From 3b6dccf1e6ae1cda0590ee995365cc18b9c24991 Mon Sep 17 00:00:00 2001 From: George Elphick Date: Sat, 22 Aug 2026 13:08:05 +0100 Subject: [PATCH] Fix mise-action sha256: it verifies the extracted binary, not the tarball First consumer to opt into toolchain-source: mise (caersid #292, run 32572052123) failed at the mise-action step: the pinned hash was for mise-v2026.8.10-linux-x64.tar.zst, but mise-action checks the installed mise binary. New value matches the official SHASUMS256.txt entry for mise-v2026.8.10-linux-x64 (no extension), independently re-verified. Diagnosed by the caersid session, which also confirmed the tarball hash was correct (ruling out tampering) before concluding config error. Claude-Session: https://claude.ai/code/session_012EuXdzh4NJzL5mxmsqRDzR --- .github/workflows/ci-pnpm.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci-pnpm.yml b/.github/workflows/ci-pnpm.yml index d452aec..d73a333 100644 --- a/.github/workflows/ci-pnpm.yml +++ b/.github/workflows/ci-pnpm.yml @@ -59,10 +59,13 @@ jobs: - if: inputs.toolchain-source == 'mise' uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 with: - # Must move together: sha256 is for mise-v-linux-x64.tar.zst - # (the asset mise-action downloads on ubuntu runners). + # Must move together: sha256 is the hash of the EXTRACTED mise + # binary (official SHASUMS entry for mise-v-linux-x64, + # no extension) — mise-action verifies the binary it installs, + # NOT the tarball it downloads. linux-x64 only; this job hardcodes + # ubuntu-latest, so no per-OS hash map is needed. version: 2026.8.10 - sha256: ccc3547c9ac00828f3794bfa6dfea39fbaac9b1dc8a84ed0f71df438304224bb + sha256: 1f5e8795d24073904ef20ba70c1250ad6389d8c5672226d152e0ed24909ba72f install: true cache: true