No description
Find a file
renovate[bot] 396ce9daa2
chore(deps): update dependency aube to v1.5.1 (#463)
This PR contains the following updates:

| Package | Update | Change | Pending |
|---|---|---|---|
| [aube](https://redirect.github.com/endevco/aube) | minor | `1.4` →
`v1.5.1` | `v1.9.1` (+6) |

---

### Release Notes

<details>
<summary>endevco/aube (aube)</summary>

###
[`v1.5.1`](https://redirect.github.com/endevco/aube/releases/tag/v1.5.1):
: POSIX colon tarball filenames

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.5.0...v1.5.1)

A small patch release fixing tarball installs that contain `:` in entry
filenames on POSIX platforms (e.g. `redos-detector@6.1.4`'s
`dist/__mocks__/package-json:version.d.ts`).

#### Fixed

- **POSIX colon tarball filenames** — the store tarball validator and
the linker's `validate_index_key` previously rejected `:` on every
platform to defend against Windows drive-prefix and NTFS
alternate-data-stream ambiguity. That guard was too broad for POSIX,
where colon is a valid filename character, and caused installs of
packages like `redos-detector@6.1.4` to fail. Both guards are now
platform-gated: `:` is still rejected on Windows, but accepted on Linux
and macOS.
([#&#8203;386](https://redirect.github.com/endevco/aube/pull/386) by
[@&#8203;jdx](https://redirect.github.com/jdx))

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.5.0...v1.5.1>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

###
[`v1.5.0`](https://redirect.github.com/endevco/aube/releases/tag/v1.5.0):
: Dependency graph queries and patch/lockfile fixes

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.4.0...v1.5.0)

This release adds `aube query` for selector-based dependency graph
inspection, fixes patch application against CRLF tarball files, repairs
npm-aliased catalog dependencies in pnpm-generated lockfiles, and
unifies how aube decides where to write workspace settings.

#### Added

- **`aube query`** — a vlt-inspired dependency-graph query command.
Supply a selector expression (attribute predicates plus pseudo-selectors
like `:scripts`, `:bin`, `:peer`, `:type(...)`, `:license(...)`),
optionally scope with workspace `--filter`/`--prod`/`--dev` roots, and
emit human-readable, `--parseable`, or `--json` output. Reads only the
local lockfile.
([#&#8203;380](https://redirect.github.com/endevco/aube/pull/380) by
[@&#8203;jdx](https://redirect.github.com/jdx))

#### Fixed

- **Patches against CRLF text files** — tarballs published from Windows
editors (e.g. `gifuct-js@2.1.2/index.d.ts`) ship CRLF, but
git/pnpm-style patches always emit LF, and diffy refused to match LF
hunks against CRLF context. aube now normalizes the original to LF
before applying and restores CRLF on write — matching pnpm's approach —
with a `\r\r\n` collapse so a literal `\r` byte mid-line doesn't gain a
second carriage return.
([#&#8203;384](https://redirect.github.com/endevco/aube/pull/384) by
[@&#8203;jdx](https://redirect.github.com/jdx))
- **`aube patch-commit` destination** — previously wrote unconditionally
to `pnpm.patchedDependencies` in `package.json` even on projects already
using the pnpm v10+ workspace-yaml home. A single rule now applies to
every command that mutates a setting which can live in either the
workspace yaml or `package.json#{pnpm,aube}.<key>`:

  1. If a workspace yaml exists on disk → write there.
2. Otherwise, if `package.json#pnpm` is already declared → write
`pnpm.<key>` (preserve the user's namespace).
  3. Otherwise → write `aube.<key>`.

`aube patch-remove` now strips entries from every place they could live
and reports the files actually rewritten. The same rule covers `aube
approve-builds` and install-time auto-deny seeding.
([#&#8203;384](https://redirect.github.com/endevco/aube/pull/384) by
[@&#8203;jdx](https://redirect.github.com/jdx))
- **npm-aliased catalog deps from pnpm lockfiles** — `aube install
--frozen-lockfile` previously accepted a pnpm lockfile with `beamcoder:
npm:beamcoder-prebuild@…` declared via `pnpm-workspace.yaml#catalog` and
silently produced an empty `node_modules`, because the importer's
specifier was `'catalog:'` and alias detection only fired on
`specifier.starts_with("npm:")`. Aliases are now detected purely from
the canonical `<real>@&#8203;<resolved>` `version:` shape, with a
peer-suffix strip so `version: 18.2.0(react@18.2.0)` isn't
misclassified.
([#&#8203;384](https://redirect.github.com/endevco/aube/pull/384) by
[@&#8203;jdx](https://redirect.github.com/jdx))
- **Bounded resolver stream** — the resolved-package stream is now a
bounded Tokio channel sized from the same network concurrency used by
fetch workers, with awaited sends so resolver/fetch overlap applies
backpressure instead of accumulating an unbounded queue.
([#&#8203;377](https://redirect.github.com/endevco/aube/pull/377) by
[@&#8203;jdx](https://redirect.github.com/jdx))

#### Changed

- **`aube-workspace.yaml` is the default-write filename** — when neither
`aube-workspace.yaml` nor `pnpm-workspace.yaml` exists, `aube
approve-builds` (and the install-time auto-seed of unreviewed build
scripts) now creates `aube-workspace.yaml` so it pairs with
`aube-lock.yaml` instead of leaving mixed vendor namespaces side by
side. Existing `pnpm-workspace.yaml` files keep being mutated in place.
([#&#8203;382](https://redirect.github.com/endevco/aube/pull/382) by
[@&#8203;jdx](https://redirect.github.com/jdx))
- **Comment-preserving workspace-yaml writes** — yaml writes now skip
the rewrite when the closure produces no structural change, so user
comments survive every no-op update to `allowBuilds`,
`patchedDependencies`, and catalog cleanup.
([#&#8203;384](https://redirect.github.com/endevco/aube/pull/384) by
[@&#8203;jdx](https://redirect.github.com/jdx))
- **Install phase timing sink** — set `AUBE_BENCH_PHASES_FILE` to append
per-phase install timings (resolve/fetch/link/scripts/state/sweep) as
JSONL, optionally tagged with `AUBE_BENCH_SCENARIO`. The benchmark
harness samples aube install-shaped scenarios and
`benchmarks/generate-phase-results.mjs` turns the JSONL into a Markdown
table plus a structured JSON artifact.
([#&#8203;381](https://redirect.github.com/endevco/aube/pull/381) by
[@&#8203;jdx](https://redirect.github.com/jdx))

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.4.0...v1.5.0>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/Chicago)

- Branch creation
  - Only on Friday (`* * * * 5`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/jdx/mise-action).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-05-08 05:30:45 +00:00
.github chore(deps): update github/codeql-action digest to 68bde55 (#462) 2026-05-08 05:29:48 +00:00
.husky fix: run npm install in pre-commit hook before build (#410) 2026-03-22 10:54:05 -05:00
dist fix(deps): update dependency @actions/glob to ^0.7.0 (#458) 2026-05-01 13:21:24 +00:00
scripts chore: remove duplicate release-plz logic 2025-08-18 11:57:51 -05:00
src fix: include runner image in cache key to prevent cross-provider collisions (#456) 2026-04-30 09:15:04 -05:00
.eslintrc.yml feat: support windows (#122) 2024-09-25 21:27:52 +00:00
.gitattributes updated action template base from actions/typescript-action (#170) 2023-10-16 19:18:57 -05:00
.gitignore chore: migrate package manager from npm/pnpm/bun to aube (#455) 2026-04-29 09:13:34 -05:00
.npmrc chore: migrate package manager from npm/pnpm/bun to aube (#455) 2026-04-29 09:13:34 -05:00
.prettierignore updated action template base from actions/typescript-action (#170) 2023-10-16 19:18:57 -05:00
.prettierrc.json updated action template base from actions/typescript-action (#170) 2023-10-16 19:18:57 -05:00
action.yml feat: add wings_enabled input (mise-wings cache integration) (#454) 2026-04-29 09:36:39 -05:00
CHANGELOG.md chore: release v4.0.1 (#406) 2026-03-22 16:06:38 +00:00
CLAUDE.md chore: migrate package manager from npm/pnpm/bun to aube (#455) 2026-04-29 09:13:34 -05:00
cliff.toml docs: hide release entries in CHANGELOG 2025-08-18 11:50:35 -05:00
CODEOWNERS jdxcode -> jdx 2023-08-27 12:12:44 -05:00
eslint.config.mjs chore: updated deps 2024-11-27 18:10:51 -06:00
LICENSE Initial commit 2023-01-14 08:11:40 -06:00
mise.lock chore(deps): update dependency aube to v1.5.1 (#463) 2026-05-08 05:30:45 +00:00
mise.toml chore(deps): update dependency aube to v1.5.1 (#463) 2026-05-08 05:30:45 +00:00
package-lock.json chore(deps): update dependency @types/handlebars to v4.1.0 (#457) 2026-05-01 09:46:35 -05:00
package.json chore(deps): update dependency aube to v1.5.1 (#463) 2026-05-08 05:30:45 +00:00
README.md fix: include runner image in cache key to prevent cross-provider collisions (#456) 2026-04-30 09:15:04 -05:00
rollup.config.mjs chore: migrate package manager from npm/pnpm/bun to aube (#455) 2026-04-29 09:13:34 -05:00
tsconfig.json chore: migrate from ncc (CJS) to rollup (ESM) (#436) 2026-04-11 12:55:09 -05:00

Example Workflow

name: test
on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: jdx/mise-action@v4
        with:
          version: 2026.3.10 # [default: latest] mise version to install
          install: true # [default: true] run `mise install`
          install_args: "bun" # [default: ""] additional arguments to `mise install`
          cache: true # [default: true] cache mise using GitHub's cache
          experimental: true # [default: false] enable experimental features
          log_level: debug # [default: info] log level
          # automatically write this .tool-versions file
          tool_versions: |
            shellcheck 0.11.0
          # or, if you prefer .mise.toml format:
          mise_toml: |
            [tools]
            shellcheck = "0.11.0"
          working_directory: app # [default: .] directory to run mise in
          reshim: false # [default: false] run `mise reshim -f`
          github_token: ${{ secrets.GITHUB_TOKEN }} # [default: ${{ github.token }}] GitHub token for API authentication
      - run: shellcheck scripts/*.sh
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: jdx/mise-action@v4
      # .tool-versions will be read from repo root
      - run: node ./my_app.js

Cache Configuration

You can customize the cache key used by the action:

- uses: jdx/mise-action@v4
  with:
    cache_key: "my-custom-cache-key"  # Override the entire cache key
    cache_key_prefix: "mise-v1"       # Or just change the prefix (default: "mise-v0")

Template Variables in Cache Keys

When using cache_key, you can use template variables to reference internal values:

- uses: jdx/mise-action@v4
  with:
    cache_key: "mise-{{platform}}-{{version}}-{{file_hash}}"
    version: "2026.3.10"
    install_args: "node python"

Available template variables:

  • {{version}} - The mise version (from the version input)
  • {{cache_key_prefix}} - The cache key prefix (from cache_key_prefix input or default)
  • {{platform}} - The target platform, including the runner image (e.g., "linux-x64-ubuntu24", "macos-arm64-macos15", "linux-x64-self-hosted"). The trailing segment is process.env.ImageOS on github-hosted runners and falls back to "self-hosted" elsewhere — preventing cache collisions when the same repo runs on different runner providers (github-hosted, namespace.so, self-hosted).
  • {{file_hash}} - Hash of all mise configuration files
  • {{mise_env}} - The MISE_ENV environment variable value
  • {{install_args_hash}} - SHA256 hash of the sorted tools from install args
  • {{default}} - The processed default cache key (useful for extending)

Conditional logic is also supported using Handlebars syntax like {{#if version}}...{{/if}}.

Example using multiple variables:

- uses: jdx/mise-action@v4
  with:
    cache_key: "mise-v1-{{platform}}-{{install_args_hash}}-{{file_hash}}"
    install_args: "node@24 python@3.14"

You can also extend the default cache key:

- uses: jdx/mise-action@v4
  with:
    cache_key: "{{default}}-custom-suffix"
    install_args: "node@24 python@3.14"

This gives you full control over cache invalidation based on the specific aspects that matter to your workflow.

GitHub API Rate Limits

When installing tools hosted on GitHub (like gh, node, bun, etc.), mise needs to make API calls to GitHub's releases API. Without authentication, these calls are subject to GitHub's rate limit of 60 requests per hour, which can cause installation failures.

- uses: jdx/mise-action@v4
  with:
    github_token: ${{ secrets.GITHUB_TOKEN }}
    # your other configuration

Note: The action automatically uses ${{ github.token }} as the default, so in most cases you don't need to explicitly provide it. However, if you encounter rate limit errors, make sure the token is being passed correctly.

Alternative Installation

Alternatively, mise is easy to use in GitHub Actions even without this:

jobs:
  build:
    steps:
    - run: |
        curl https://mise.run | sh
        echo "$HOME/.local/share/mise/bin" >> $GITHUB_PATH
        echo "$HOME/.local/share/mise/shims" >> $GITHUB_PATH