This release adds automatic locked installs when a mise.lock is present, and fixes a long-standing cache-key collision that could poison tool installs when workflows migrate between runner providers.
Added
Automatic --locked install when mise.lock exists (#495) by @zeitlinger
When a repo contains mise.lock, the action now automatically passes --locked to mise install (on mise versions that support it). This removes the need to manually set install_args: --locked and prevents mise install from silently mutating the lockfile in CI. Explicit install_args and older mise versions are still respected.
Note: workflows with a stale lockfile may now fail earlier and more explicitly instead of silently updating mise.lock mid-run — this surfaces lockfile drift rather than hiding it.
Fixed
Cache key collisions across runner providers (#456) — the default cache key now includes the runner image (e.g. macos15, ubuntu24 for GitHub-hosted runners; self-hosted otherwise). Previously, repos migrating between providers like github-hosted, namespace.so, BuildJet, and self-hosted runners with the same OS/arch could restore a peer provider's ~/.local/share/mise/installs/*, causing failures like does not have an executable named '…' or SIGILL crashes from binaries built against a different glibc/CPU featureset. Expect a one-time cache miss after upgrading; thereafter the cache stays scoped per image.
mise-shim.exe missing on Windows (#476) by @risu729 — the action now installs mise-shim.exe alongside mise.exe and repairs restored caches that lack the shim. Fixes #475.
Changed
Migrated the bundled action build from ncc (CommonJS) to Rollup (ESM) (#436). No user-facing behavior change.
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [https://github.com/jdx/mise-action](https://github.com/jdx/mise-action) | action | minor | `v4.0.1` → `v4.1.0` |
---
### Release Notes
<details>
<summary>jdx/mise-action (https://github.com/jdx/mise-action)</summary>
### [`v4.1.0`](https://github.com/jdx/mise-action/releases/tag/v4.1.0): : automatic --locked installs
[Compare Source](https://github.com/jdx/mise-action/compare/v4.0.1...v4.1.0)
This release adds automatic locked installs when a `mise.lock` is present, and fixes a long-standing cache-key collision that could poison tool installs when workflows migrate between runner providers.
#### Added
##### Automatic `--locked` install when `mise.lock` exists ([#​495](https://github.com/jdx/mise-action/pull/495)) by [@​zeitlinger](https://github.com/zeitlinger)
When a repo contains `mise.lock`, the action now automatically passes `--locked` to `mise install` (on mise versions that support it). This removes the need to manually set `install_args: --locked` and prevents `mise install` from silently mutating the lockfile in CI. Explicit `install_args` and older mise versions are still respected.
Note: workflows with a stale lockfile may now fail earlier and more explicitly instead of silently updating `mise.lock` mid-run — this surfaces lockfile drift rather than hiding it.
#### Fixed
- **Cache key collisions across runner providers** ([#​456](https://github.com/jdx/mise-action/pull/456)) — the default cache key now includes the runner image (e.g. `macos15`, `ubuntu24` for GitHub-hosted runners; `self-hosted` otherwise). Previously, repos migrating between providers like github-hosted, namespace.so, BuildJet, and self-hosted runners with the same OS/arch could restore a peer provider's `~/.local/share/mise/installs/*`, causing failures like `does not have an executable named '…'` or SIGILL crashes from binaries built against a different glibc/CPU featureset. Expect a one-time cache miss after upgrading; thereafter the cache stays scoped per image.
- **`mise-shim.exe` missing on Windows** ([#​476](https://github.com/jdx/mise-action/pull/476)) by [@​risu729](https://github.com/risu729) — the action now installs `mise-shim.exe` alongside `mise.exe` and repairs restored caches that lack the shim. Fixes [#​475](https://github.com/jdx/mise-action/issues/475).
#### Changed
- Migrated the bundled action build from ncc (CommonJS) to Rollup (ESM) ([#​436](https://github.com/jdx/mise-action/pull/436)). No user-facing behavior change.
**Full Changelog**: <https://github.com/jdx/mise-action/compare/v4.0.1...v4.1.0>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTQuMiIsInVwZGF0ZWRJblZlciI6IjQzLjIxNC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v4.0.1→v4.1.0Release Notes
jdx/mise-action (https://github.com/jdx/mise-action)
v4.1.0: : automatic --locked installsCompare Source
This release adds automatic locked installs when a
mise.lockis present, and fixes a long-standing cache-key collision that could poison tool installs when workflows migrate between runner providers.Added
Automatic
--lockedinstall whenmise.lockexists (#495) by @zeitlingerWhen a repo contains
mise.lock, the action now automatically passes--lockedtomise install(on mise versions that support it). This removes the need to manually setinstall_args: --lockedand preventsmise installfrom silently mutating the lockfile in CI. Explicitinstall_argsand older mise versions are still respected.Note: workflows with a stale lockfile may now fail earlier and more explicitly instead of silently updating
mise.lockmid-run — this surfaces lockfile drift rather than hiding it.Fixed
macos15,ubuntu24for GitHub-hosted runners;self-hostedotherwise). Previously, repos migrating between providers like github-hosted, namespace.so, BuildJet, and self-hosted runners with the same OS/arch could restore a peer provider's~/.local/share/mise/installs/*, causing failures likedoes not have an executable named '…'or SIGILL crashes from binaries built against a different glibc/CPU featureset. Expect a one-time cache miss after upgrading; thereafter the cache stays scoped per image.mise-shim.exemissing on Windows (#476) by @risu729 — the action now installsmise-shim.exealongsidemise.exeand repairs restored caches that lack the shim. Fixes #475.Changed
Full Changelog: https://github.com/jdx/mise-action/compare/v4.0.1...v4.1.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.