chore(deps): actions: bump jdx/mise-action from 4.2.1 to 4.2.3 in the all-actions group

[dependabot]

Bumps the all-actions group with 1 update: jdx/mise-action.

Updates jdx/mise-action from 4.2.1 to 4.2.3

Release notes

Sourced from jdx/mise-action's releases.

v4.2.3: Restore mise PATH propagation

A patch release that restores mise's PATH propagation to subsequent workflow steps — without reintroducing the full-PATH snapshot behavior that v4.2.1 fixed.

Fixed

Export mise PATH entries to subsequent steps (#575) by @​jdx

v4.2.1 stopped exporting the complete PATH returned by mise env --json into GITHUB_ENV, which correctly prevented snapshotting the runner's environment into subsequent steps. However, that also dropped mise-produced PATH entries — tool shims, [env] _.path directories, and similar — that workflows relied on after the setup step. See #565.

The action now computes only the prefix that mise prepended to the existing PATH and forwards those directories individually through GITHUB_PATH. This preserves mise's configured ordering, composes cleanly with PATH changes from other actions, and never persists the runner's full PATH through GITHUB_ENV. The dotenv fallback path (used with older mise versions) also strips PATH= lines and re-derives additions from mise env --json.

A new export_path input (default true) lets workflows keep regular env exports while opting out of PATH changes:

- uses: jdx/mise-action@v4
  with:
    export_path: false # keep env vars, skip mise PATH additions

Full Changelog: jdx/mise-action@v4.2.2...v4.2.3

v4.2.2: Zstd tar fallback for older runners

A small patch release that fixes archive selection on runners with an older tar and corrects a stale default in the README.

Fixed

Verify tar supports Zstd before picking .tar.zst (#569 by @​JackMyers001

The action previously chose the .tar.zst mise archive whenever zstd --version succeeded, then extracted it with tar --zstd. On RHEL 8-compatible runners that ship zstd 1.4.4 alongside GNU tar 1.30, the --zstd option isn't recognized and installation failed.

Detection now runs both checks:

zstd --version
tar --zstd --version

If either fails, the action falls back to the .tar.gz archive. No configuration change is required — existing workflows on affected runners just start working again. Fixes #568.

Documentation

• Update the cache_key_prefix example in the README to reflect the current default of mise-v1 (previously documented as mise-v0) (#570 by @​muzimuzhi).

New Contributors

• @​JackMyers001 made their first contribution in #569
• @​muzimuzhi made their first contribution in #570

Full Changelog: jdx/mise-action@v4.2.1...v4.2.2

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

4.2.3 - 2026-07-24

🐛 Bug Fixes

• export mise path entries to subsequent steps (#575) by @​jdx in #575

---

4.2.2 - 2026-07-24

🐛 Bug Fixes

• (release-plz) exit when git-cliff produces no version bump (#566) by @​jdx in #566
• ensure tar supports Zstd (#569) by @​JackMyers001 in #569

📚 Documentation

• update default value of cache_key_prefix (#570) by @​muzimuzhi in #570

New Contributors

• @​muzimuzhi made their first contribution in #570
• @​JackMyers001 made their first contribution in #569

---

4.2.1 - 2026-07-16

🐛 Bug Fixes

• verify mise downloads with signed checksums (#548) by @​jdx in #548
• exclude PATH from environment export (#556) by @​jdx in #556

🔍 Other Changes

• Enable Entire for Codex (#529) by @​jdx in #529

⚙️ Miscellaneous Tasks

• (ci) automate weekly releases (#557) by @​jdx in #557
• (release) skip ai reviews for release prs (#549) by @​jdx in #549

---

4.2.0 - 2026-06-17

🚀 Features

• support bootstrap mode (#522) by @​jdx in #522

... (truncated)

Commits

• 9e7f763 chore: release v4.2.3 (#578)
• 0f85637 fix: export mise path entries to subsequent steps (#575)
• a24c375 chore(deps): migrate to aube lockfile (#576)
• f10502f chore: release v4.2.2 (#567)
• 5df6b79 chore(deps): update zizmorcore/zizmor-action action to v0.6.0 (#574)
• be707ec chore(deps): update jdx/mise-action action to v4.2.1 (#572)
• d0f7879 chore(deps): update github/codeql-action action to v4.37.1 (#571)
• fc371b7 docs: update default value of cache_key_prefix (#570)
• 5c77551 fix: ensure tar supports Zstd (#569)
• a63ca4f fix(release-plz): exit when git-cliff produces no version bump (#566)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[scottschreckengaust]

Verdict: Approve

Dependabot all-actions group bump of jdx/mise-action 4.2.1 → 4.2.3 across all 7 workflows. SHA-pinned, verified, CI green. Mergeable.

Vision alignment

CI-tooling hygiene only; no control-plane surface touched. Preserves bounded blast radius and the reviewable-outcomes tenet (SHA-pinned actions remain auditable).

Supply-chain verification (the one in-scope lens for an actions bump)

• All 7 files repin from dad1bfd… to 9e7f7633ff6f6d6048a9418a68d48f288f50eb14, uniform, no stragglers.
• Verified 9e7f7633… is exactly what tag v4.2.3 resolves to via gh api repos/jdx/mise-action/git/refs/tags/v4.2.3 (lightweight tag → commit). The # v4.2.3 comment is accurate.
• Immutable full-SHA pinning is retained (no float to a mutable tag).
• Upstream 4.2.3 restores mise PATH propagation to subsequent steps (regression over 4.2.1) while keeping the security fix of not snapshotting the runner's full PATH into GITHUB_ENV — a net-positive, low-risk patch. 4.2.2 adds a zstd/tar fallback for older runners. Both are additive bug fixes.

Blocking issues

None.

Non-blocking suggestions / nits

None. This is the minimal, correct form of an actions bump.

Documentation

Not applicable — no behavior, contract, env var, command, or design surface changed.

Tests & CI

No tests required or possible for a workflow-pin bump. All required checks green: build (agentcore) pass, Secrets/deps/workflow scan pass, Dead-code (advisory) pass, Validate PR title pass. CodeQL / auto-approve skipping is expected for this path. mergeStateStatus: BLOCKED is the branch-protection approval gate, not a failing check — this review clears it. Bootstrap synth-coverage: not applicable (no CDK constructs/stacks/handlers touched).

Governance (ADR-003)

Dependabot PR under the standing all-actions group-bump policy — that policy is the authorization; no hand-filed issue required. dependencies + github_actions labels present. Branch name is Dependabot's convention (de-facto-waived nit, not a blocker).

Review agents run

Ran supply-chain integrity verification by hand (SHA↔tag resolution) — the only in-scope lens for a pure actions-pin bump. Omitted, each because the diff genuinely does not touch its scope:

• code-reviewer — no application source (only .github/workflows/*.yml pin lines).
• silent-failure-hunter — no error-handling / fallback code.
• type-design-analyzer — no new/changed types.
• comment-analyzer — only the # v4.2.3 version comment, verified accurate above.
• pr-test-analyzer — no testable code paths.
• /security-review — no IAM, Cedar, network, secrets, or input-gateway change; the sole security-relevant concern (action pin integrity) is verified above.

Human heuristics

• Proportionality — Pass. Minimal 7-line diff, one action, one version.
• Coherence — Pass. Same SHA applied uniformly across every workflow; belongs in .github/workflows/.
• Clarity — Pass. # v4.2.3 comment matches the resolved SHA.
• Appropriateness — Pass. Standard, team-maintainable Dependabot flow verified against the real GitHub tag ref, not a mock.