From 10a4f19c835d14e7a746fb3d94a8214b61bd248b Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Sat, 22 Aug 2026 01:17:06 -0700 Subject: [PATCH 1/2] Pin bin/ci's tool versions in .mise.toml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit bin/ci fails cold in a fresh worktree: mise shims for actionlint, shellcheck, and pwsh exist machine-wide but no version is pinned for this project, so each one dies with "No version is set for shim". shellcheck isn't even invoked by the repo directly — actionlint shells out to it to lint workflow run: blocks, so the broken shim takes actionlint down with it. zizmor is worse than unpinned: make lint-actions hard-fails without it and make tools can't install it (brew/pacman only). Pin all four in [tools] so mise install makes bin/ci self-sufficient: * actionlint 1.7.12 — matches the .github/workflows/test.yml action pin * shellcheck 0.11.0 — actionlint's dependency; CI uses the runner's preinstall * powershell 7.6.5 — no CI pin to mirror (runners preinstall pwsh); turns the three fail-closed-in-CI installer.bats pwsh tests into locally-running tests * zizmor 1.29.0 — pinned in the workflow too: zizmor-action's version input defaults to "latest", so the SHA-pinned action still selected a floating zizmor release. Now the action and mise pin the same binary version. Each pin carries a sync comment mirroring the existing goreleaser convention. --- .github/workflows/test.yml | 3 +++ .mise.toml | 11 +++++++++++ 2 files changed, 14 insertions(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 27315cd3a..d1ca5259c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -95,6 +95,9 @@ jobs: - name: Run zizmor uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 with: + # The action's default version floats to the latest zizmor release. + # Keep in sync with the .mise.toml zizmor pin. + version: "1.29.0" advanced-security: false security: diff --git a/.mise.toml b/.mise.toml index ad684612d..e0dc62e68 100644 --- a/.mise.toml +++ b/.mise.toml @@ -2,3 +2,14 @@ go = "1.26" # Keep in sync with .github/workflows/release.yml GoReleaser CLI version pin. goreleaser = "2.15.4" +# Keep in sync with .github/workflows/test.yml rhysd/actionlint version pin. +actionlint = "1.7.12" +# Not invoked directly; actionlint shells out to it to lint workflow `run:` +# scripts (CI uses the runner's preinstalled shellcheck). +shellcheck = "0.11.0" +# No CI pin to match; runners preinstall pwsh. Lets e2e/installer.bats pwsh +# tests run locally instead of skipping. +powershell = "7.6.5" +# Keep in sync with the zizmor-action `version:` input in +# .github/workflows/test.yml (the action's default floats to latest). +zizmor = "1.29.0" From bb029d63adb53883d8f4c1f6e24ca0ea5788aef0 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Sat, 22 Aug 2026 12:14:28 -0700 Subject: [PATCH 2/2] Correct the zizmor pin comments: the action never floated at runtime MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The zizmor-action resolves its version input — including the "latest" default — through a digest map checked in at the action's pinned SHA, so CI was never running a floating release; "latest" at v0.6.2 maps to the same digest as 1.29.0. The explicit version pin still earns its keep: it stops the release from shifting when the action SHA is bumped and matches the .mise.toml pin so local bin/ci runs the same zizmor CI does. Reword both comments to describe that mechanism instead of a runtime float. --- .github/workflows/test.yml | 6 ++++-- .mise.toml | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index d1ca5259c..c7dc23b3c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -95,8 +95,10 @@ jobs: - name: Run zizmor uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 with: - # The action's default version floats to the latest zizmor release. - # Keep in sync with the .mise.toml zizmor pin. + # The action resolves `version` (default "latest") through the digest + # map checked in at its pinned SHA, so this stays stable either way — + # the explicit pin keeps the release from shifting when the action SHA + # is bumped, and matches the .mise.toml zizmor pin for local parity. version: "1.29.0" advanced-security: false diff --git a/.mise.toml b/.mise.toml index e0dc62e68..b8f1e97e1 100644 --- a/.mise.toml +++ b/.mise.toml @@ -11,5 +11,5 @@ shellcheck = "0.11.0" # tests run locally instead of skipping. powershell = "7.6.5" # Keep in sync with the zizmor-action `version:` input in -# .github/workflows/test.yml (the action's default floats to latest). +# .github/workflows/test.yml so local bin/ci runs the same release CI does. zizmor = "1.29.0"