Modernize maintenance workflows

.github/actions/mise-install/action.yaml

@@ -0,0 +1,24 @@
+---
+name: Install mise tools
+description: Install a declared subset of the locked mise toolchain
+inputs:
+  executable:
+    description: Absolute path to the verified mise executable
+    required: true
+  github-token:
+    description: GitHub token used by mise's GitHub-backed tool providers
+    required: true
+  tools:
+    description: Newline-delimited mise.toml tool names to install
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Install locked tools
+      shell: bash
+      env:
+        ACTION_PATH: ${{ github.action_path }}
+        MISE: ${{ inputs.executable }}
+        MISE_GITHUB_TOKEN: ${{ inputs.github-token }}
+        MISE_TOOLS: ${{ inputs.tools }}
+      run: '"$ACTION_PATH/install.sh"'

.github/actions/mise-install/install.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Install an explicitly requested subset of the repository's locked mise tools.
+
+set -Eeuo pipefail
+IFS=$'\n\t'
+
+main() {
+  local -r mise=${MISE:?MISE is required}
+  local -r requested_tools=${MISE_TOOLS:?MISE_TOOLS is required}
+  local -r github_path=${GITHUB_PATH:?GITHUB_PATH is required}
+  local bin_path enabled_tools repo_root tool
+  local -a tools=()
+
+  repo_root=$(git rev-parse --show-toplevel)
+  readonly repo_root
+
+  while IFS= read -r tool; do
+    [[ -n $tool ]] || continue
+    if [[ ! $tool =~ ^[a-zA-Z0-9][a-zA-Z0-9:._/-]*$ ]]; then
+      echo "invalid mise tool name: $tool" >&2
+      return 1
+    fi
+
+    "$mise" config get --file "$repo_root/mise.toml" "tools.$tool" > /dev/null
+    tools+=("$tool")
+  done <<< "$requested_tools"
+
+  if [[ ${#tools[@]} -eq 0 ]]; then
+    echo "mise-install requires at least one declared tool" >&2
+    return 1
+  fi
+
+  enabled_tools=$(
+    IFS=,
+    echo "${tools[*]}"
+  )
+  readonly enabled_tools
+
+  MISE_ENABLE_TOOLS=$enabled_tools MISE_NO_HOOKS=1 \
+    "$mise" install --cd "$repo_root" --locked "${tools[@]}"
+  while IFS= read -r bin_path; do
+    printf '%s\n' "$bin_path" >> "$github_path"
+  done < <(MISE_ENABLE_TOOLS=$enabled_tools \
+    "$mise" bin-paths --cd "$repo_root" "${tools[@]}")
+}
+
+main "$@"

.github/actions/mise-tool-versions/action.yaml

@@ -0,0 +1,24 @@
+---
+name: Resolve mise tool versions
+description: Expose exact mise.toml tool versions as GitHub Action outputs
+inputs:
+  executable:
+    description: Absolute path to the verified mise executable
+    required: true
+outputs:
+  node:
+    description: Node.js toolchain version
+    value: ${{ steps.resolve.outputs.node }}
+  zizmor:
+    description: zizmor tool version
+    value: ${{ steps.resolve.outputs.zizmor }}
+runs:
+  using: composite
+  steps:
+    - name: Resolve tool versions
+      id: resolve
+      shell: bash
+      env:
+        ACTION_PATH: ${{ github.action_path }}
+        MISE: ${{ inputs.executable }}
+      run: '"$ACTION_PATH/resolve.sh"'

.github/actions/mise-tool-versions/resolve.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Resolve exact mise.toml tool versions into trusted GitHub Action outputs.
+
+set -Eeuo pipefail
+IFS=$'\n\t'
+
+emit_version() {
+  local -r output_name=$1
+  local -r tool_name=$2
+  local -r config_path=$3
+  local -r github_output=$4
+  local -r mise=$5
+  local version
+
+  version=$("$mise" config get --file "$config_path" "tools.$tool_name")
+  readonly version
+
+  if [[ ! $version =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    echo "mise tool $tool_name must be an exact release, got $version" >&2
+    return 1
+  fi
+
+  printf '%s=%s\n' "$output_name" "$version" >> "$github_output"
+}
+
+main() {
+  local -r mise=${MISE:?MISE is required}
+  local -r github_output=${GITHUB_OUTPUT:?GITHUB_OUTPUT is required}
+  local config_path repo_root
+
+  repo_root=$(git rev-parse --show-toplevel)
+  readonly repo_root
+  config_path="$repo_root/mise.toml"
+  readonly config_path
+
+  emit_version node node "$config_path" "$github_output" "$mise"
+  emit_version zizmor aqua:zizmorcore/zizmor "$config_path" "$github_output" "$mise"
+}
+
+main "$@"

.github/actions/setup-mise/action.yaml

@@ -0,0 +1,29 @@
+---
+name: Setup mise
+description: Install the repository-pinned mise bootstrap after checksum verification
+inputs:
+  github-token:
+    description: GitHub token used to authenticate the release download
+    required: true
+outputs:
+  executable:
+    description: Absolute path to the verified mise executable
+    value: ${{ steps.install.outputs.executable }}
+runs:
+  using: composite
+  steps:
+    - name: Disable mise version download tracking
+      shell: bash
+      run: printf '%s\n' 'MISE_USE_VERSIONS_HOST_TRACK=false' >> "$GITHUB_ENV"
+
+    - name: Install mise
+      id: install
+      shell: bash
+      env:
+        ACTION_PATH: ${{ github.action_path }}
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+        MISE_VERSION: "2026.8.10"
+        MISE_SHA256_LINUX_X64: "db4afe188fc405489fe6a04e159d46eb2053499c12e133240c790d988f248710"
+        MISE_SHA256_MACOS_ARM64: "a8190378f6c0b394c54068405260282dcff2af14a153b327198cf4c44364e1b1"
+        MISE_SHA256_MACOS_X64: "cda2095e2e71a2f046c2c6628d7e21e08a79933aa1a04fd3114e9284b72db423"
+      run: '"$ACTION_PATH/setup.sh"'

.github/actions/setup-mise/setup.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# Install a pinned mise archive after SHA-256 verification.
+
+set -Eeuo pipefail
+IFS=$'\n\t'
+
+SETUP_MISE_SCRATCH=
+SETUP_MISE_ARCHIVE=
+
+cleanup() {
+  if [[ -n $SETUP_MISE_ARCHIVE ]]; then
+    rm -f -- "$SETUP_MISE_ARCHIVE"
+  fi
+  if [[ -n $SETUP_MISE_SCRATCH ]]; then
+    rmdir -- "$SETUP_MISE_SCRATCH"
+  fi
+}
+
+platform_and_checksum() {
+  local -r runner_os=$1
+  local -r runner_arch=$2
+
+  case "$runner_os/$runner_arch" in
+    Linux/X64)
+      printf '%s\t%s\n' linux-x64 \
+        "${MISE_SHA256_LINUX_X64:?MISE_SHA256_LINUX_X64 is required}"
+      ;;
+    macOS/ARM64)
+      printf '%s\t%s\n' macos-arm64 \
+        "${MISE_SHA256_MACOS_ARM64:?MISE_SHA256_MACOS_ARM64 is required}"
+      ;;
+    macOS/X64)
+      printf '%s\t%s\n' macos-x64 \
+        "${MISE_SHA256_MACOS_X64:?MISE_SHA256_MACOS_X64 is required}"
+      ;;
+    *)
+      echo "setup-mise does not support $runner_os $runner_arch" >&2
+      return 1
+      ;;
+  esac
+}
+
+verify_checksum() {
+  local -r runner_os=$1
+  local -r checksum=$2
+  local -r archive=$3
+
+  if [[ $runner_os == macOS ]]; then
+    printf '%s  %s\n' "$checksum" "$archive" | shasum -a 256 --check
+  else
+    printf '%s  %s\n' "$checksum" "$archive" | sha256sum --check
+  fi
+}
+
+main() {
+  local -r version=${MISE_VERSION:?MISE_VERSION is required}
+  local -r runner_os=${RUNNER_OS:?RUNNER_OS is required}
+  local -r runner_arch=${RUNNER_ARCH:?RUNNER_ARCH is required}
+  local -r runner_temp=${RUNNER_TEMP:?RUNNER_TEMP is required}
+  local -r github_output=${GITHUB_OUTPUT:?GITHUB_OUTPUT is required}
+  local archive checksum install_root platform scratch
+  local -a curl_args=(--fail --location --silent --show-error)
+
+  if [[ -n ${GITHUB_TOKEN:-} ]]; then
+    curl_args+=(--header "Authorization: Bearer $GITHUB_TOKEN")
+  fi
+
+  IFS=$'\t' read -r platform checksum < <(
+    platform_and_checksum "$runner_os" "$runner_arch"
+  )
+  readonly platform checksum
+  archive="mise-v${version}-${platform}.tar.xz"
+  readonly archive
+  install_root="$runner_temp/mise-$version"
+  readonly install_root
+  scratch=$(mktemp -d "$runner_temp/setup-mise.XXXXXX")
+  readonly scratch
+  SETUP_MISE_SCRATCH=$scratch
+  readonly SETUP_MISE_SCRATCH
+  SETUP_MISE_ARCHIVE="$scratch/$archive"
+  readonly SETUP_MISE_ARCHIVE
+  trap cleanup EXIT
+
+  curl "${curl_args[@]}" \
+    --output "$SETUP_MISE_ARCHIVE" \
+    "https://github.com/jdx/mise/releases/download/v${version}/${archive}"
+  verify_checksum "$runner_os" "$checksum" "$SETUP_MISE_ARCHIVE"
+
+  mkdir -p "$install_root"
+  tar --extract --xz --file "$SETUP_MISE_ARCHIVE" \
+    --directory "$install_root" --strip-components=1
+
+  "$install_root/bin/mise" --version
+  printf 'executable=%s\n' "$install_root/bin/mise" >> "$github_output"
+}
+
+main "$@"

.github/dependabot.yml

@@ -13,6 +13,8 @@ updates:
       - lopopolo
     labels:
       - A-deps
+    cooldown:
+      default-days: 7
   - package-ecosystem: cargo
     directory: "/"
     schedule:
@@ -25,18 +27,8 @@ updates:
       - lopopolo
     labels:
       - A-deps
-  - package-ecosystem: bundler
-    directory: "/"
-    schedule:
-      interval: monthly
-    groups:
-      bundler-deps:
-        patterns:
-          - "*"
-    assignees:
-      - lopopolo
-    labels:
-      - A-deps
+    cooldown:
+      default-days: 7
   - package-ecosystem: npm
     directory: "/"
     schedule:
@@ -49,3 +41,5 @@ updates:
       - lopopolo
     labels:
       - A-deps
+    cooldown:
+      default-days: 7