✨ feat(mise): refresh cooled release pin

Use mise-action's signed checksum verification before recording the
binary digest. Keep the seven-day cutoff in shared code so callers
cannot lower it.

Author: gaborbernat

README.md

@@ -152,6 +152,35 @@ changes release inputs, including a workspace member's `pyproject.toml` or a sec
 formatting job runs `prek`; the writer checks patch paths and modes. Its `changed` output is `true` only when the
 refresh produces a patch. Neither mode pushes a branch or requests a write token.
 
+## Refresh a pinned mise binary
+
+`refresh-mise-pin` updates one named `jdx/mise-action` step in a release workflow. It selects the newest stable mise
+GitHub Release published at least seven days ago, installs that version through the pinned mise Action, and compares the
+installed executable with the release asset digest. The mise Action verifies the download against mise's minisign-signed
+checksum file. The refresh Action fails if the named step is missing or duplicated, its version or digest is not
+literal, or the installed binary differs from the selected release. It changes only that step's `version` and `sha256`
+values and leaves the verified mise executable on `PATH` for the next step.
+
+Call it in a read-only Ubuntu job after checkout. `workflow` is the path under `.github/workflows`; `step-name` is the
+exact name of the mise step in that file. `github-token` needs public release read access. `changed` is `true` only when
+the two pins change; `version` omits the leading `v`, and `sha256` is the Linux x64 executable digest. The Action does
+not update `mise.lock` or open a PR.
+
+```yaml
+  - uses: tox-dev/github-workflows/refresh-mise-pin@SHA
+    id: mise
+    with:
+      workflow: .github/workflows/release.yaml
+      step-name: 🔧 Set up mise (JDKs)
+      github-token: ${{ github.token }}
+  - name: Refresh locked JDKs
+    run: mise lock --bump --minimum-release-age 7d
+```
+
+Include `.github/workflows/release.yaml` and `mise.lock` in the updater's artifact and App writer path allowlists. The
+writer should run in a separate job; this Action does not request its token. The seven-day cutoff is fixed and cannot be
+lowered by an input.
+
 The weekly updater freezes eligible hook revisions with `prek update --freeze --cooldown-days 7`. It then uses
 `release-creator hooks` to pin Python hook dependencies under the same cutoff and writes a patch when
 `.pre-commit-config.yaml` changes. The generation job has read-only repository permissions; the separate publish job

changelog.d/+mise-pin.feature.md

@@ -0,0 +1 @@
+Add a keyless Action to refresh the signed mise binary pin after its GitHub Release has aged seven days.

refresh-mise-pin/action.yml

@@ -0,0 +1,62 @@
+name: Refresh mise release pin
+description: Update a release workflow to a seven-day-old, signature-verified mise binary
+inputs:
+  workflow:
+    description: Repository-relative workflow containing the pinned mise step
+    required: true
+  step-name:
+    description: Exact name of the mise setup step in that workflow
+    required: true
+  github-token:
+    description: Token with read access to public GitHub releases
+    required: true
+outputs:
+  changed:
+    description: Whether the workflow's mise version or digest changed
+    value: ${{ steps.update.outputs.changed }}
+  version:
+    description: Selected mise version without the v prefix
+    value: ${{ steps.update.outputs.version }}
+  sha256:
+    description: SHA256 of the verified Linux x64 mise executable
+    value: ${{ steps.update.outputs.sha256 }}
+runs:
+  using: composite
+  steps:
+    - name: List upstream releases
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+      run: |
+        gh api --paginate \
+          --jq '.[] | {tag_name,published_at,prerelease,draft,assets:[.assets[] |
+            select(.name | endswith("-linux-x64")) | {name,digest}]} | @json' \
+          'repos/jdx/mise/releases?per_page=100' >"$RUNNER_TEMP/mise-releases.jsonl"
+    - name: Select seven-day-old release
+      id: select
+      shell: bash
+      run: |
+        python3 "$GITHUB_ACTION_PATH/../tools/refresh_mise_pin.py" select \
+          "$RUNNER_TEMP/mise-releases.jsonl" "$GITHUB_OUTPUT"
+    - name: Install signature-verified mise
+      uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
+      with:
+        version: ${{ steps.select.outputs.version }}
+        mise_dir: ${{ runner.temp }}/refresh-mise-pin
+        cache: "false"
+        install: "false"
+        env: "false"
+        export_path: "false"
+        add_shims_to_path: "false"
+    - name: Update the workflow pin
+      id: update
+      shell: bash
+      env:
+        WORKFLOW: ${{ inputs.workflow }}
+        STEP_NAME: ${{ inputs.step-name }}
+        VERSION: ${{ steps.select.outputs.version }}
+        EXPECTED_SHA256: ${{ steps.select.outputs.sha256 }}
+      run: |
+        python3 "$GITHUB_ACTION_PATH/../tools/refresh_mise_pin.py" update \
+          "$WORKFLOW" "$STEP_NAME" "$VERSION" "$EXPECTED_SHA256" \
+          "$RUNNER_TEMP/refresh-mise-pin/bin/mise" "$GITHUB_OUTPUT"