ci: move from aqua to mise

.github/workflows/dagger-update.yaml

@@ -32,52 +32,32 @@ jobs:
           # https://github.com/marketplace/actions/add-commit#working-with-prs
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.ref }}
-      - name: generate app token
-        id: generate_app_token
-        if: "! github.event.pull_request.head.repo.fork"
-        # yamllint disable-line rule:line-length
-        uses: suzuki-shunsuke/github-token-action@350d7506222e3a0016491abe85b5c4dd475b67d1 # v0.2.1
-        with:
-          github_app_id: ${{ secrets.GH_APP_ID }}
-          github_app_private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-          github_app_permissions: >-
-            { "contents": "write" }
-          github_app_repositories: >-
-            ["${{github.event.repository.name}}"]
-      - name: install aquas (using default token)
-        # yamllint disable-line rule:line-length
-        uses: aquaproj/aqua-installer@11dd79b4e498d471a9385aa9fb7f62bb5f52a73c # v4.0.4
-        if: |
-          steps.generate_app_token.outputs.token_type == 'empty'
-          && ! github.event.pull_request.head.repo.fork
-        with:
-          policy_allow: "true"
-          aqua_version: v2.59.0 # renovate: depName=aquaproj/aqua
-          github_token: ${{ github.token }}
       # yamllint disable-line rule:line-length
-      - name: install aquas (using generated app token)
-        # yamllint disable-line rule:line-length
-        uses: aquaproj/aqua-installer@11dd79b4e498d471a9385aa9fb7f62bb5f52a73c # v4.0.4
-        if: |
-          steps.generate_app_token.outputs.token_type != 'empty'
-          && ! github.event.pull_request.head.repo.fork
+      - name: Generate GitHub token
+        # https://github.com/actions/create-github-app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: generate-token
+        if: "! github.event.pull_request.head.repo.fork"
         with:
-          policy_allow: "true"
-          aqua_version: v2.59.0 # renovate: depName=aquaproj/aqua
-        env:
-          AQUA_GITHUB_TOKEN: ${{ steps.generate_app_token.outputs.token }}
-      # yamllint disable-line rule:line-length
-      - uses: kevincobain2000/action-gobrew@aa328ee19c95750fa612256c0a3f9bad4810fc04 # v2
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write # create releases
+          permission-pull-requests: write # create release pull requests
+      - name: install mise
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
-          version: 1.23.1 # renovate: datasource=golang-version depName=go
+          install: true
+          cache: true
+          experimental: true
+          github_token: ${{ steps.generate-token.outputs.token }}
       - name: dagger develop
         run: |
           just goUpdates="${{ inputs.go-updates }}" develop
       - name: push changes with ghcp
         if: "! github.event.pull_request.head.repo.fork"
         env:
-          GITHUB_REPOSITORY: ${{ github.event.repository.name }}
-          GITHUB_TOKEN: ${{ steps.generate_app_token.outputs.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
         run: |
           set -eu
 
@@ -86,18 +66,25 @@ jobs:
             exit 1
           fi
 
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "::notice ::No lockfile changes needed"
+            exit 0
+          fi
+
           branch=${GITHUB_HEAD_REF:-} # https://github.com/int128/ghcp
           if [ -z "${branch}" ]; then
             branch="${GITHUB_REF_NAME}"
           fi
+
           GO_UPDATES_STR=""
           if [ "${{ inputs.go-updates }}" = "true" ]; then
             GO_UPDATES_STR=" + related golang updates"
           fi
+
           # shellcheck disable=SC2046
           # ^- we want it to split!
           ghcp commit -r "$GITHUB_REPOSITORY" -b "${branch}" \
             -m "chore(dagger): develop${GO_UPDATES_STR}" \
             $(git --no-pager diff --name-only)
-            echo "::notice ::changes pushed to branch, 'exit 1' to force checks"
+          echo "::notice ::changes pushed to branch, 'exit 1' to force checks"
           exit 1

.github/workflows/pr_mise_lock.yaml

@@ -0,0 +1,81 @@
+---
+name: mise
+on:
+  pull_request:
+    paths:
+      - .mise/config.toml
+      - .mise/mise.lock
+permissions: read-all
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+env:
+  MISE_EXPERIMENTAL: true
+jobs:
+  lock:
+    if: "! github.event.pull_request.head.repo.fork"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          # should be used for PRs only
+          # https://github.com/marketplace/actions/add-commit#working-with-prs
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
+      # yamllint disable-line rule:line-length
+      - name: Generate GitHub token
+        # https://github.com/actions/create-github-app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: generate-token
+        if: "! github.event.pull_request.head.repo.fork"
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write # create releases
+          permission-pull-requests: write # create release pull requests
+      - name: install mise
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        env:
+          MISE_LOCKED: 0 # disable "locked=true" for update
+        with:
+          install: true
+          install_args: aqua:int128/ghcp
+          cache: true
+          experimental: true
+          github_token: ${{ steps.generate-token.outputs.token }}
+      - name: mise lock
+        env:
+          MISE_LOCKED: 0 # disable "locked=true" for update
+        run: rm -f mise/mise.lock && mise lock # rm to prune
+      - name: push changes with ghcp
+        env:
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
+        run: |
+          set -eu
+
+          if ! ghcp -v; then
+            echo "::error ::int128/ghcp not found - needed to push."
+            exit 1
+          fi
+
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "::notice ::No lockfile changes needed"
+            exit 0
+          fi
+
+          branch=${GITHUB_HEAD_REF:-} # https://github.com/int128/ghcp
+          if [ -z "${branch}" ]; then
+            branch="${GITHUB_REF_NAME}"
+          fi
+          # shellcheck disable=SC2046
+          # ^- we want it to split!
+          ghcp commit -r "$GITHUB_REPOSITORY" -b "${branch}" \
+            -m "chore(mise): lock" \
+            $(git --no-pager diff --name-only)
+          echo "::notice ::changes pushed to branch, 'exit 1' to force checks"
+          exit 1

.mise/config.toml

@@ -0,0 +1,5 @@
+[tools]
+go = "1.26.3"
+"aqua:casey/just" = "1.51.0"
+"aqua:dagger/dagger" = "0.21.4"
+"aqua:int128/ghcp" = "1.15.3"