[mise-lock] chore: migrate CI to mise-action

.github/actions.lock.yaml

@@ -1,5 +1,5 @@
 version: 1
-generated_at: 2026-06-15T13:14:55Z
+generated_at: 2026-08-21T11:40:11Z
 internal: []
 trusted:
   - action: actions/checkout
@@ -8,14 +8,7 @@ trusted:
     occurrences:
       ee0669bd1cc54295c223e0bb666b733df41de1c5:
         .github/workflows/docker-build.yml:
-          - jobs.build.steps.[0].uses
-        .github/workflows/python-package.yml:
-          - jobs.build.steps.[0].uses
-  - action: actions/setup-python
-    refs:
-      - d09bd5e6005b175076f227b13d9730d56e9dcfcb
-    occurrences:
-      d09bd5e6005b175076f227b13d9730d56e9dcfcb:
+          - jobs.build.steps.[1].uses
         .github/workflows/python-package.yml:
           - jobs.build.steps.[1].uses
 external:
@@ -25,7 +18,24 @@ external:
     occurrences:
       0e68818ea37ba7728f417f03a58e06e68d9d2592:
         .github/workflows/docker-build.yml:
-          - jobs.build.steps.[1].uses
+          - jobs.build.steps.[2].uses
+  - action: step-security/harden-runner
+    refs:
+      - 9af89fc71515a100421586dfdb3dc9c984fbf411
+    occurrences:
+      9af89fc71515a100421586dfdb3dc9c984fbf411:
+        .github/workflows/docker-build.yml:
+          - jobs.build.steps.[0].uses
+        .github/workflows/python-package.yml:
+          - jobs.build.steps.[0].uses
+  - action: step-security/mise-action
+    refs:
+      - 2796166110dee826668caddd4bffedae5116e7cd
+    occurrences:
+      2796166110dee826668caddd4bffedae5116e7cd:
+        .github/workflows/python-package.yml:
+          - jobs.build.steps.[2].uses
 local: []
 docker: []
 dynamic: []
+nested_floating_deps: []

.github/workflows/python-package.yml

@@ -29,10 +29,15 @@ jobs:
         api-key: ${{ secrets.GH_FRESHAENGINEERING_STEP_SECURITY_API_KEY }}
 
     - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@d09bd5e6005b175076f227b13d9730d56e9dcfcb # v4.0.0
+    - name: Setup mise
+      uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
+      env:
+        MISE_PYTHON_GITHUB_ATTESTATIONS: false
       with:
-        python-version: ${{ matrix.python-version }}
+        version: '2026.8.12'
+        mise_toml: |
+          [tools]
+          python = "${{ matrix.python-version }}"
 
     - name: Install dependencies
       run: |

.gitignore

@@ -39,3 +39,5 @@ legacy/err.egg-info/
 
 # tox
 .tox
+
+.github/actions.lock.yaml

mise.toml

@@ -0,0 +1,2 @@
+[tools]
+python = "3.10"

setup.py

@@ -30,9 +30,9 @@
     "webtest==3.0.0",
     "setuptools==60.5.0",
     "flask==2.0.2",
+    "werkzeug==2.0.3",  # flask 2.0.2 imports werkzeug.urls.url_quote, removed in werkzeug>=2.1
     "requests==2.27.1",
     "jinja2==3.0.3",
-    "pyOpenSSL==21.0.0",
     "colorlog==6.6.0",
     "markdown==3.3.6",
     "ansi==0.2.0",
@@ -44,6 +44,11 @@
 
 if py_version < (3, 8):
     deps.append("importlib-metadata==4.12.0")
+    # 26.2.0 requires Python >=3.8; 21.0.0 breaks against the latest
+    # cryptography it resolves unpinned (AttributeError: GEN_EMAIL)
+    deps.append("pyOpenSSL==24.0.0")
+else:
+    deps.append("pyOpenSSL==26.2.0")
 
 if py_version < (3, 9):
     deps.append("graphlib-backport==1.0.3")