From e3d2d8d5b9a7b4ee46c8d411311f4148909cef9a Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 9 Jul 2026 17:45:31 +0000 Subject: [PATCH 1/5] Harden Docker mise tool installation against transient upstream failures Two consecutive staging deploys failed because the tool-install layer hit an HTTP 504 from an upstream tool source during `mise install`. - Move the `mise install` layer above the turbo-pruned dependency-manifest COPYs in all five service Dockerfiles so the tool layer stays cached in the registry build cache across JS dependency churn and most builds never contact upstream tool sources at all - Bump the pinned mise from 2026.4.22 to 2026.7.0: since v2026.4.24 (jdx/mise#9414) mise retries transient download failures (5xx/408/429, network errors, mid-stream drops) with jittered backoff by default, whereas 2026.4.22 defaulted to zero retries so a single 504 was fatal - Pin `biome` to 2.5.2 so builds no longer resolve "latest" on every run Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01EcBiQCfeizMQJubtqXkiMs --- .config/mise/config.toml | 3 ++- README.md | 4 ++-- apps/hash-ai-worker-ts/docker/Dockerfile | 17 +++++++++++------ apps/hash-api/docker/Dockerfile | 17 +++++++++++------ apps/hash-frontend/docker/Dockerfile | 17 +++++++++++------ apps/hash-graph/docker/Dockerfile | 17 +++++++++++------ apps/hash-integration-worker/docker/Dockerfile | 17 +++++++++++------ 7 files changed, 59 insertions(+), 33 deletions(-) diff --git a/.config/mise/config.toml b/.config/mise/config.toml index 1e62bc4097e..e6c59a2a715 100644 --- a/.config/mise/config.toml +++ b/.config/mise/config.toml @@ -1,4 +1,4 @@ -min_version = "2026.4.22" +min_version = "2026.7.0" [env] TURBO_GLOBAL_WARNING_DISABLED = 1 @@ -24,6 +24,7 @@ java = "25" protoc = "32.1" # CLI tools +biome = "2.5.2" "cargo:cargo-codspeed" = "4.1.0" "cargo:cargo-hack" = "0.6.45" "cargo:cargo-insta" = "1.47.2" diff --git a/README.md b/README.md index 8cd2238c2b5..4a162b4f070 100644 --- a/README.md +++ b/README.md @@ -69,7 +69,7 @@ Install these on the host first: - **[Docker](https://docs.docker.com/get-docker/)** (≥ 20.10), including: - **[Docker Compose](https://docs.docker.com/compose/)** (≥ 2.17) — orchestrates the stack - **[Docker Buildx](https://docs.docker.com/build/install-buildx/)** (≥ 0.10) — builds the images -- **[mise](https://mise.jdx.dev/)** (≥ 2026.4.22) — installs and pins Node, Rust, protoc and the other required tool versions +- **[mise](https://mise.jdx.dev/)** (≥ 2026.7.0) — installs and pins Node, Rust, protoc and the other required tool versions Give Docker at least **8 GB RAM** (Preferences → Resources) and keep ~15 GB of disk free for build artefacts, images and volumes. @@ -80,7 +80,7 @@ git --version # ≥ 2.17 docker --version # ≥ 20.10 docker compose version # ≥ 2.17 docker buildx version # ≥ 0.10 -mise --version # ≥ 2026.4.22 +mise --version # ≥ 2026.7.0 ``` #### Setup diff --git a/apps/hash-ai-worker-ts/docker/Dockerfile b/apps/hash-ai-worker-ts/docker/Dockerfile index 14b33854740..7110d1ad3ac 100644 --- a/apps/hash-ai-worker-ts/docker/Dockerfile +++ b/apps/hash-ai-worker-ts/docker/Dockerfile @@ -14,7 +14,7 @@ COPY .config/mise /etc/mise RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ apt-get update && \ apt-get install -y --no-install-recommends curl ca-certificates && \ - export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \ + export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \ mise --version && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* && \ @@ -65,17 +65,22 @@ FROM rust AS builder WORKDIR /usr/local/src/ +# Install system packages and tools before copying the JS dependency manifests +# so this layer stays cached across dependency changes and tools are not +# re-downloaded from upstream sources on every dependency bump. +RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ + apt-get update && \ + apt-get install -y --no-install-recommends build-essential && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* && \ + mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc + COPY --from=base /app/out/json/ . COPY --from=base /app/out/yarn.lock ./yarn.lock COPY --from=base /app/out/full/.yarn .yarn COPY --from=base /app/out/full/turbo.json turbo.json RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ - apt-get update && \ - apt-get install -y --no-install-recommends build-essential && \ - apt-get clean && \ - rm -rf /var/lib/apt/lists/* && \ - mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc && \ yarn install --immutable && \ yarn cache clean diff --git a/apps/hash-api/docker/Dockerfile b/apps/hash-api/docker/Dockerfile index 6b711f0cb0e..6492fdedf43 100644 --- a/apps/hash-api/docker/Dockerfile +++ b/apps/hash-api/docker/Dockerfile @@ -14,7 +14,7 @@ COPY .config/mise /etc/mise RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ apt-get update && \ apt-get install -y --no-install-recommends curl ca-certificates && \ - export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \ + export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \ mise --version && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* && \ @@ -65,17 +65,22 @@ FROM rust AS builder WORKDIR /usr/local/src/ +# Install system packages and tools before copying the JS dependency manifests +# so this layer stays cached across dependency changes and tools are not +# re-downloaded from upstream sources on every dependency bump. +RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ + apt-get update && \ + apt-get install -y --no-install-recommends build-essential && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* && \ + mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc + COPY --from=base /app/out/json/ . COPY --from=base /app/out/yarn.lock ./yarn.lock COPY --from=base /app/out/full/.yarn .yarn COPY --from=base /app/out/full/turbo.json turbo.json RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ - apt-get update && \ - apt-get install -y --no-install-recommends build-essential && \ - apt-get clean && \ - rm -rf /var/lib/apt/lists/* && \ - mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc && \ yarn install --immutable && \ yarn cache clean diff --git a/apps/hash-frontend/docker/Dockerfile b/apps/hash-frontend/docker/Dockerfile index d1f469f9cd9..4a03b9f7958 100644 --- a/apps/hash-frontend/docker/Dockerfile +++ b/apps/hash-frontend/docker/Dockerfile @@ -12,7 +12,7 @@ COPY .config/mise /etc/mise RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ apt-get update && \ apt-get install -y --no-install-recommends curl ca-certificates && \ - export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \ + export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \ mise --version && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* && \ @@ -62,17 +62,22 @@ FROM rust AS builder WORKDIR /usr/local/src/ +# Install system packages and tools before copying the JS dependency manifests +# so this layer stays cached across dependency changes and tools are not +# re-downloaded from upstream sources on every dependency bump. +RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ + apt-get update && \ + apt-get install -y --no-install-recommends build-essential && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* && \ + mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc + COPY --from=base /app/out/json/ . COPY --from=base /app/out/yarn.lock ./yarn.lock COPY --from=base /app/out/full/.yarn .yarn COPY --from=base /app/out/full/turbo.json turbo.json RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ - apt-get update && \ - apt-get install -y --no-install-recommends build-essential && \ - apt-get clean && \ - rm -rf /var/lib/apt/lists/* && \ - mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc && \ yarn install --immutable && \ yarn cache clean diff --git a/apps/hash-graph/docker/Dockerfile b/apps/hash-graph/docker/Dockerfile index b3a232f297a..0967c0da782 100644 --- a/apps/hash-graph/docker/Dockerfile +++ b/apps/hash-graph/docker/Dockerfile @@ -15,7 +15,7 @@ COPY .config/mise /etc/mise RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ apt-get update && \ apt-get install -y --no-install-recommends curl ca-certificates && \ - export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \ + export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \ mise --version && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* && \ @@ -66,17 +66,22 @@ FROM rust AS builder WORKDIR /usr/local/src/ +# Install system packages and tools before copying the JS dependency manifests +# so this layer stays cached across dependency changes and tools are not +# re-downloaded from upstream sources on every dependency bump. +RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ + apt-get update && \ + apt-get install -y --no-install-recommends build-essential musl-tools && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* && \ + mise install node npm:turbo protoc + COPY --from=base /app/out/json/ . COPY --from=base /app/out/yarn.lock ./yarn.lock COPY --from=base /app/out/full/.yarn .yarn COPY --from=base /app/out/full/turbo.json turbo.json RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ - apt-get update && \ - apt-get install -y --no-install-recommends build-essential musl-tools && \ - apt-get clean && \ - rm -rf /var/lib/apt/lists/* && \ - mise install node npm:turbo protoc && \ yarn install --immutable && \ yarn cache clean diff --git a/apps/hash-integration-worker/docker/Dockerfile b/apps/hash-integration-worker/docker/Dockerfile index 52acc75b437..295cf90a893 100644 --- a/apps/hash-integration-worker/docker/Dockerfile +++ b/apps/hash-integration-worker/docker/Dockerfile @@ -14,7 +14,7 @@ COPY .config/mise /etc/mise RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ apt-get update && \ apt-get install -y --no-install-recommends curl ca-certificates && \ - export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \ + export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \ mise --version && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* && \ @@ -65,17 +65,22 @@ FROM rust AS builder WORKDIR /usr/local/src/ +# Install system packages and tools before copying the JS dependency manifests +# so this layer stays cached across dependency changes and tools are not +# re-downloaded from upstream sources on every dependency bump. +RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ + apt-get update && \ + apt-get install -y --no-install-recommends build-essential && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* && \ + mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc + COPY --from=base /app/out/json/ . COPY --from=base /app/out/yarn.lock ./yarn.lock COPY --from=base /app/out/full/.yarn .yarn COPY --from=base /app/out/full/turbo.json turbo.json RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ - apt-get update && \ - apt-get install -y --no-install-recommends build-essential && \ - apt-get clean && \ - rm -rf /var/lib/apt/lists/* && \ - mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc && \ yarn install --immutable && \ yarn cache clean From f168d0079f6dd70a004a003f2430bb460ae9b09c Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 9 Jul 2026 17:59:31 +0000 Subject: [PATCH 2/5] Drop vestigial biome from integration-worker image, prepare mise lockfile, set evidence-based min_version - Remove `biome` from the integration-worker `mise install` list: the repo migrated formatting to oxfmt, and nothing in the image's turbo build graph (build -> codegen tasks of the app and its workspace dependency closure) invokes biome or oxfmt, so no replacement is needed - Enable `lockfile = true` so a committed `mise.lock` stays maintained by `mise install` once generated - Set `min_version = "2026.6.13"` (instead of matching the Docker pin): the floor is driven by lockfile-content stability for this repo's tools (node source-lock outcomes in v2026.6.13, java lock identity in v2026.6.4, rust-toolchain.toml idiomatic locking in v2026.6.3) plus `mise lock` failing loudly on unresolvable tools (v2026.6.13); Docker images stay on MISE_VERSION=2026.7.0 which is above the floor Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01EcBiQCfeizMQJubtqXkiMs --- .config/mise/config.toml | 3 ++- README.md | 4 ++-- apps/hash-integration-worker/docker/Dockerfile | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.config/mise/config.toml b/.config/mise/config.toml index e6c59a2a715..8325a9b022a 100644 --- a/.config/mise/config.toml +++ b/.config/mise/config.toml @@ -1,4 +1,4 @@ -min_version = "2026.7.0" +min_version = "2026.6.13" [env] TURBO_GLOBAL_WARNING_DISABLED = 1 @@ -6,6 +6,7 @@ _.file = [".env", ".env.local"] [settings] idiomatic_version_file_enable_tools = ["rust"] +lockfile = true minimum_release_age = "5d" [tools] diff --git a/README.md b/README.md index 4a162b4f070..19b4d076664 100644 --- a/README.md +++ b/README.md @@ -69,7 +69,7 @@ Install these on the host first: - **[Docker](https://docs.docker.com/get-docker/)** (≥ 20.10), including: - **[Docker Compose](https://docs.docker.com/compose/)** (≥ 2.17) — orchestrates the stack - **[Docker Buildx](https://docs.docker.com/build/install-buildx/)** (≥ 0.10) — builds the images -- **[mise](https://mise.jdx.dev/)** (≥ 2026.7.0) — installs and pins Node, Rust, protoc and the other required tool versions +- **[mise](https://mise.jdx.dev/)** (≥ 2026.6.13) — installs and pins Node, Rust, protoc and the other required tool versions Give Docker at least **8 GB RAM** (Preferences → Resources) and keep ~15 GB of disk free for build artefacts, images and volumes. @@ -80,7 +80,7 @@ git --version # ≥ 2.17 docker --version # ≥ 20.10 docker compose version # ≥ 2.17 docker buildx version # ≥ 0.10 -mise --version # ≥ 2026.7.0 +mise --version # ≥ 2026.6.13 ``` #### Setup diff --git a/apps/hash-integration-worker/docker/Dockerfile b/apps/hash-integration-worker/docker/Dockerfile index 295cf90a893..fc970ad68ec 100644 --- a/apps/hash-integration-worker/docker/Dockerfile +++ b/apps/hash-integration-worker/docker/Dockerfile @@ -73,7 +73,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ apt-get install -y --no-install-recommends build-essential && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* && \ - mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc + mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc COPY --from=base /app/out/json/ . COPY --from=base /app/out/yarn.lock ./yarn.lock From e5a2a2c078aebfb877904765f44ff04c0ffc461c Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 10 Jul 2026 07:20:22 +0000 Subject: [PATCH 3/5] Remove biome everywhere else: ai-worker-ts image, Vercel install scripts, mise pin The repo's migration to oxfmt left biome installed but never invoked: no script in any package.json runs biome, there is no biome.json, and the only build-path formatter (hash-api's codegen afterOneFileWrite oxfmt hook) is outside the ai-worker-ts / frontend / petrinaut-website dependency closures. Drop biome from the ai-worker-ts Dockerfile tool list, both vercel-install.sh scripts, and the [tools] pin added earlier in this branch, so nothing resolves or downloads it at all. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01EcBiQCfeizMQJubtqXkiMs --- .config/mise/config.toml | 1 - apps/hash-ai-worker-ts/docker/Dockerfile | 2 +- apps/hash-frontend/vercel-install.sh | 2 +- apps/petrinaut-website/vercel-install.sh | 2 +- 4 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.config/mise/config.toml b/.config/mise/config.toml index 8325a9b022a..5cde10f86d9 100644 --- a/.config/mise/config.toml +++ b/.config/mise/config.toml @@ -25,7 +25,6 @@ java = "25" protoc = "32.1" # CLI tools -biome = "2.5.2" "cargo:cargo-codspeed" = "4.1.0" "cargo:cargo-hack" = "0.6.45" "cargo:cargo-insta" = "1.47.2" diff --git a/apps/hash-ai-worker-ts/docker/Dockerfile b/apps/hash-ai-worker-ts/docker/Dockerfile index 7110d1ad3ac..b208dfd77be 100644 --- a/apps/hash-ai-worker-ts/docker/Dockerfile +++ b/apps/hash-ai-worker-ts/docker/Dockerfile @@ -73,7 +73,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ apt-get install -y --no-install-recommends build-essential && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* && \ - mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc + mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc COPY --from=base /app/out/json/ . COPY --from=base /app/out/yarn.lock ./yarn.lock diff --git a/apps/hash-frontend/vercel-install.sh b/apps/hash-frontend/vercel-install.sh index d194956fdb5..9b45597eee4 100755 --- a/apps/hash-frontend/vercel-install.sh +++ b/apps/hash-frontend/vercel-install.sh @@ -23,7 +23,7 @@ echo "Adding wasm32-unknown-unknown target" rustup target add wasm32-unknown-unknown echo "Installing prerequisites" -mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc +mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc echo "Rust installation completed. Checking versions:" mise list rust diff --git a/apps/petrinaut-website/vercel-install.sh b/apps/petrinaut-website/vercel-install.sh index 90c53544c46..66d41db5b2d 100755 --- a/apps/petrinaut-website/vercel-install.sh +++ b/apps/petrinaut-website/vercel-install.sh @@ -20,7 +20,7 @@ export RUSTUP_AUTO_INSTALL=0 mise use --global rust[profile=minimal]@$(yq '.toolchain.channel' rust-toolchain.toml) echo "Installing prerequisites" -mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc +mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc echo "Rust installation completed. Checking versions:" mise list rust From cf3363cede85ce322d9b345758dd4a3954b74ae7 Mon Sep 17 00:00:00 2001 From: Tim Diekmann Date: Mon, 13 Jul 2026 14:34:13 +0200 Subject: [PATCH 4/5] Generate mise.lock --- .config/mise/mise.lock | 242 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 242 insertions(+) create mode 100644 .config/mise/mise.lock diff --git a/.config/mise/mise.lock b/.config/mise/mise.lock new file mode 100644 index 00000000000..719a4117566 --- /dev/null +++ b/.config/mise/mise.lock @@ -0,0 +1,242 @@ +# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html + +[[tools.cargo-binstall]] +version = "1.19.1" +backend = "aqua:cargo-bins/cargo-binstall" + +[tools.cargo-binstall."platforms.linux-arm64"] +checksum = "sha256:2001eee8da26705ad9627e57a25c23eb4639647521205f3e4a7b4e09d067d199" +url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.19.1/cargo-binstall-aarch64-unknown-linux-musl.tgz" +url_api = "https://api.github.com/repos/cargo-bins/cargo-binstall/releases/assets/413600212" +provenance = "github-attestations" + +[tools.cargo-binstall."platforms.linux-x64"] +checksum = "sha256:4a50fcf01418862e2fa8e4076cb6cb80ff4061b0c0b1464e71a63ce01ee29bde" +url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.19.1/cargo-binstall-x86_64-unknown-linux-musl.tgz" +url_api = "https://api.github.com/repos/cargo-bins/cargo-binstall/releases/assets/413599465" +provenance = "github-attestations" + +[tools.cargo-binstall."platforms.macos-arm64"] +checksum = "sha256:bf9da6a27e432784f361cfbc70a6d04e548abc548470ae9a7587c3cffb8fb0a7" +url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.19.1/cargo-binstall-aarch64-apple-darwin.zip" +url_api = "https://api.github.com/repos/cargo-bins/cargo-binstall/releases/assets/413600458" +provenance = "github-attestations" + +[[tools."cargo:cargo-codspeed"]] +version = "4.1.0" +backend = "cargo:cargo-codspeed" + +[[tools."cargo:cargo-hack"]] +version = "0.6.45" +backend = "cargo:cargo-hack" + +[[tools."cargo:cargo-insta"]] +version = "1.47.2" +backend = "cargo:cargo-insta" + +[[tools."cargo:cargo-llvm-cov"]] +version = "0.8.7" +backend = "cargo:cargo-llvm-cov" + +[[tools."cargo:cargo-nextest"]] +version = "0.9.137" +backend = "cargo:cargo-nextest" + +[[tools."cargo:wasm-opt"]] +version = "0.116.1" +backend = "cargo:wasm-opt" + +[[tools."cargo:wasm-pack"]] +version = "0.15.0" +backend = "cargo:wasm-pack" + +[[tools.java]] +version = "25.0.2" +backend = "core:java" + +[tools.java.options] +shorthand_vendor = "openjdk" + +[tools.java."platforms.linux-arm64"] +checksum = "sha256:671208d205e70c9805da45a483f670d49dd64654990a7b7223ccffb2abb070dd" +url = "https://download.java.net/java/GA/jdk25.0.2/b1e0dfa218384cb9959bdcb897162d4e/10/GPL/openjdk-25.0.2_linux-aarch64_bin.tar.gz" + +[tools.java."platforms.linux-x64"] +checksum = "sha256:555ce0821e4fe175ea50d54518cd6fbece9663c1998de529bc6ce429534457df" +url = "https://download.java.net/java/GA/jdk25.0.2/b1e0dfa218384cb9959bdcb897162d4e/10/GPL/openjdk-25.0.2_linux-x64_bin.tar.gz" + +[tools.java."platforms.macos-arm64"] +checksum = "sha256:7581b0d1752cd5acbf39e286c03f07b6cd6c205b562eb2fe753ff0253cf4c1bf" +url = "https://download.java.net/java/GA/jdk25.0.2/b1e0dfa218384cb9959bdcb897162d4e/10/GPL/openjdk-25.0.2_macos-aarch64_bin.tar.gz" + +[[tools.just]] +version = "1.51.0" +backend = "aqua:casey/just" + +[tools.just."platforms.linux-arm64"] +checksum = "sha256:ed7ec466b77709198fd4afed253dba0270203ba5eb1c006bee2b0139090284f5" +url = "https://github.com/casey/just/releases/download/1.51.0/just-1.51.0-aarch64-unknown-linux-musl.tar.gz" +url_api = "https://api.github.com/repos/casey/just/releases/assets/416466462" + +[tools.just."platforms.linux-x64"] +checksum = "sha256:c8f085ca3e885723c341d06243fc291b5abfdc8bbe3b2c076b117de490387b59" +url = "https://github.com/casey/just/releases/download/1.51.0/just-1.51.0-x86_64-unknown-linux-musl.tar.gz" +url_api = "https://api.github.com/repos/casey/just/releases/assets/416466152" + +[tools.just."platforms.macos-arm64"] +checksum = "sha256:61e3f1b8a545ff064b091eab4b6e14f8cc743ff15549be293b1e92f5b1467002" +url = "https://github.com/casey/just/releases/download/1.51.0/just-1.51.0-aarch64-apple-darwin.tar.gz" +url_api = "https://api.github.com/repos/casey/just/releases/assets/416466044" + +[[tools.markdownlint-cli2]] +version = "0.22.1" +backend = "npm:markdownlint-cli2" + +[[tools.node]] +version = "22.21.1" +backend = "core:node" + +[tools.node."platforms.linux-arm64"] +checksum = "sha256:c86830dedf77f8941faa6c5a9c863bdfdd1927a336a46943decc06a38f80bfb2" +url = "https://nodejs.org/dist/v22.21.1/node-v22.21.1-linux-arm64.tar.gz" + +[tools.node."platforms.linux-x64"] +checksum = "sha256:219a152ea859861d75adea578bdec3dce8143853c13c5187f40c40e77b0143b2" +url = "https://nodejs.org/dist/v22.21.1/node-v22.21.1-linux-x64.tar.gz" + +[tools.node."platforms.macos-arm64"] +checksum = "sha256:c170d6554fba83d41d25a76cdbad85487c077e51fa73519e41ac885aa429d8af" +url = "https://nodejs.org/dist/v22.21.1/node-v22.21.1-darwin-arm64.tar.gz" + +[[tools."npm:@napi-rs/cli"]] +version = "3.7.0" +backend = "npm:@napi-rs/cli" + +[[tools."npm:@redocly/cli"]] +version = "2.31.5" +backend = "npm:@redocly/cli" + +[[tools."npm:renovate"]] +version = "43.212.4" +backend = "npm:renovate" + +[[tools."npm:turbo"]] +version = "2.6.3" +backend = "npm:turbo" + +[[tools.oxfmt]] +version = "0.50.0" +backend = "npm:oxfmt" + +[[tools."pipx:sqlfluff"]] +version = "3.4.2" +backend = "pipx:sqlfluff" + +[[tools.protoc]] +version = "35.1" +backend = "aqua:protocolbuffers/protobuf/protoc" + +[tools.protoc."platforms.linux-arm64"] +checksum = "sha256:01bf9d08808c7f96678b63f4bd8efa559bb4f83d5a7a270d5edaf507f9d5d9cf" +url = "https://github.com/protocolbuffers/protobuf/releases/download/v35.1/protoc-35.1-linux-aarch_64.zip" +url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/445060236" + +[tools.protoc."platforms.linux-x64"] +checksum = "sha256:6930ebf62bd4ea607b98fff052596c6ee564b9835b4ce172c75a3f53ae9d91b7" +url = "https://github.com/protocolbuffers/protobuf/releases/download/v35.1/protoc-35.1-linux-x86_64.zip" +url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/445060247" + +[tools.protoc."platforms.macos-arm64"] +checksum = "sha256:193289af0470c6a1aada357d4fba0bbf8d78bfaac8b5e42ca30af2ef75583de2" +url = "https://github.com/protocolbuffers/protobuf/releases/download/v35.1/protoc-35.1-osx-aarch_64.zip" +url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/445060249" + +[[tools.rust]] +version = "nightly-2026-07-06" +backend = "core:rust" + +[tools.rust.options] +components = "clippy,llvm-tools-preview,miri,rust-analyzer,rust-src,rustc-codegen-cranelift-preview,rustfmt" + +[[tools.sentry-cli]] +version = "2.52.0" +backend = "aqua:getsentry/sentry-cli" + +[tools.sentry-cli."platforms.linux-arm64"] +checksum = "sha256:1db6a70093828bd3a017f585a2717e83ffb01f2aee671900669ae49de5261c4f" +url = "https://github.com/getsentry/sentry-cli/releases/download/2.52.0/sentry-cli-Linux-aarch64" +url_api = "https://api.github.com/repos/getsentry/sentry-cli/releases/assets/282142098" + +[tools.sentry-cli."platforms.linux-x64"] +checksum = "sha256:6149cf765590ef5adf2e8bc47ca236ba9100b38d600dd148b3bc435693c7e6a5" +url = "https://github.com/getsentry/sentry-cli/releases/download/2.52.0/sentry-cli-Linux-x86_64" +url_api = "https://api.github.com/repos/getsentry/sentry-cli/releases/assets/282142106" + +[tools.sentry-cli."platforms.macos-arm64"] +checksum = "sha256:4d1781961252c670a89b765ed192dc06caebf2e3bff7cc99ce9f817c56a8ab55" +url = "https://github.com/getsentry/sentry-cli/releases/download/2.52.0/sentry-cli-Darwin-arm64" +url_api = "https://api.github.com/repos/getsentry/sentry-cli/releases/assets/282142093" + +[[tools.taplo]] +version = "0.10.0" +backend = "aqua:tamasfe/taplo" + +[tools.taplo."platforms.linux-arm64"] +url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-aarch64.gz" +url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322597" + +[tools.taplo."platforms.linux-x64"] +url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-x86_64.gz" +url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322600" + +[tools.taplo."platforms.macos-arm64"] +url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-darwin-aarch64.gz" +url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257323110" + +[[tools."ubi:terrastruct/d2"]] +version = "0.7.1" +backend = "ubi:terrastruct/d2" + +[[tools.uv]] +version = "0.11.18" +backend = "aqua:astral-sh/uv" + +[tools.uv."platforms.linux-arm64"] +checksum = "sha256:6d895725333680bf7633ad635baff8e49dc45d3b52e00b2b3adf6ced41f2ebe2" +url = "https://github.com/astral-sh/uv/releases/download/0.11.18/uv-aarch64-unknown-linux-musl.tar.gz" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/435541698" +provenance = "github-attestations" + +[tools.uv."platforms.linux-x64"] +checksum = "sha256:a095a969fc8357f42e35652e0554525a47a29010ddb814bd82650c2ffa7d6d62" +url = "https://github.com/astral-sh/uv/releases/download/0.11.18/uv-x86_64-unknown-linux-musl.tar.gz" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/435541798" +provenance = "github-attestations" + +[tools.uv."platforms.macos-arm64"] +checksum = "sha256:1a7adf8dadae3b55853115d13a8bf564d219597ad13824b93b213706933863e5" +url = "https://github.com/astral-sh/uv/releases/download/0.11.18/uv-aarch64-apple-darwin.tar.gz" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/435541676" +provenance = "github-attestations" + +[[tools.yq]] +version = "4.53.2" +backend = "aqua:mikefarah/yq" + +[tools.yq."platforms.linux-arm64"] +checksum = "sha256:03061b2a50c7a498de2bbb92d7cb078ce433011f085a4994117c2726be4106ea" +url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_linux_arm64" +url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368442" +provenance = "cosign" + +[tools.yq."platforms.linux-x64"] +checksum = "sha256:d56bf5c6819e8e696340c312bd70f849dc1678a7cda9c2ad63eebd906371d56b" +url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_linux_amd64" +url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368450" +provenance = "cosign" + +[tools.yq."platforms.macos-arm64"] +checksum = "sha256:616b0a0f6a5b79d746f05a169c2b9bb40dee00c605ef165b9a1c1681bba738ac" +url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_darwin_amd64" +url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368453" +provenance = "cosign" From db084e0720fd3f93b16ce69949683e7faab9056c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 13 Jul 2026 12:43:26 +0000 Subject: [PATCH 5/5] Fix wrong-arch asset in mise.lock macos-arm64 yq entry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The macos-arm64 platform entry for yq pointed at the yq_darwin_amd64 asset (and carried its checksum), so Apple Silicon installs under lockfile mode would fetch the x86_64 binary. Point it at yq_darwin_arm64 with its sha256, verified two ways: computed locally from the downloaded asset (a Mach-O arm64 executable) and matching the SHA-256 column of the release's published `checksums` file (column mapping cross-checked against the lockfile's known-good linux_amd64 and darwin_amd64 values). url_api is omitted; it is optional in the schema and mise drops it itself when an entry's artifact URL changes — the next `mise lock` run will repopulate it. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01EcBiQCfeizMQJubtqXkiMs --- .config/mise/mise.lock | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.config/mise/mise.lock b/.config/mise/mise.lock index 719a4117566..78ada15e7e6 100644 --- a/.config/mise/mise.lock +++ b/.config/mise/mise.lock @@ -236,7 +236,6 @@ url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368450" provenance = "cosign" [tools.yq."platforms.macos-arm64"] -checksum = "sha256:616b0a0f6a5b79d746f05a169c2b9bb40dee00c605ef165b9a1c1681bba738ac" -url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_darwin_amd64" -url_api = "https://api.github.com/repos/mikefarah/yq/releases/assets/398368453" +checksum = "sha256:541ba2287560df70f561955e2d7f7e1cd00cf2a15a884f6b5c87a4bfa887bc07" +url = "https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_darwin_arm64" provenance = "cosign"