEMPLATE =
+  '{{cache_key_prefix}}-{{platform}}{{#if version}}-{{version}}{{/if}}{{#if mise_env}}-{{mise_env}}{{/if}}{{#if install_args_hash}}-{{install_args_hash}}{{/if}}-{{#if file_hash}}{{file_hash}}{{else}}no-config{{/if}}'
 
 async function run(): Promise<void> {
   try {
     await setToolVersions()
     await setMiseToml()
 
+    let cacheKey: string | undefined
     if (core.getBooleanInput('cache')) {
-      await restoreMiseCache()
+      cacheKey = await restoreMiseCache()
     } else {
       core.setOutput('cache-hit', false)
     }
 
+    // Wings opt-in hook (experimental). When
+    // `wings_enabled: true` is set, this exports
+    // `MISE_WINGS_ENABLED=1` so subsequent `mise install`
+    // commands in this workflow route through the wings
+    // cache. Default `false` so workflows with
+    // `id-token: write` (used for SLSA / AWS-OIDC / Sigstore /
+    // etc.) don't silently send the runner's OIDC token to
+    // a third-party cache without explicit consent.
+    //
+    // Note: `setupMise` fetches the mise binary itself with
+    // `curl`, which doesn't go through mise's HTTP layer —
+    // the wings rewriter only kicks in once the resulting
+    // mise binary runs `mise install` and friends. Ordering
+    // here is irrelevant for binary acceleration; we just
+    // want the env var set before any `mise` subcommand
+    // runs. Greptile + Gemini both flagged the previous
+    // comment as overstating what the early call accelerates.
+    setupWings()
+
     const version = core.getInput('version')
-    await setupMise(version)
+    const fetchFromGitHub = core.getBooleanInput('fetch_from_github')
+    await setupMise(version, fetchFromGitHub)
     await setEnvVars()
+    if (core.getBooleanInput('reshim')) {
+      await miseReshim()
+    }
     await testMise()
     if (core.getBooleanInput('install')) {
       await miseInstall()
+      if (cacheKey && core.getBooleanInput('cache_save')) {
+        await saveCache(cacheKey)
+      }
+    }
+    await miseLs()
+    const loadEnv = core.getBooleanInput('env')
+    if (loadEnv) {
+      await exportMiseEnv()
     }
   } catch (err) {
     if (err instanceof Error) core.setFailed(err.message)
@@ -32,6 +98,139 @@ async function run(): Promise<void> {
   }
 }
 
+/**
+ * Opt in to mise-wings caching for this workflow run. When
+ * `wings_enabled: true`, exports `MISE_WINGS_ENABLED=1` so
+ * subsequent `mise install` commands route through the
+ * cache.
+ *
+ * Mise itself owns the OIDC → wings session exchange — when
+ * it sees `MISE_WINGS_ENABLED=1` and the GHA OIDC env vars
+ * (`ACTIONS_ID_TOKEN_REQUEST_URL` +
+ * `ACTIONS_ID_TOKEN_REQUEST_TOKEN`), it fetches the runner's
+ * OIDC token, exchanges it at the proxy's `POST /auth`
+ * route, and caches the resulting session JWT for the rest
+ * of the process.
+ *
+ * Pre-flight check: `id-token: write` permission must be
+ * declared at the workflow or job level for the OIDC env
+ * vars to be present. We log a warning when wings is
+ * enabled but the env vars are absent — without this hint,
+ * the user sees a transparent "wings configured but doing
+ * nothing" which is hard to debug.
+ */
+function setupWings(): void {
+  if (!core.getBooleanInput('wings_enabled')) {
+    return
+  }
+  core.exportVariable('MISE_WINGS_ENABLED', '1')
+  core.info(
+    "mise-wings: enabled. mise will exchange the runner's OIDC token for a wings session on first use."
+  )
+
+  const oidcUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL
+  const oidcToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN
+  if (!oidcUrl || !oidcToken) {
+    core.warning(
+      'mise-wings: GHA OIDC env vars are missing. Add ' +
+        '`permissions: id-token: write` at the workflow or job ' +
+        'level so the runner can mint OIDC tokens. Without this, ' +
+        'mise falls through to direct-origin fetches and the cache ' +
+        'is bypassed.'
+    )
+  }
+}
+
+async function exportMiseEnv(): Promise<void> {
+  core.startGroup('Exporting mise environment variables')
+
+  const cwd = getCwd()
+
+  // Check if mise supports --redacted flags based on version input
+  const supportsRedacted = checkMiseSupportsRedacted()
+
+  if (supportsRedacted) {
+    try {
+      // First, get the redacted values to identify what needs masking
+      const redactedOutput = await exec.getExecOutput(
+        'mise',
+        ['env', '--redacted', '--json'],
+        { silent: true, cwd }
+      )
+      const redactedVars = JSON.parse(redactedOutput.stdout)
+
+      // Mask sensitive values in GitHub Actions
+      for (const [key, actualValue] of Object.entries(redactedVars)) {
+        core.setSecret(actualValue as string)
+        core.info(`Masked sensitive value for: ${key}`)
+      }
+
+      // Then get the actual values
+      const actualOutput = await exec.getExecOutput('mise', ['env', '--json'], {
+        cwd
+      })
+      const actualVars = JSON.parse(actualOutput.stdout)
+
+      // Export all environment variables
+      for (const [key, value] of Object.entries(actualVars)) {
+        if (typeof value === 'string') {
+          core.exportVariable(key, value)
+        }
+      }
+    } catch {
+      // Fall back to dotenv format if the redacted command fails
+      core.info('Falling back to dotenv format')
+      const output = await exec.getExecOutput('mise', ['env', '--dotenv'], {
+        cwd
+      })
+      fs.appendFileSync(process.env.GITHUB_ENV!, output.stdout)
+    }
+  } else {
+    // Fall back to the old --dotenv format for older versions
+    const output = await exec.getExecOutput('mise', ['env', '--dotenv'], {
+      cwd
+    })
+    fs.appendFileSync(process.env.GITHUB_ENV!, output.stdout)
+  }
+
+  core.endGroup()
+}
+
+function cleanVersion(version: string) {
+  // remove 'v' prefix if present
+  return version.replace(/^v/, '')
+}
+
+function checkMiseSupportsRedacted(): boolean {
+  const version = core.getInput('version')
+
+  // If no version is specified, assume latest which supports redacted
+  if (!version) {
+    return true
+  }
+
+  const versionMatch = cleanVersion(version).match(/^(\d+)\.(\d+)\.(\d+)/)
+
+  if (!versionMatch) {
+    // If we can't parse the version, assume it supports redacted
+    return true
+  }
+
+  const [, year, month, patch] = versionMatch
+  const yearNum = parseInt(year, 10)
+  const monthNum = parseInt(month, 10)
+  const patchNum = parseInt(patch, 10)
+
+  // Check if version is >= 2025.8.17
+  if (yearNum > 2025) return true
+  if (yearNum === 2025) {
+    if (monthNum > 8) return true
+    if (monthNum === 8 && patchNum >= 17) return true
+  }
+
+  return false
+}
+
 async function setEnvVars(): Promise<void> {
   core.startGroup('Setting env vars')
   const set = (k: string, v: string): void => {
@@ -40,40 +239,40 @@ async function setEnvVars(): Promise<void> {
       core.exportVariable(k, v)
     }
   }
-  if (getExperimental()) set('MISE_EXPERIMENTAL', '1')
+  if (core.getBooleanInput('experimental')) set('MISE_EXPERIMENTAL', '1')
-  set('MISE_LOG_LEVEL', core.getInput('log_level') || 'info')
+
+  const logLevel = core.getInput('log_level')
+  if (logLevel) set('MISE_LOG_LEVEL', logLevel)
+
+  const githubToken = core.getInput('github_token')
+  if (githubToken) {
+    // Don't use GITHUB_TOKEN, use MISE_GITHUB_TOKEN instead to avoid downstream issues.
+    set('MISE_GITHUB_TOKEN', githubToken)
+  } else {
+    core.warning(
+      'No MISE_GITHUB_TOKEN provided. You may hit GitHub API rate limits when installing tools from GitHub.'
+    )
+  }
+
   set('MISE_TRUSTED_CONFIG_PATHS', process.cwd())
   set('MISE_YES', '1')
 
-  const shimsDir = path.join(miseDir(), 'shims')
+  if (core.getBooleanInput('add_shims_to_path')) {
-  core.info(`Adding ${shimsDir} to PATH`)
+    const shimsDir = path.join(miseDir(), 'shims')
-  core.addPath(shimsDir)
+    core.info(`Adding ${shimsDir} to PATH`)
+    core.addPath(shimsDir)
+  }
 }
 
-async function restoreMiseCache(): Promise<void> {
+async function restoreMiseCache(): Promise<string | undefined> {
   core.startGroup('Restoring mise cache')
   const cachePath = miseDir()
-  const fileHash = await glob.hashFiles(
-    [
-      `**/.config/mise/config.toml`,
-      `**/.config/mise/config.*.toml`,
-      `**/.config/mise.toml`,
-      `**/.config/mise.*.toml`,
-      `**/.mise/config.toml`,
-      `**/.mise/config.*.toml`,
-      `**/mise/config.toml`,
-      `**/mise/config.*.toml`,
-      `**/.mise.toml`,
-      `**/.mise.*.toml`,
-      `**/mise.toml`,
-      `**/mise.*.toml`,
-      `**/.tool-versions`
-    ].join('\n')
-  )
-  const prefix = core.getInput('cache_key_prefix') || 'mise-v0'
-  const primaryKey = `${prefix}-${getOS()}-${os.arch()}-${fileHash}`
 
-  core.saveState('CACHE', core.getBooleanInput('cache_save') ?? true)
+  // Use custom cache key if provided, otherwise use default template
+  const cacheKeyTemplate =
+    core.getInput('cache_key') || DEFAULT_CACHE_KEY_TEMPLATE
+  const primaryKey = await processCacheKeyTemplate(cacheKeyTemplate)
+
   core.saveState('PRIMARY_KEY', primaryKey)
   core.saveState('MISE_DIR', cachePath)
 
@@ -82,39 +281,198 @@ async function restoreMiseCache(): Promise<void> {
 
   if (!cacheKey) {
     core.info(`mise cache not found for ${primaryKey}`)
-    return
+    return primaryKey
   }
 
-  core.saveState('CACHE_KEY', cacheKey)
   core.info(`mise cache restored from key: ${cacheKey}`)
 }
 
-async function setupMise(version: string | undefined): Promise<void> {
+async function setupMise(
-  core.startGroup(version ? `Setup mise@${version}` : 'Setup mise')
+  version: string,
+  fetchFromGitHub = false
+): Promise<void> {
   const miseBinDir = path.join(miseDir(), 'bin')
-  await fs.promises.mkdir(miseBinDir, { recursive: true })
+  const miseBinPath = path.join(
-  const url = version
+    miseBinDir,
-    ? `https://mise.jdx.dev/v${version}/mise-v${version}-${getOS()}-${os.arch()}`
+    process.platform === 'win32' ? 'mise.exe' : 'mise'
-    : `https://mise.jdx.dev/mise-latest-${getOS()}-${os.arch()}`
+  )
-  if (getOS() === 'windows') {
+  const miseShimPath = path.join(miseBinDir, 'mise-shim.exe')
-    const zipPath = path.join(os.tmpdir(), 'mise.zip')
+  let installedVersion: string | undefined
-    await exec.exec('curl', ['-fsSL', `${url}.zip`, '--output', zipPath])
+  if (!fs.existsSync(path.join(miseBinPath))) {
-    await exec.exec('unzip', [zipPath, '-d', os.tmpdir()])
+    core.startGroup(version ? `Download mise@${version}` : 'Setup mise')
-    await io.mv(
+    await fs.promises.mkdir(miseBinDir, { recursive: true })
-      path.join(os.tmpdir(), 'mise/bin/mise.exe'),
+    const ext =
-      path.join(miseBinDir, 'mise.exe')
+      process.platform === 'win32'
-    )
+        ? '.zip'
+        : version && version.startsWith('2024')
+          ? ''
+          : (await zstdInstalled())
+            ? '.tar.zst'
+            : '.tar.gz'
+    let resolvedVersion = version || (await latestMiseVersion())
+    resolvedVersion = resolvedVersion.replace(/^v/, '')
+    let url: string
+    if (!fetchFromGitHub && !version) {
+      // Only for latest version
+      url = `https://mise.jdx.dev/mise-latest-${await getTarget()}${ext}`
+    } else {
+      url = `https://github.com/jdx/mise/releases/download/v${resolvedVersion}/mise-v${resolvedVersion}-${await getTarget()}${ext}`
+    }
+    installedVersion = resolvedVersion
+    switch (ext) {
+      case '.zip': {
+        await withExtractedZip(url, 'mise.zip', async extractDir => {
+          const extractedMiseBinDir = path.join(extractDir, 'mise', 'bin')
+          await io.mv(path.join(extractedMiseBinDir, 'mise.exe'), miseBinPath)
+          await installWindowsMiseShim(extractedMiseBinDir, miseShimPath)
+        })
+        break
+      }
+      case '.tar.zst':
+        await exec.exec('sh', [
+          '-c',
+          `curl -fsSL ${url} | tar --zstd -xf - -C ${os.tmpdir()} && mv ${os.tmpdir()}/mise/bin/mise ${miseBinPath}`
+        ])
+        break
+      case '.tar.gz':
+        await exec.exec('sh', [
+          '-c',
+          `curl -fsSL ${url} | tar -xzf - -C ${os.tmpdir()} && mv ${os.tmpdir()}/mise/bin/mise ${miseBinPath}`
+        ])
+        break
+      default:
+        await exec.exec('sh', ['-c', `curl -fsSL ${url} > ${miseBinPath}`])
+        await exec.exec('chmod', ['+x', miseBinPath])
+        break
+    }
   } else {
-    const output = path.join(miseBinDir, 'mise')
+    const requestedVersion = cleanVersion(core.getInput('version'))
-    await exec.exec('curl', ['-fsSL', url, '--output', output])
+    if (requestedVersion !== '') {
-    await exec.exec('chmod', ['+x', path.join(miseBinDir, 'mise')])
+      installedVersion = await getInstalledMiseVersion(miseBinPath)
+      if (requestedVersion === installedVersion) {
+        core.info(`mise already installed`)
+      } else {
+        core.info(
+          `mise already installed (${installedVersion}), but different version requested (${requestedVersion})`
+        )
+        await exec.exec(miseBinPath, ['self-update', requestedVersion, '-y'])
+        core.info(`mise updated to version ${requestedVersion}`)
+        installedVersion = requestedVersion
+      }
+    }
   }
+  await ensureWindowsMiseShim(miseBinPath, miseShimPath, installedVersion)
+  // compare with provided hash
+  const want = core.getInput('sha256')
+  if (want) {
+    const hash = crypto.createHash('sha256')
+    const fileBuffer = await fs.promises.readFile(miseBinPath)
+    const got = hash.update(fileBuffer).digest('hex')
+    if (got !== want) {
+      throw new Error(
+        `SHA256 mismatch: expected ${want}, got ${got} for ${miseBinPath}`
+      )
+    }
+  }
+
   core.addPath(miseBinDir)
 }
 
-function getExperimental(): boolean {
+async function withExtractedZip(
-  const experimentalString = core.getInput('experimental')
+  url: string,
-  return experimentalString === 'true'
+  archiveName: string,
+  fn: (extractDir: string) => Promise<void>
+): Promise<void> {
+  const tempDir = await fs.promises.mkdtemp(
+    path.join(os.tmpdir(), 'mise-action-')
+  )
+  try {
+    const archivePath = path.join(tempDir, archiveName)
+    const extractDir = path.join(tempDir, 'extract')
+
+    await exec.exec('curl', ['-fsSL', url, '--output', archivePath])
+    await exec.exec('unzip', [archivePath, '-d', extractDir])
+    await fn(extractDir)
+  } finally {
+    await io.rmRF(tempDir)
+  }
+}
+
+async function installWindowsMiseShim(
+  extractedMiseBinDir: string,
+  miseShimPath: string
+): Promise<void> {
+  if (process.platform !== 'win32') return
+
+  const extractedMiseShimPath = path.join(extractedMiseBinDir, 'mise-shim.exe')
+  if (!fs.existsSync(extractedMiseShimPath)) {
+    core.info('mise-shim.exe not found in the mise archive; skipping')
+    return
+  }
+
+  await io.mv(extractedMiseShimPath, miseShimPath)
+}
+
+async function ensureWindowsMiseShim(
+  miseBinPath: string,
+  miseShimPath: string,
+  version?: string
+): Promise<void> {
+  if (process.platform !== 'win32') return
+  if (fs.existsSync(miseShimPath)) return
+
+  core.info(
+    'mise-shim.exe not found next to mise.exe; installing it from the matching release archive'
+  )
+
+  try {
+    const installedVersion =
+      version || (await getInstalledMiseVersion(miseBinPath))
+    const archiveName = `mise-v${installedVersion}-${await getTarget()}.zip`
+    const url = `https://github.com/jdx/mise/releases/download/v${installedVersion}/${archiveName}`
+
+    await withExtractedZip(url, archiveName, async extractDir => {
+      await installWindowsMiseShim(
+        path.join(extractDir, 'mise', 'bin'),
+        miseShimPath
+      )
+    })
+  } catch (err) {
+    core.warning(
+      `Failed to install mise-shim.exe: ${errorMessage(err)}. Continuing because mise can fall back to file shim mode on Windows.`
+    )
+  }
+}
+
+async function getInstalledMiseVersion(miseBinPath: string): Promise<string> {
+  const versionOutput = await exec.getExecOutput(
+    miseBinPath,
+    ['version', '--json'],
+    { silent: true }
+  )
+  const versionJson = JSON.parse(versionOutput.stdout) as { version: string }
+  return cleanVersion(versionJson.version.split(' ')[0])
+}
+
+function errorMessage(err: unknown): string {
+  return err instanceof Error ? err.message : String(err)
+}
+
+async function zstdInstalled(): Promise<boolean> {
+  try {
+    await exec.exec('zstd', ['--version'])
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function latestMiseVersion(): Promise<string> {
+  const rsp = await exec.getExecOutput('curl', [
+    '-fsSL',
+    'https://mise.jdx.dev/VERSION'
+  ])
+  return rsp.stdout.trim()
 }
 
 async function setToolVersions(): Promise<void> {
@@ -131,37 +489,161 @@ async function setMiseToml(): Promise<void> {
   }
 }
 
-function getOS(): string {
-  switch (process.platform) {
-    case 'darwin':
-      return 'macos'
-    case 'win32':
-      return 'windows'
-    default:
-      return process.platform
-  }
-}
-
 const testMise = async (): Promise<number> => mise(['--version'])
 const miseInstall = async (): Promise<number> =>
   mise([`install ${core.getInput('install_args')}`])
+const miseLs = async (): Promise<number> => mise([`ls`])
+const miseReshim = async (): Promise<number> => mise([`reshim`, `-f`])
 const mise = async (args: string[]): Promise<number> =>
-  core.group(`Running mise ${args.join(' ')}`, async () => {
+  await core.group(`Running mise ${args.join(' ')}`, async () => {
-    const cwd =
+    const cwd = getCwd()
-      core.getInput('working_directory') ||
+    const baseEnv = Object.fromEntries(
-      core.getInput('install_dir') ||
+      Object.entries(process.env).filter(
-      process.cwd()
+        (entry): entry is [string, string] => entry[1] !== undefined
+      )
+    )
+    const env = core.isDebug()
+      ? { ...baseEnv, MISE_LOG_LEVEL: 'debug' }
+      : baseEnv
+
     if (args.length === 1) {
-      return exec.exec(`mise ${args}`, [], { cwd })
+      return exec.exec(`mise ${args}`, [], {
+        cwd,
+        env
+      })
     } else {
-      return exec.exec('mise', args, { cwd })
+      return exec.exec('mise', args, { cwd, env })
     }
   })
 
 const writeFile = async (p: fs.PathLike, body: string): Promise<void> =>
-  core.group(`Writing ${p}`, async () => {
+  await core.group(`Writing ${p}`, async () => {
     core.info(`Body:\n${body}`)
     await fs.promises.writeFile(p, body, { encoding: 'utf8' })
   })
 
 run()
+
+function getCwd(): string {
+  return (
+    core.getInput('working_directory') ||
+    core.getInput('install_dir') ||
+    process.cwd()
+  )
+}
+
+function miseDir(): string {
+  const dir = core.getState('MISE_DIR')
+  if (dir) return dir
+
+  const miseDir = core.getInput('mise_dir')
+  if (miseDir) return miseDir
+
+  const { MISE_DATA_DIR, XDG_DATA_HOME, LOCALAPPDATA } = process.env
+  if (MISE_DATA_DIR) return MISE_DATA_DIR
+  if (XDG_DATA_HOME) return path.join(XDG_DATA_HOME, 'mise')
+  if (process.platform === 'win32' && LOCALAPPDATA)
+    return path.join(LOCALAPPDATA, 'mise')
+
+  return path.join(os.homedir(), '.local', 'share', 'mise')
+}
+
+async function saveCache(cacheKey: string): Promise<void> {
+  await core.group(`Saving mise cache`, async () => {
+    const cachePath = miseDir()
+
+    if (!fs.existsSync(cachePath)) {
+      throw new Error(`Cache folder path does not exist on disk: ${cachePath}`)
+    }
+
+    const cacheId = await cache.saveCache([cachePath], cacheKey)
+    if (cacheId === -1) return
+
+    core.info(`Cache saved from ${cachePath} with key: ${cacheKey}`)
+  })
+}
+
+async function getTarget(): Promise<string> {
+  const arch = process.arch === 'arm' ? 'armv7' : process.arch
+  switch (process.platform) {
+    case 'darwin':
+      return `macos-${arch}`
+    case 'win32':
+      return `windows-${arch}`
+    case 'linux':
+      return `linux-${arch}${(await isMusl()) ? '-musl' : ''}`
+    default:
+      throw new Error(`Unsupported platform ${process.platform}`)
+  }
+}
+
+/**
+ * Identifies the runner image so cached binaries from one provider
+ * (github-hosted, namespace.so, BuildJet, self-hosted) aren't restored
+ * onto another provider's image where their compiled-in paths and libc
+ * versions don't match. GitHub-hosted images export `ImageOS`
+ * (e.g. "macos15", "ubuntu24"); other runners leave it unset and pool
+ * under "self-hosted".
+ */
+function getRunnerImageId(): string {
+  return process.env.ImageOS || 'self-hosted'
+}
+
+async function processCacheKeyTemplate(template: string): Promise<string> {
+  // Get all available variables
+  const version = core.getInput('version')
+  const installArgs = core.getInput('install_args')
+  const cacheKeyPrefix = core.getInput('cache_key_prefix') || 'mise-v1'
+  const miseEnv = process.env.MISE_ENV?.replace(/,/g, '-')
+  const platform = `${await getTarget()}-${getRunnerImageId()}`
+
+  // Calculate file hash
+  const fileHash = await glob.hashFiles(MISE_CONFIG_FILE_PATTERNS.join('\n'))
+
+  // Calculate install args hash
+  let installArgsHash = ''
+  if (installArgs) {
+    const tools = installArgs
+      .split(' ')
+      .filter(arg => !arg.startsWith('-'))
+      .sort()
+      .join(' ')
+    if (tools) {
+      installArgsHash = crypto.createHash('sha256').update(tools).digest('hex')
+    }
+  }
+
+  // Prepare base template data
+  const baseTemplateData = {
+    version,
+    cache_key_prefix: cacheKeyPrefix,
+    platform,
+    file_hash: fileHash,
+    mise_env: miseEnv,
+    install_args_hash: installArgsHash
+  }
+
+  // Calculate the default cache key by processing the default template
+  const defaultTemplate = Handlebars.compile(DEFAULT_CACHE_KEY_TEMPLATE)
+  const defaultCacheKey = defaultTemplate(baseTemplateData)
+
+  // Prepare final template data including the default cache key and env variables
+  const templateData = {
+    ...baseTemplateData,
+    default: defaultCacheKey,
+    env: process.env
+  }
+
+  // Compile and execute the user's template
+  const compiledTemplate = Handlebars.compile(template)
+  return compiledTemplate(templateData)
+}
+
+async function isMusl() {
+  // `ldd --version` always returns 1 and print to stderr
+  const { stderr } = await exec.getExecOutput('ldd', ['--version'], {
+    failOnStdErr: false,
+    ignoreReturnCode: true
+  })
+  return stderr.indexOf('musl') > -1
+}

src/utils.ts

@@ -1,16 +0,0 @@
-import * as core from '@actions/core'
-import * as os from 'os'
-import * as path from 'path'
-
-export function miseDir(): string {
-  const dir = core.getState('MISE_DIR')
-  if (dir) return dir
-
-  const { MISE_DATA_DIR, XDG_DATA_HOME, LOCALAPPDATA } = process.env
-  if (MISE_DATA_DIR) return MISE_DATA_DIR
-  if (XDG_DATA_HOME) return path.join(XDG_DATA_HOME, 'mise')
-  if (process.platform === 'win32' && LOCALAPPDATA)
-    return path.join(LOCALAPPDATA, 'mise')
-
-  return path.join(os.homedir(), '.local', 'share', 'mise')
-}

tsconfig.json

@@ -13,7 +13,9 @@
     "forceConsistentCasingInFileNames": true,
     "strict": true,
     "skipLibCheck": true,
-    "newLine": "lf"
+    "newLine": "lf",
+    "isolatedModules": true,
+    "allowSyntheticDefaultImports": true
   },
   "exclude": ["./dist", "./node_modules", "./__tests__", "./coverage"]
 }