Skip to content

chore(deps): actions: bump jdx/mise-action from 4.2.1 to 4.2.4 in the all-actions group across 1 directory - #692

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/all-actions-5a4c42ae6d
Open

chore(deps): actions: bump jdx/mise-action from 4.2.1 to 4.2.4 in the all-actions group across 1 directory#692
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/all-actions-5a4c42ae6d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-actions group with 1 update in the / directory: jdx/mise-action.

Updates jdx/mise-action from 4.2.1 to 4.2.4

Release notes

Sourced from jdx/mise-action's releases.

v4.2.4: Reliable locking detection under forced color

A small patch release that fixes locking-support detection when workflows force colored output.

Fixed

Detect mise install --locked reliably under forced color (#580 by @​scop)

When colored output was forced globally (for example via CLICOLOR_FORCE=1), ANSI escape codes in mise install --help prevented the action from matching --locked in the help text, so locking support was reported as unavailable even on versions of mise that supported it.

The help probe now runs with NO_COLOR=1 in its environment, which overrides CLICOLOR_FORCE and guarantees plain-text output for the feature detection — regardless of the surrounding workflow's color settings.

Full Changelog: jdx/mise-action@v4.2.3...v4.2.4

v4.2.3: Restore mise PATH propagation

A patch release that restores mise's PATH propagation to subsequent workflow steps — without reintroducing the full-PATH snapshot behavior that v4.2.1 fixed.

Fixed

Export mise PATH entries to subsequent steps (#575) by @​jdx

v4.2.1 stopped exporting the complete PATH returned by mise env --json into GITHUB_ENV, which correctly prevented snapshotting the runner's environment into subsequent steps. However, that also dropped mise-produced PATH entries — tool shims, [env] _.path directories, and similar — that workflows relied on after the setup step. See #565.

The action now computes only the prefix that mise prepended to the existing PATH and forwards those directories individually through GITHUB_PATH. This preserves mise's configured ordering, composes cleanly with PATH changes from other actions, and never persists the runner's full PATH through GITHUB_ENV. The dotenv fallback path (used with older mise versions) also strips PATH= lines and re-derives additions from mise env --json.

A new export_path input (default true) lets workflows keep regular env exports while opting out of PATH changes:

- uses: jdx/mise-action@v4
  with:
    export_path: false # keep env vars, skip mise PATH additions

Full Changelog: jdx/mise-action@v4.2.2...v4.2.3

v4.2.2: Zstd tar fallback for older runners

A small patch release that fixes archive selection on runners with an older tar and corrects a stale default in the README.

Fixed

Verify tar supports Zstd before picking .tar.zst (#569 by @​JackMyers001

The action previously chose the .tar.zst mise archive whenever zstd --version succeeded, then extracted it with tar --zstd. On RHEL 8-compatible runners that ship zstd 1.4.4 alongside GNU tar 1.30, the --zstd option isn't recognized and installation failed.

Detection now runs both checks:

zstd --version
tar --zstd --version

... (truncated)

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

4.2.4 - 2026-07-28

🐛 Bug Fixes

  • locking support detection with force-colored output (#580) by @​scop in #580

4.2.3 - 2026-07-24

🐛 Bug Fixes

4.2.2 - 2026-07-24

🐛 Bug Fixes

📚 Documentation

New Contributors

4.2.1 - 2026-07-16

🐛 Bug Fixes

🔍 Other Changes

⚙️ Miscellaneous Tasks

... (truncated)

Commits
  • 7e36c90 chore: release v4.2.4 (#581)
  • 493a5fd chore(deps): update jdx/renovate-config digest to d4f71e1 (#585)
  • 4f79861 chore(deps): update github/codeql-action action to v4.37.2 (#586)
  • 3fb09b2 chore(deps): update jdx/pr-closer action to v1.2.0 (#584)
  • 4606f11 chore(deps): update jdx/renovate-config digest to aa7a43b (#582)
  • 2319179 chore(deps): update actions/checkout action to v7.0.1 (#583)
  • b4fa3f8 fix: locking support detection with force-colored output (#580)
  • c3c9861 chore(deps): lock file maintenance (#579)
  • 9e7f763 chore: release v4.2.3 (#578)
  • 0f85637 fix: export mise path entries to subsequent steps (#575)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 1, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 1, 2026 06:17
@dependabot dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Aug 1, 2026
scottschreckengaust
scottschreckengaust previously approved these changes Aug 3, 2026
View reviewed changes

@scottschreckengaust scottschreckengaust left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verdict: Approve

Dependabot all-actions group bump of jdx/mise-action 4.2.1 → 4.2.3 across all 7 workflows. SHA-pinned, verified, CI green. Mergeable.

Vision alignment

CI-tooling hygiene only; no control-plane surface touched. Preserves bounded blast radius and the reviewable-outcomes tenet (SHA-pinned actions remain auditable).

Supply-chain verification (the one in-scope lens for an actions bump)

  • All 7 files repin from dad1bfd… to 9e7f7633ff6f6d6048a9418a68d48f288f50eb14, uniform, no stragglers.
  • Verified 9e7f7633… is exactly what tag v4.2.3 resolves to via gh api repos/jdx/mise-action/git/refs/tags/v4.2.3 (lightweight tag → commit). The # v4.2.3 comment is accurate.
  • Immutable full-SHA pinning is retained (no float to a mutable tag).
  • Upstream 4.2.3 restores mise PATH propagation to subsequent steps (regression over 4.2.1) while keeping the security fix of not snapshotting the runner's full PATH into GITHUB_ENV — a net-positive, low-risk patch. 4.2.2 adds a zstd/tar fallback for older runners. Both are additive bug fixes.

Blocking issues

None.

Non-blocking suggestions / nits

None. This is the minimal, correct form of an actions bump.

Documentation

Not applicable — no behavior, contract, env var, command, or design surface changed.

Tests & CI

No tests required or possible for a workflow-pin bump. All required checks green: build (agentcore) pass, Secrets/deps/workflow scan pass, Dead-code (advisory) pass, Validate PR title pass. CodeQL / auto-approve skipping is expected for this path. mergeStateStatus: BLOCKED is the branch-protection approval gate, not a failing check — this review clears it. Bootstrap synth-coverage: not applicable (no CDK constructs/stacks/handlers touched).

Governance (ADR-003)

Dependabot PR under the standing all-actions group-bump policy — that policy is the authorization; no hand-filed issue required. dependencies + github_actions labels present. Branch name is Dependabot's convention (de-facto-waived nit, not a blocker).

Review agents run

Ran supply-chain integrity verification by hand (SHA↔tag resolution) — the only in-scope lens for a pure actions-pin bump. Omitted, each because the diff genuinely does not touch its scope:

  • code-reviewer — no application source (only .github/workflows/*.yml pin lines).
  • silent-failure-hunter — no error-handling / fallback code.
  • type-design-analyzer — no new/changed types.
  • comment-analyzer — only the # v4.2.3 version comment, verified accurate above.
  • pr-test-analyzer — no testable code paths.
  • /security-review — no IAM, Cedar, network, secrets, or input-gateway change; the sole security-relevant concern (action pin integrity) is verified above.

Human heuristics

  • Proportionality — Pass. Minimal 7-line diff, one action, one version.
  • Coherence — Pass. Same SHA applied uniformly across every workflow; belongs in .github/workflows/.
  • Clarity — Pass. # v4.2.3 comment matches the resolved SHA.
  • Appropriateness — Pass. Standard, team-maintainable Dependabot flow verified against the real GitHub tag ref, not a mock.

@dependabot dependabot Bot changed the title chore(deps): actions: bump jdx/mise-action from 4.2.1 to 4.2.3 in the all-actions group chore(deps): actions: bump jdx/mise-action from 4.2.1 to 4.2.4 in the all-actions group across 1 directory Aug 8, 2026
@dependabot
chore(deps): actions: bump jdx/mise-action
9a849e4 
Bumps the all-actions group with 1 update in the / directory: [jdx/mise-action](https://github.com/jdx/mise-action).


Updates `jdx/mise-action` from 4.2.1 to 4.2.4
- [Release notes](https://github.com/jdx/mise-action/releases)
- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)
- [Commits](jdx/mise-action@dad1bfd...7e36c90)

---
updated-dependencies:
- dependency-name: jdx/mise-action
  dependency-version: 4.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/all-actions-5a4c42ae6d branch from 95155ec to 9a849e4 Compare August 8, 2026 06:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@scottschreckengaust scottschreckengaust scottschreckengaust left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@scottschreckengaust