mise.lock format updates changing git status

[taiidani]

Hello! My team is currently using setup-mise with the vanilla setup. We like that this is bringing in the newest version of the mise binary and would prefer not to adopt the toil of locking it to a version and remembering to bump it.

- uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1

Unfortunately, this means that any time a new version of mise releases and changes the lock file format, it will emit the new lock file into the working copy and put git into a dirty state. This has downstream effects on any workflow that is sensitive to files being changed - GoReleaser being the most painful example since we have it running on a tag push.

Is there a way to have setup-mise not emit the new lock file and instead, say, error if the actual dependencies have diverged? I'm thinking behavior similar to npm ci. Something that makes the installation less sensitive to no-op formatting changes in the lock file.

Here are two recent examples that forced our team to swarm and PR all of our repositories:

[risu729]

mise install --locked is the mode for this. In locked mode, mise should use the existing lockfile entries and avoid rewriting mise.lock; it will fail instead if required locked data is missing. I verified a real mise install --locked install against a tracked mise.lock leaves git status clean.

With jdx/mise-action, pass it through the install_args input:

- uses: jdx/mise-action@v4
  with:
    install_args: "--locked"

If you already pass tool names there, include both, e.g. install_args: "--locked bun".

This comment was generated by an AI coding assistant.

[risu729]

Also, the github_attestations diff is actually not a "no-op formatting change". See jdx/mise#9741