Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

chore(ci): pin the mise version in jdx/mise-action instead of installing latest

Open
  • Is something wrong?
#890 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
52/100
Issue type
Refactor
Clarity
Mostly clear
Activity status
Active
Tech stack
github-actions
Domain
ci-cd

Research direction

Review build.yml, security.yml, security-pr.yml, integ.yml, dead-code-pr.yml, upgrade-main.yml, and deploy.yml at their jdx/mise-action steps. Then read mise.toml and ADR-003 to understand the version floor and approval requirements. Done means the approved versioning choice is applied consistently across all seven workflows, with a drift check if maintainers require one.

Written by the indexing model from the issue text.

Description

v1
Summary

The 7 workflows that call jdx/mise-action pin the action by SHA (@…518 # v4.2.5) but pass no mise-version input, so each run installs the latest mise release. That's why the monorepo_root unknown-field warning (#887) never surfaced in CI — CI is always on a version ≥ the floor. For reproducibility and supply-chain determinism we may want CI to install a known mise version instead of "whatever is latest today".

Mechanism

jdx/mise-action exposes a version: input ("The version of mise to use. If not specified, will use the latest release.") and honors a MISE_VERSION env var. Example:

- uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
  with:
    cache: true
    version: 2026.7.11   # or a pinned newer version, kept in sync with mise.toml min_version

Note: mise-action does not read min_version from mise.toml to select a version — the floor is enforced by the mise binary post-install. So the action pin is an independent lever. (Also: pin to a published release — 2026.7.8–2026.7.10 were tagged but never released, so a pin to those would fail to install; 2026.7.11 is the first installable release carrying monorepo_root.)

Affected workflows

build.yml, security.yml, security-pr.yml, integ.yml, dead-code-pr.yml, upgrade-main.yml, deploy.yml (each at the jdx/mise-action step).

Open questions for triage
  • Pin to an exact version (max reproducibility, needs periodic bumps — possibly via the existing upgrade-main flow) vs. leave latest (zero maintenance, non-deterministic).
  • If pinned, keep it ≥ the mise.toml min_version floor and add a drift check.
Notes

Optional hardening; deliberately kept out of #888 (min_version floor fix). Needs maintainer approved + assignment before implementation (ADR-003).

Dominant language
TypeScript
Stars
161
Forks
50
Avg merge
3d 16h
Merged PRs (30d)
15

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws-samples/sample-autonomous-cloud-coding-agents

All issues in aws-samples/sample-autonomous-cloud-coding-agents

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.