Cache mise tools in ghcr.io

.github/actions/install-mise-tools/action.yaml

@@ -33,6 +33,44 @@ runs:
       with:
         install-action-tools: ${{ inputs.install-action-tools }}
 
+    # Seed the mise data dir from this platform's GHCR store before installing.
+    # Every job used to cold-install every tool, and each github:/aqua tool costs api.github.com calls
+    # (version lists, artifact-attestation verification) against the repo installation's shared 5000/hr
+    # bucket; a push's ~30 parallel jobs drained it and `mise install` died with
+    #
+    #     mise ERROR Failed to install github:benhoyt/goawk@latest: GitHub artifact attestations
+    #     verification error ...: API error: GitHub API returned 403 Forbidden
+    #     "message": "API rate limit exceeded for installation. ..."
+    #
+    # observed on commit 5c08a759202d166ac9fac48f5e54ec998d5fcb6e at
+    # https://github.com/edge-toolkit/core/actions/runs/31659062139/job/94319942583. The store is one OCI
+    # image per platform, published exclusively by a maintainer running `mise run push-mise-tools` on a
+    # machine of that platform -- CI only ever reads (no workflow holds packages:write), so a compromised
+    # workflow cannot poison the store. The image is flattened into the data dir with `crane export`; the
+    # `mise install` that follows then verifies mostly-installed tools with near-zero API traffic. Any
+    # restore failure (store not yet published, or a token that can't read it) falls through to the plain
+    # cold install.
+    - name: Restore mise tools from GHCR
+      shell: bash --noprofile --norc -euo pipefail {0}
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+      run: |
+        # CI dogfoods the same `pull-mise-tools` task local devs run, not its own copy of the pull logic.
+        # The task self-installs its own tools, but the ghcr login below runs BEFORE it, so crane is
+        # installed up front here. (An explicit install also dodges a `mise x` quirk: it has been seen
+        # exec-failing on the very call that triggers a tool's install -- "couldn't exec process: No such
+        # file or directory".)
+        mise install crane
+        # crane's login writes the standard ~/.docker/config.json for the task's pull.
+        # printf-pipe rather than a `<<<` herestring: this step's declared bash has herestrings, but the
+        # repo's Windows task shell (busybox ash) does not, and this line is the kind that gets copied.
+        printf %s "$GITHUB_TOKEN" | mise x crane -- crane auth login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
+        if mise run pull-mise-tools; then
+          echo "restored this platform's mise-tools store"
+        else
+          echo "store not restorable (not yet published, or unreadable with this token); cold install"
+        fi
+
     - name: Install mise tools
       id: install-mise-tools
       continue-on-error: true

.github/workflows/check.yaml

@@ -8,6 +8,9 @@ name: check
 permissions:
   id-token: write
   contents: write
+  # Read-only pull of the maintainer-published ghcr.io mise-tools store (install-mise-tools restore step).
+  # Never write: the stores are published only from a maintainer's machine via `mise run push-mise-tools`.
+  packages: read
 
 # this allows a subsequently queued workflow run to interrupt previous runs in pull requests only
 concurrency:

.github/workflows/docker-linux.yaml

@@ -143,12 +143,30 @@ jobs:
           # /var stragglers); `find ... -size +50M` for the individual heavyweights. Run in a throwaway container
           # so the host's writable layer doesn't tilt the numbers; find/du stderr noise (unreadable /proc entries
           # etc.) prints to the log but doesn't affect the sort pipeline.
-          echo "::group::et-test: largest dirs (depth 2, >=10M)"
-          docker run --rm et-test sh -c "du -h --threshold=10M --max-depth=2 / | sort -h | tail -50"
-          echo "::endgroup::"
-          echo "::group::et-test: individual files >50M"
-          docker run --rm et-test sh -c "find / -xdev -type f -size +50M -exec du -h {} + | sort -h | tail -50"
-          echo "::endgroup::"
+          #
+          # Both runs are gated on the tag existing locally: this step is `always()`, and when the build died
+          # before tagging, a bare `docker run et-test` falls through to pulling `et-test:latest` from Docker
+          # Hub -- failing this debug step with the misleading
+          #
+          #     docker: Error response from daemon: pull access denied for et-test, repository does not exist
+          #     or may require 'docker login': denied: requested access to the resource is denied
+          #
+          # on top of the real build error (observed on commit 5c08a759202d166ac9fac48f5e54ec998d5fcb6e at
+          # https://github.com/edge-toolkit/core/actions/runs/31659062139/job/94319942583), and handing
+          # execution to whoever squats that name on Docker Hub if the pull ever resolved. `--pull=never`
+          # keeps the registry unreachable even if the gate is edited away.
+          if docker image inspect et-test >/dev/null 2>&1; then
+            echo "::group::et-test: largest dirs (depth 2, >=10M)"
+            du_cmd="du -h --threshold=10M --max-depth=2 / | sort -h | tail -50"
+            docker run --rm --pull=never et-test sh -c "$du_cmd"
+            echo "::endgroup::"
+            echo "::group::et-test: individual files >50M"
+            find_cmd="find / -xdev -type f -size +50M -exec du -h {} + | sort -h | tail -50"
+            docker run --rm --pull=never et-test sh -c "$find_cmd"
+            echo "::endgroup::"
+          else
+            echo "et-test image not present (build failed before tagging); skipping in-image size report"
+          fi
 
       # Every cargo knob here is passed INTO the container, not set on the job.
       # The compile happens inside `docker run`, so a job-level env would never reach cargo.
@@ -170,9 +188,10 @@ jobs:
         env:
           LANE_ARGS: ${{ matrix.base == 'opensuse/leap:15.6' && '-e CARGO_BUILD_JOBS=2' || '' }}
         run: |
-          # $LANE_ARGS is a word-split flag list by design; do not quote it.
+          args="--rm --pull=never -e CARGO_INCREMENTAL=0 -e CARGO_PROFILE_DEV_DEBUG=0 $LANE_ARGS"
+          # $args is a word-split flag list by design; do not quote it.
           # shellcheck disable=SC2086
-          docker run --rm -e CARGO_INCREMENTAL=0 -e CARGO_PROFILE_DEV_DEBUG=0 $LANE_ARGS et-test mise run cargo-test
+          docker run $args et-test mise run cargo-test
 
       - name: Run mise check
-        run: docker run --rm et-check
+        run: docker run --rm --pull=never et-check

.github/workflows/docker-windows.yaml

@@ -128,14 +128,18 @@ jobs:
         env:
           IMAGE_TAG: ${{ steps.dockerfile.outputs.tag }}
         run: |
+          # `--pull=never` on every run of a locally-built tag.
+          # A bare name is also a valid Docker Hub reference, so if the local image were ever missing, docker
+          # would try to pull (and run) whatever squats that name upstream instead of failing with a clear
+          # "No such image".
           echo "::group::which rustpython"
-          docker run --rm "$IMAGE_TAG" cmd /c "mise where http:et-rp & where rustpython"
+          docker run --rm --pull=never "$IMAGE_TAG" cmd /c "mise where http:et-rp & where rustpython"
           echo "::endgroup::"
           echo "::group::rustpython --version"
-          docker run --rm "$IMAGE_TAG" cmd /c "mise exec -- rustpython --version"
+          docker run --rm --pull=never "$IMAGE_TAG" cmd /c "mise exec -- rustpython --version"
           echo "::endgroup::"
           echo "::group::rustpython -c hello"
-          docker run --rm "$IMAGE_TAG" cmd /c "mise exec -- rustpython -c \"print('et-rp ok')\""
+          docker run --rm --pull=never "$IMAGE_TAG" cmd /c "mise exec -- rustpython -c \"print('et-rp ok')\""
           echo "::endgroup::"
 
       - name: Build stage test
@@ -159,4 +163,4 @@ jobs:
       # `There is not enough space on the disk. (os error 112)` even after the disk-free step left 43 GB.
       - name: Run cargo-test
         if: matrix.base == 'servercore'
-        run: docker run --rm -e CARGO_INCREMENTAL=0 et-windows-test mise run cargo-test
+        run: docker run --rm --pull=never -e CARGO_INCREMENTAL=0 et-windows-test mise run cargo-test

.github/workflows/test.yaml

@@ -35,6 +35,11 @@ env:
 
 jobs:
   default:
+    # Read-only pull of the maintainer-published ghcr.io mise-tools store (install-mise-tools restore step).
+    # Never write: the stores are published only from a maintainer's machine via `mise run push-mise-tools`.
+    permissions:
+      contents: read
+      packages: read
     runs-on: ${{ matrix.os }}
     timeout-minutes: ${{ matrix.timeout }}
     # Override the workflow-level `shell: bash` default for Windows runs.
@@ -152,6 +157,11 @@ jobs:
   # `mingw` links that msvc archive into an x86_64-pc-windows-gnu binary with winlibs GCC. Separate from
   # the `default` job because they override the gnullvm default target rather than exercising it.
   override:
+    # Read-only pull of the maintainer-published ghcr.io mise-tools store (install-mise-tools restore step).
+    # Never write: the stores are published only from a maintainer's machine via `mise run push-mise-tools`.
+    permissions:
+      contents: read
+      packages: read
     runs-on: windows-latest
     timeout-minutes: 120
     strategy:

.mise/config.java.toml

@@ -47,8 +47,9 @@ MAVEN_ARGS = "--no-transfer-progress"
 # busybox's own sh applet -- but the Unix script's JAVACMD composition (`JAVACMD="$JAVA_HOME/bin/java"`, no
 # `.exe`) then fails its `[ -x "$JAVACMD" ]` test because on Windows the file is named `bin/java.exe`. Bare
 # `mvn.cmd` (and `cmd.exe /c mvn`) both fail in the all-langs MISE_ENV with "'mvn[.cmd]' is not recognized" --
-# the wrapping cmd.exe cannot see maven\bin in its inherited PATH (likely a length/encoding issue introduced
-# by the wider tool set; works fine with MISE_ENV=java alone). Use the absolute path to `mvn.cmd` instead:
+# the wrapping cmd.exe discards the over-long PATH it inherits, so maven\bin is not there to be found (which
+# is also why MISE_ENV=java alone works: its narrower tool set stays under cmd.exe's per-variable PATH limit).
+# Use the absolute path to `mvn.cmd` instead:
 # busybox-w32's spawnve detects `.cmd` and auto-wraps with cmd.exe, which runs the full path directly with no
 # PATH lookup required. `vars.maven_bin` is defined in config.windows.toml; vars merge across all loaded
 # configs.
@@ -60,17 +61,17 @@ mvn
 
 [tasks.build-ws-java-data1-module]
 description = "Build the java-data1 workflow module"
-run = "$MVN package"
+run = "\"$MVN\" package"
 shell = "bash -euo pipefail -c"
 
 # Namespaced aggregator picked up by the default config's globbed `check`.
 # The compile triggers maven-compiler-plugin with -Xlint:all -Werror + Error Prone.
 [tasks."check:java"]
 description = "Run Java checks (javac -Xlint:all -Werror, Error Prone)"
-run = "$MVN -q compile"
+run = "\"$MVN\" -q compile"
 shell = "bash -euo pipefail -c"
 
 [tasks."prefetch:java"]
 description = "Prefetch Java (Maven) dependencies"
-run = "$MVN dependency:resolve --quiet"
+run = "\"$MVN\" dependency:resolve --quiet"
 shell = "bash -euo pipefail -c"

.mise/config.kotlin.toml

@@ -28,19 +28,19 @@ gradle
 [tasks.build-ws-kotlin-data1-module]
 description = "Build the kotlin-data1 workflow module (Kotlin/Wasm -> WasmGC)"
 dir = "services/ws-modules/kotlin-data1"
-run = "$GRADLE --console=plain pkgDist"
+run = "\"$GRADLE\" --console=plain pkgDist"
 shell = "bash -euo pipefail -c"
 
 # Namespaced aggregator picked up by the default config's globbed `check`.
 # The compile runs kotlinc with allWarningsAsErrors (set in build.gradle.kts), the Kotlin analogue of -Werror.
 [tasks."check:kotlin"]
 description = "Run Kotlin checks (kotlinc allWarningsAsErrors via the Gradle compile)"
 dir = "services/ws-modules/kotlin-data1"
-run = "$GRADLE --console=plain compileKotlinWasmJs"
+run = "\"$GRADLE\" --console=plain compileKotlinWasmJs"
 shell = "bash -euo pipefail -c"
 
 [tasks."prefetch:kotlin"]
 description = "Prefetch Kotlin (Gradle plugin + Maven Central) dependencies"
 dir = "services/ws-modules/kotlin-data1"
-run = "$GRADLE --console=plain dependencies"
+run = "\"$GRADLE\" --console=plain dependencies"
 shell = "bash -euo pipefail -c"

.mise/config.maint.toml

@@ -508,11 +508,127 @@ step rustpython -m cowsay -t "rustpython lives via pip-only path"
 """
 shell = "bash -euo pipefail -c"
 
+# Publish this platform's mise tool tree to its per-platform GHCR store (maintainer-only).
+# The stores under ghcr.io/edge-toolkit/core/mise-tools/<os>-<arch> feed CI's install-mise-tools restore
+# step and the pull-mise-tools task, and are written ONLY from a maintainer's machine -- no workflow holds
+# packages:write, so a compromised workflow cannot poison what every job then executes. `mise oci build`
+# emits one content-addressed layer per tool; crane does the upload, skipping blobs the registry already
+# holds, so re-publishing after a config bump uploads just the changed tools. Each store carries
+# host-native binaries: run this on a machine of the platform being published. Needs a one-time
+# `docker login ghcr.io` (or `crane auth login ghcr.io`) with a packages:write PAT, and installs the full
+# language set first so the image matches what CI expects.
+#
+# crane pushes the layout rather than `mise oci push` because mise 2026.8.0's built-in registry client
+# trips GHCR's chunked blob-upload range rules on large layers and dies mid-push with
+#
+#     mise ERROR uploading blob sha256:0f89655a801ea25e9d3c000287ca276eb8e2b2f890ec3e393e2517facfd7cb9a
+#     mise ERROR HTTP status client error (416 Range Not Satisfiable) for url
+#     (https://ghcr.io/v2/edge-toolkit/core/mise-tools/macos-arm64/blobs/upload/3.4effcd8a-...)
+#
+# (observed locally on macos-arm64, mise 2026.8.0). Revisit once a mise release fixes the chunked upload.
+[tasks.push-mise-tools]
+depends = ["_setup-store-tools"]
+description = "Publish this platform's mise tool tree to its per-platform GHCR store (maintainer-only)"
+run = """
+coreutils="$(mise which coreutils)"
+crane="$(mise which crane)"
+detected=$("$coreutils" uname -sm)
+case "$detected" in
+  Darwin*arm64) plat=macos-arm64 ;;
+  Darwin*x86_64) plat=macos-x64 ;;
+  Linux*aarch64 | Linux*arm64) plat=linux-arm64 ;;
+  Linux*x86_64) plat=linux-x64 ;;
+  Windows*) plat=windows-x64 ;;
+  *) echo "unrecognised platform '$detected'" >&2 && exit 1 ;;
+esac
+ref="ghcr.io/edge-toolkit/core/mise-tools/${plat}:latest"
+out="target/scratch/mise-oci-${plat}"
+"$coreutils" rm -rf "$out"
+MISE_ENV="$ALL_LANGS" mise install
+MISE_ENV="$ALL_LANGS" mise run oci-build-store "$out"
+"$crane" push "$out" "$ref"
+"""
+shell = "bash -euo pipefail -c"
+
+# Publish the linux-x64 mise tool tree store from any host via docker (maintainer-only).
+# Lets a maintainer on a macOS laptop refresh the store CI's linux lanes restore from. Reuses the
+# Dockerfile's `build` stage -- the same canonical linux tool install CI's docker images use, with docker's
+# layer cache making repeats cheap -- then runs `mise oci build` inside the container onto a bind mount and
+# pushes the resulting OCI layout from the HOST with crane. Pushing host-side means registry credentials
+# never enter the container: the one-time `docker login ghcr.io` (keychain-backed on macOS) covers it. The
+# build secret lifts mise's anonymous GitHub rate limit; `gh auth token` supplies it when GITHUB_TOKEN
+# isn't already set. On arm64 hosts the amd64 build runs emulated -- the first build is slow (the toolchain
+# install runs under qemu/Rosetta); later runs reuse docker layers.
+[tasks.push-mise-tools-linux-x64]
+depends = ["_setup-store-tools"]
+description = "Publish the linux-x64 mise tools store via docker from any host (maintainer-only)"
+# docker itself is a host daemon, not a mise tool; everything else comes from the depends helper.
+run = """
+coreutils="$(mise which coreutils)"
+crane="$(mise which crane)"
+gh="$(mise which gh)"
+GITHUB_TOKEN="${GITHUB_TOKEN:-$("$gh" auth token)}"
+export GITHUB_TOKEN
+ref="ghcr.io/edge-toolkit/core/mise-tools/linux-x64:latest"
+out="target/scratch/mise-oci-linux-x64"
+"$coreutils" rm -rf "$out"
+"$coreutils" mkdir -p "$out"
+# Bare --build-arg forwards $BASE_IMAGE when set, falling back to the Dockerfile default otherwise.
+# (E.g. BASE_IMAGE=ubuntu:26.04 to test another base.) Keep the default: the store's consumers are the
+# hosted CI runners on ubuntu 24.04, and tools compiled during install (the go: backend build, any cargo:
+# fallback) link the build container's glibc -- a newer base risks GLIBC_2.xx-not-found breakage in the
+# restored tree.
+args="--platform linux/amd64 --target build --secret id=gh_token,env=GITHUB_TOKEN --build-arg BASE_IMAGE"
+# $args is a word-split flag list by design; do not quote it.
+# shellcheck disable=SC2086
+DOCKER_BUILDKIT=1 docker build $args -t et-mise-linux .
+mnt="$PWD/$out:/oci-out"
+docker run --rm --platform linux/amd64 -v "$mnt" et-mise-linux mise run oci-build-store /oci-out
+"$crane" push "$out" "$ref"
+"""
+shell = "bash -euo pipefail -c"
+
+# Verify every mise-tools GHCR store is public, so unauthenticated users can pull-mise-tools.
+# GHCR has NO API to change package visibility -- the packages REST surface is read/delete/restore only,
+# and the web UI's toggle posts a session-cookie form -- so flipping a store public is a one-time manual
+# click. This task automates everything around that click: it lists the org's container packages, prints
+# each store's visibility, and fails with the exact settings page URL for any still-private store (flip it
+# under Danger Zone -> Change visibility -> Public). Visibility survives later pushes, so each store needs
+# this exactly once, right after its first `push-mise-tools*` publish. The listing call needs gh auth with
+# the read:packages scope -- grant it once with `gh auth refresh -s read:packages`.
+[tasks.check-mise-tools-visibility]
+depends = ["_setup-store-tools"]
+description = "Verify every mise-tools GHCR store is public; print settings URLs for any still private"
+run = """
+gh="$(mise which gh)"
+jaq="$(mise which jaq)"
+json=$("$gh" api "/orgs/edge-toolkit/packages?package_type=container" --paginate)
+filter='.[] | select(.name | startswith("core/mise-tools/"))'
+report='.name + ": " + .visibility'
+still_private='select(.visibility != "public") | .name | @uri'
+echo "$json" | "$jaq" -r "$filter | $report"
+if [ -z "$(echo "$json" | "$jaq" -r "$filter | .name")" ]; then
+  echo "no mise-tools packages exist yet; publish one with push-mise-tools first" >&2
+  exit 1
+fi
+private=$(echo "$json" | "$jaq" -r "$filter | $still_private")
+if [ -z "$private" ]; then
+  echo "all mise-tools stores are public"
+  exit 0
+fi
+echo "still private -- make each public at its settings page (Danger Zone -> Change visibility):" >&2
+for p in $private; do
+  echo "  https://github.com/orgs/edge-toolkit/packages/container/$p/settings" >&2
+done
+exit 1
+"""
+shell = "bash -euo pipefail -c"
+
 # --- Bootstrap tasks for upstream-cache releases.
-# Idempotent gh release view+create -- safe to re-run. Each release's notes are the upstream project URL and
-# its license, nothing else (consumers can read the release body to know where the asset came from and under
-# what terms). Each release is marked --prerelease so it stays off the repo's "Latest release" badge
-# alongside the rp-v<N> release.
+# Idempotent gh release view+create -- safe to re-run.
+# Each release's notes are the upstream project URL and its license, nothing else (consumers can read the
+# release body to know where the asset came from and under what terms). Each release is marked --prerelease
+# so it stays off the repo's "Latest release" badge alongside the rp-v<N> release.
 [tasks.bootstrap-augeas-release]
 description = "Create the augeas-v1 GitHub release if it doesn't exist (idempotent)"
 run = """