build(deps): update project tools 2026-07

[alexey1312]

Monthly tool refresh. Every version was verified against the actual project before being committed (mise x tool@version on the real config/sources), one commit per tool.

Applied

Tool	Previous	Updated	Verification
actionlint	1.7.11	1.7.12	actionlint — 0 findings; new cron timezone check does not apply (no scheduled workflows)
git-cliff	2.12.0	2.13.1	git-cliff --unreleased renders; cliff.toml schema unchanged
usage	3.2.0	4.0.0	usage generate completion zsh OK. The 4.0.0 major only marks Rust structs #[non_exhaustive] for usage-lib dependents — we consume the prebuilt CLI, so no impact. KDL spec format unchanged
dprint	0.53.1	0.55.2	dprint check clean. The two 0.55.0 breaking changes (additive plugin associations, case-sensitive globs) don't affect our dprint.json
swiftlint	0.63.2	0.63.3	swiftlint lint --strict Sources Tests clean — the 4 new default-on rules (redundant_final, invisible_character, variable_shadowing, legacy_uigraphics_function) produce no violations. Deliberately not 0.65.0 — see Skipped
xcsift	1.2.0	1.3.1	Validated on a real swift build: status: success on success, status: failed + error count on a broken build — identical to 1.2.0. Picks up the os_log/CoreData noise filter that addresses the false positive documented in troubleshooting.md
swiftformat	0.60.1	0.62.1	swiftformat Sources Tests --lint → 0/458 files require formatting (see config note below)
hk	1.39.0	1.53.0	hk check --all exit 0 (requires the hk.pkl package bump below)
pkl	0.31.1	0.32.1	mise run codegen:pkl output is byte-identical to what's committed, modulo the known stripped trailing newline. Also patches two package-cache path-traversal advisories (GHSA-87qh-25w9-mh34, GHSA-fgvf-hh2w-cxff) that affect 0.31.1

Config changes required by the bumps

Three bumps could not land as a version-only edit:

1. .swiftformat — 0.62.0 split the opt-in wrapConditionalBodies rule into wrapIfStatementBodies / wrapIfExpressionBodies / wrapGuardStatementBodies and turned the two wrapIf* halves on by default. Left alone this reformats 36 files / 253 sites. Both are explicitly disabled to keep existing single-line if bodies, so this PR contains zero source reformatting. Enabling them is a separate style decision.
2. hk.pkl — hk 1.47+ evaluates hk.pkl with the built-in pklr instead of the external pkl CLI, and pklr rejects the old package schema: Eval error: undefined variable: extra_files. The hk@1.28.0 package URI is bumped to hk@1.53.0 in the same commit.
3. Schemas/generator-settings.pkl — pkl 0.32 treats package:// and projectpackage:// as distinct module identities, so codegen died with Module version conflict: ... pkl.swift.GeneratorSettings. It now amends the project dependency @pkl.swift/GeneratorSettings.pkl. Note this makes codegen require pkl 0.32+ (it no longer runs on 0.31.1), which the pinned version guarantees.

mise.lock is refreshed per tool. mise lock appends rather than replaces, so stale version blocks were pruned (one leftover actionlint 1.7.11 block is dropped in its own commit).

Skipped

Tool	Current	Latest	Reason
swiftlint	0.63.3	0.65.0	Regression, bisected to 0.64.0: SwiftLint no longer honors excluded: when handed explicit file paths. hk runs swiftlint lint --strict {{files}} in batch mode, so Sources/ExFigConfig/Generated/*.pkl.swift gets linted and hk check --all fails with file_length / type_name / redundant_string_enum_value errors. Reproducible in one line: swiftlint lint --strict --quiet Sources/ExFigConfig/Generated/Lint.pkl.swift → clean on 0.63.3, 1 error on 0.64.0+. Revisit once upstream restores exclusion for explicit paths

Nothing else is held back — the GitHub Actions majors below were reviewed and taken.

GitHub Actions

All five pending bumps are majors, each reviewed against how this repo actually invokes the action. actionlint passes after every commit.

Action	Previous	Updated	Breaking change	Applies here?
actions/checkout	v6	v7	ESM migration + fork-PR checkout blocked for pull_request_target / workflow_run	No — neither trigger exists in this repo (only push, pull_request, tags, workflow_dispatch). The same restriction was backported to v6.1.0, which the floating @v6 tag already resolved to
actions/cache	v5	v6	ESM migration; Node 24 runtime (already required since v5.0.1, runner >= 2.327.1)	No — all runners are GitHub-hosted (macos-15, ubuntu-latest, windows-latest)
actions/upload-pages-artifact	v4	v5	Internal upload-artifact v4 -> v7; adds include-hidden-files input	No — only path: docs is passed; dotfile exclusion already landed in v4
softprops/action-gh-release	v2	v3	Runtime Node 20 -> Node 24	No — runs on ubuntu-latest. v3.0.2 also fixes publishing a prerelease over an existing draft and unreliable small-asset uploads, both of which this release job exercises
compnerd/gha-setup-swift	v0.3.0	v0.4.0	PR #47 renamed branch -> swift-version and tag -> swift-build	Old names still work (marked [DEPRECATED]), so the bump is compatible. Migrated to the new names in a separate commit anyway

Already on their latest major: actions/deploy-pages@v5, actions/download-artifact@v8, actions/upload-artifact@v7, jdx/mise-action@v4, orhun/git-cliff-action@v4.

Coverage gap: this PR's CI exercises checkout, cache and gha-setup-swift (Windows job in ci.yml). action-gh-release@v3 and upload-pages-artifact@v5 live in release.yml / deploy-docc.yml, which only run on a tag push — they are unverified until the next release/docs deploy.

Not verified locally

mise run build and mise run test could not be run. The package requires Swift tools 6.3 (.swift-version = 6.3.0) but this machine has 6.2.4 from Xcode and swiftly has no release toolchain installed, so swift build fails with package is using Swift tools version 6.3.0 but the installed version is 6.2.4. This is pre-existing environment drift, unrelated to this PR — no Swift source is touched here. CI is the gate for the build/test paths.

One cosmetic side effect worth knowing: mise run lint pipes SwiftLint output through xcsift, and since that isn't a build log, xcsift 1.3.1 now prints status: incomplete where 1.2.0 printed status: success. Exit code is unchanged (0) and CI gates on exit codes only, so nothing breaks — but the status line in that one task is misleading.

Follow-ups (not in this PR)

• hk.pkl pins TOOLCHAIN_DIR to ~/.local/share/mise/installs/swift/6.2.3, which no longer matches .swift-version (6.3.0).
• The mise.toml comment on pkl still says "for hk.pkl", but hk now uses its own embedded pklr — pkl is kept for codegen:pkl.
• mise run format-check pipes hk check --all through grep -E '^(✔|✗|hk )' under set -o pipefail. Only one hk line matches that pattern, so if hk ever stops printing it the task fails with no diagnostic.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.