Fix mise-action sha256: extracted binary, not tarball - #17
Merged
george-elphick-talieisin merged 1 commit intoAug 22, 2026
Merged
Conversation
…ball First consumer to opt into toolchain-source: mise (caersid #292, run 32572052123) failed at the mise-action step: the pinned hash was for mise-v2026.8.10-linux-x64.tar.zst, but mise-action checks the installed mise binary. New value matches the official SHASUMS256.txt entry for mise-v2026.8.10-linux-x64 (no extension), independently re-verified. Diagnosed by the caersid session, which also confirmed the tarball hash was correct (ruling out tampering) before concluding config error. Claude-Session: https://claude.ai/code/session_012EuXdzh4NJzL5mxmsqRDzR
george-elphick-talieisin
deleted the
fix/mise-sha256-binary-not-tarball
branch
August 22, 2026 12:09
There was a problem hiding this comment.
Pull request overview
Corrects the mise-action SHA-256 pin for the extracted mise 2026.8.10 Linux x64 binary.
Changes:
- Updates the checksum.
- Clarifies verification behavior and platform scope.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One-line fix: mise-action's sha256 input verifies the EXTRACTED mise binary, not the downloaded tarball. Pinned value corrected to the official SHASUMS256.txt entry for mise-v2026.8.10-linux-x64 (re-verified from the release). Found by the first consumer run (caersid #292); the same run confirmed the hardened secret-scan + canary pass on a real config. Comment updated; linux-x64 only since the job hardcodes ubuntu-latest.
https://claude.ai/code/session_012EuXdzh4NJzL5mxmsqRDzR