From a6bb0e3f0057342e7485e433a7e5e290574347e1 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 12:42:52 +0000 Subject: [PATCH 1/2] chore(deps): update jdx/mise-action action to v5 --- .github/workflows/test-template.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test-template.yml b/.github/workflows/test-template.yml index 2b7d665..a3f5dbf 100644 --- a/.github/workflows/test-template.yml +++ b/.github/workflows/test-template.yml @@ -108,7 +108,7 @@ jobs: run: uvx semgrep@1.167.0 scan --config .semgrep.yml --metrics=off --error . # gitleaks is installed from the mise.toml pin (single source of truth); # install: false brings up the mise CLI only. - - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + - uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0 with: install: false - name: gitleaks From c978b47f4a00cb18a1561a354fc483457e6d0329 Mon Sep 17 00:00:00 2001 From: Ashlen Date: Fri, 16 Oct 2026 12:08:12 -0600 Subject: [PATCH 2/2] ci(scan): keep the GitHub token for the gitleaks step mise-action v5.1.1 stopped exporting MISE_GITHUB_TOKEN to later steps by default. The gitleaks step runs `mise install gitleaks` and `mise exec` afterwards, which query api.github.com; unauthenticated they share the runner's 60 req/h limit and can fail with 403. Set persist_github_token: true to restore the v4 behaviour. The workflow token is contents: read, so nothing new is granted. --- .github/workflows/test-template.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test-template.yml b/.github/workflows/test-template.yml index a3f5dbf..4875889 100644 --- a/.github/workflows/test-template.yml +++ b/.github/workflows/test-template.yml @@ -107,10 +107,13 @@ jobs: - name: semgrep run: uvx semgrep@1.167.0 scan --config .semgrep.yml --metrics=off --error . # gitleaks is installed from the mise.toml pin (single source of truth); - # install: false brings up the mise CLI only. + # install: false brings up the mise CLI only. persist_github_token + # re-exports MISE_GITHUB_TOKEN (v5.1.1+ default is off) so the later + # `mise install`/`mise exec` calls api.github.com authenticated. - uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0 with: install: false + persist_github_token: true - name: gitleaks run: | mise install gitleaks