chore(mise): add lockfile with multi-platform support and version pin (#946)

Author: pimlock

.github/workflows/branch-checks.yml

@@ -13,6 +13,37 @@ permissions:
   packages: read
 
 jobs:
+  mise-lockfile:
+    name: mise Lockfile
+    runs-on: build-amd64
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Mark workspace as safe for git
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Detect mise config changes
+        id: changed
+        uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11 # v42.1.0
+        with:
+          files: |
+            mise.toml
+            mise.lock
+
+      - name: Verify mise.lock is in sync with mise.toml
+        if: steps.changed.outputs.any_changed == 'true'
+        run: |
+          mise lock
+          if ! git diff --exit-code mise.lock; then
+            echo "::error::mise.lock is out of sync with mise.toml. Run 'mise lock' locally and commit the result." >&2
+            exit 1
+          fi
+
   license-headers:
     name: License Headers
     runs-on: build-amd64
@@ -25,7 +56,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Check license headers
         run: mise run license:check
@@ -46,7 +77,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Configure sccache remote cache
         if: vars.SCCACHE_MEMCACHED_ENDPOINT != ''
@@ -90,7 +121,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Install dependencies
         run: uv sync --frozen

.github/workflows/ci-image.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - 'deploy/docker/Dockerfile.ci'
       - 'mise.toml'
+      - 'mise.lock'
       - 'tasks/**'
       - '.github/workflows/ci-image.yml'
   workflow_dispatch:

.github/workflows/release-dev.yml

@@ -246,7 +246,7 @@ jobs:
         run: git fetch --tags --force
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Cache Rust target and registry
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
@@ -418,7 +418,7 @@ jobs:
         run: git fetch --tags --force
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Cache Rust target and registry
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
@@ -569,7 +569,7 @@ jobs:
         run: git fetch --tags --force
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Cache Rust target and registry
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2

.github/workflows/release-tag.yml

@@ -269,7 +269,7 @@ jobs:
         run: git fetch --tags --force
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Cache Rust target and registry
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
@@ -443,7 +443,7 @@ jobs:
         run: git fetch --tags --force
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Cache Rust target and registry
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
@@ -528,7 +528,7 @@ jobs:
         run: git fetch --tags --force
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Cache Rust target and registry
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2

.github/workflows/release-vm-dev.yml

@@ -153,7 +153,7 @@ jobs:
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Install zstd
         run: apt-get update && apt-get install -y --no-install-recommends zstd && rm -rf /var/lib/apt/lists/*
@@ -222,7 +222,7 @@ jobs:
         run: git fetch --tags --force
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Cache Rust target and registry
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
@@ -459,7 +459,7 @@ jobs:
         run: git fetch --tags --force
 
       - name: Install tools
-        run: mise install
+        run: mise install --locked
 
       - name: Cache Rust target and registry
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2

deploy/docker/Dockerfile.ci

@@ -65,18 +65,19 @@ RUN case "$TARGETARCH" in \
     && curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${gh_arch}.tar.gz" \
     | tar xz --strip-components=2 -C /usr/local/bin "gh_${GH_VERSION}_linux_${gh_arch}/bin/gh"
 
-# Install mise
+# Install mise (NOTE: keep this version in sync with mise.toml)
 ARG MISE_VERSION=v2026.4.20
 RUN curl https://mise.run | MISE_VERSION=$MISE_VERSION sh
 
 # Copy mise.toml and task includes, then install all tools via mise
 COPY mise.toml /opt/mise/mise.toml
+COPY mise.lock /opt/mise/mise.lock
 COPY tasks/ /opt/mise/tasks/
 WORKDIR /opt/mise
 RUN --mount=type=secret,id=MISE_GITHUB_TOKEN \
     export MISE_GITHUB_TOKEN="$(cat /run/secrets/MISE_GITHUB_TOKEN 2>/dev/null || true)" && \
     mise trust /opt/mise/mise.toml && \
-    env -u RUSTC_WRAPPER mise install && \
+    env -u RUSTC_WRAPPER mise install --locked && \
     mise reshim && \
     npm install -g "npm@${NPM_VERSION}" && \
     mise reshim && \