fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

[hyperpolymath]

What was wrong

Anyone with the mise shell hook active got a screen of warnings on every cd into the repo:

• git, gofmt, cargo, go-task, gnu-sed, gnu-tar, gnu-grep, vitest and jest are not in the mise registry, so each produced Failed to resolve tool version list.
• [alias] is deprecated (use [tool_alias]), and its entries (build = "cargo build --release || …", test, lint, fmt) are command shortcuts, not tool aliases, so mise could do nothing with them.

The fix

mise.toml only: remove those nine tools and the [alias] table. Everything that resolves stays, including the zig = "0.16.0" pin.

Checked

• zig.yml still extracts the pin (awk over mise.toml finds zig = "0.16.0").
• language-blockers.yml only bans python|denojs|deno|rescript and PYTHON* env entries; none are present.
• Nothing else in the repo reads the removed entries (Justfile is the task entry point).
• Not run: mise itself is not installed in this sandbox, so the absence of warnings is unverified here. Please cd into a checkout of this branch to confirm.

Not covered

Only this repository. Other repos that carry a copy of this mise.toml need the same change.

---

Generated by Claude Code

[hyperpolymath]

The red governance / checks here (Well-Known, Allowlist Preflight, Actions lockfile verify) are not caused by this change, which only edits mise.toml. I read the Actions lockfile verify log: it dies at job setup with

Unable to resolve action `actions/checkout@3d3c42e5…`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

The same stale pin fails the same checks on main and on #927. The fix is regenerating .github/workflows/actions.lock, which the repo owner is doing separately. No fix to port here and nothing to push for this PR; I'll re-check once the lockfile PR lands.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 31 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f417c134-5846-412d-a993-1987d479c5a5

📥 Commits

Reviewing files that changed from the base of the PR and between e9197d2 and 81b895e.

📒 Files selected for processing: 1

• mise.toml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ac65623e-fa7b-47d1-a2ae-5d973b13d37f

📥 Commits

Reviewing files that changed from the base of the PR and between fd7db07 and e9197d2.

📒 Files selected for processing: 1

• mise.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⚠️ CI failures not shown inline: 26

GitHub Actions: Hypatia Security Scan / 0_hypatia _ Hypatia Neurosymbolic Analysis.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 SecurityEvents: write
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]lockfile verification did not produce a result for this action. Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action

GitHub Actions: Secret Scanner / 0_scan _ gitleaks.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / 1_scan _ shell-secrets.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / 2_scan _ rust-secrets.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Tests (E2E / Integration / Stress / Bench) / 0_Integration Status.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mecho "## Integration Test Results" >> "$GITHUB_STEP_SUMMARY"�[0m
 �[36;1mecho "" >> "$GITHUB_STEP_SUMMARY"�[0m
 �[36;1m�[0m
 �[36;1mtotal=0�[0m
 �[36;1mok=0�[0m
 �[36;1mfailed=0�[0m
 �[36;1m�[0m
 �[36;1mcheck() {�[0m
 �[36;1m  name="$1"�[0m
 �[36;1m  result="$2"�[0m
 �[36;1m  total=$((total + 1))�[0m
 �[36;1m  if [ "$result" = "success" ]; then�[0m
 �[36;1m    ok=$((ok + 1))�[0m
 �[36;1m    echo "- :white_check_mark: ${name}: ${result}" >> "$GITHUB_STEP_SUMMARY"�[0m
 �[36;1m  else�[0m
 �[36;1m    failed=$((failed + 1))�[0m
 �[36;1m    echo "- :x: ${name}: ${result:-<no result>} — this job did not complete, so its evidence is MISSING" >> "$GITHUB_STEP_SUMMARY"�[0m
 �[36;1m  fi�[0m
 �[36;1m}�[0m
 �[36;1m�[0m
 �[36;1mcheck build-images      "$BUILD_IMAGES"�[0m
 �[36;1mcheck integration-tests "$INTEGRATION_TESTS"�[0m
 �[36;1mcheck coverage-report   "$COVERAGE_REPORT"�[0m
 �[36;1m�[0m
 �[36;1mecho "" >> "$GITHUB_STEP_SUMMARY"�[0m
 �[36;1mecho "Checked ${ok} of ${total} integration jobs; ${failed} did not report success." >> "$GITHUB_STEP_SUMMARY"�[0m
 �[36;1mecho "integration-status: ok=${ok} failed=${failed} total=${total}"�[0m
 �[36;1m�[0m
 �[36;1mif [ "$total" -eq 0 ]; then�[0m
 �[36;1m  echo "::error::integration-status checked 0 jobs. A rollup with an empty subject cannot report success."�[0m
 �[36;1m  exit 1�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mif [ "$failed" -gt 0 ]; then�[0m
 �[36;1m  echo "::error::${failed} of ${total} integration jobs did not report success."�[0m
...
   BUILD_IMAGES: success
   INTEGRATION_TESTS: failure
   COVERAGE_REPORT: skipped
 ##[endgroup]
 integration-status: ok=1 failed=2 total=3
 ##[error]2 of 3 integration jobs did not report success.
 ##[error]Process completed with exit code 1.

GitHub Actions: Tests (E2E / Integration / Stress / Bench) / 2_Integration Tests.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]Run mix test --include integration
 �[36;1mmix test --include integration�[0m
 shell: /usr/bin/bash -e {0}
 env:
   CARGO_HOME: /home/runner/.cargo
   CARGO_INCREMENTAL: 0
   CARGO_TERM_COLOR: always
   CACHE_ON_FAILURE: true
   INSTALL_DIR_FOR_OTP: /home/runner/work/_temp/.setup-beam/otp
   INSTALL_DIR_FOR_ELIXIR: /home/runner/work/_temp/.setup-beam/elixir
   ARANGODB_URL: http://localhost:8529
   ARANGODB_DATABASE: hypatia
   ARANGODB_USER: root
   ARANGODB_***REDACTED_SECRET_ASSIGNMENT***
   DRAGONFLY_URL: redis://localhost:6379
   TEST_GITHUB_***REDACTED_SECRET_ASSIGNMENT***
 ==> gen_stage
 Compiling 10 files (.ex)
 Generated gen_stage app
 ==> mime
 Compiling 1 file (.ex)
 Generated mime app
 ==> phoenix_template
 Compiling 4 files (.ex)
 Generated phoenix_template app
 ===> Analyzing applications...
 ===> Compiling telemetry
 ==> thousand_island
 Compiling 18 files (.ex)
 Generated thousand_island app
 ==> jason
 Compiling 10 files (.ex)
 Generated jason app
 ==> phoenix_pubsub
 Compiling 12 files (.ex)
 Generated phoenix_pubsub app
 ==> plug_crypto
 Compiling 5 files (.ex)
 Generated plug_crypto app
 ==> hpax
 Compiling 4 files (.ex)
 Generated hpax app
 ==> plug
 Compiling 1 file (.erl)
 Compiling 42 files (.ex)
 Generated plug app
 ==> websock
 Compiling 1 file (.ex)
 Generated websock app
 ==> bandit
 Compiling 54 files (.ex)
 Generated bandit app
 ==> websock_adapter
 Compiling 4 files (.ex)
 Generated websock_adapter app
 ==> phoenix
 Compiling 75 files (.ex)
      warning: this check/guard will always yield the same result
      │
  301 │     if @requires_consolidation && config[:consolidate_protocols] do
      │     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      │
      └─ lib/phoenix/code_reloader/server.ex:301
      warning: this check/guard will always yield the same result
      │
  414 │       @requires_consolidation && status == :ok && config[:consolidate_protocols] ->
      │       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~...

GitHub Actions: Tests (E2E / Integration / Stress / Bench) / 3_E2E — Elixir Scanner Pipeline.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]Run bash tests/e2e.sh
 �[36;1mbash tests/e2e.sh�[0m
 shell: /usr/bin/bash -e {0}
 env:
   INSTALL_DIR_FOR_OTP: /home/runner/work/_temp/.setup-beam/otp
   INSTALL_DIR_FOR_ELIXIR: /home/runner/work/_temp/.setup-beam/elixir
 ##[endgroup]
 ═══════════════════════════════════════════════════════════════
   Hypatia — End-to-End Tests
 ═══════════════════════════════════════════════════════════════
 �[1mPreflight�[0m
 �[32m  Elixir available�[0m
 �[1mFormulaic diagnostics safety control�[0m
 �[32m  PASS: Legacy formulaic diagnostics are non-mutating and fail closed�[0m
 �[1mSection 1: Elixir scanner�[0m
 �[32m  PASS: Elixir compiles without warnings�[0m
 �[31m  FAIL: Elixir unit tests�[0m
 --- mix test: 1 failure block(s) ---
   1) test parses the repository's authoritative generated lockfile (Hypatia.Rules.ActionsLockTest)
 sed: couldn't write 157 items to stdout: Broken pipe
 ##[error]     test/rules/actions_lock_test.exs:277
...
 17:09:25.960 [error] Failed to read recipes directory: :enoent
 17:09:25.960 [error] Failed to read recipes directory: :enoent
 17:09:25.960 [error] Failed to read recipes directory: :enoent
 ##[error]Process completed with exit code 4.

GitHub Actions: Tests (E2E / Integration / Stress / Bench) / 7_stress-test.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mBINS="$(cargo metadata --no-deps --format-version 1 \�[0m
 �[36;1m  | jq -r '.packages[].targets[] | select(.kind[] == "bin") | .name' \�[0m
 �[36;1m  | sort -u | tr '\n' ' ')"�[0m
 �[36;1m[ -n "${BINS// /}" ] || { echo "::error::no bin targets resolved from cargo metadata"; exit 1; }�[0m
 �[36;1mecho "resolved binaries: $BINS"�[0m
 �[36;1mfor b in $BINS; do�[0m
 �[36;1m  [ -x "target/release/$b" ] \�[0m
 �[36;1m    || { echo "::error::target/release/$b missing or not executable"; exit 1; }�[0m
...
 ##[group]Run set -euo pipefail
...
 �[36;1m  done�[0m
 �[36;1mdone�[0m
 �[36;1mfailed=0�[0m
 �[36;1mfor i in "${!pids[@]}"; do�[0m
 �[36;1m  if ! wait "${pids[$i]}"; then�[0m
 �[36;1m    echo "::error::${names[$i]} exited non-zero under concurrent launch"�[0m
...
 ##[group]Run set -euo pipefail
...
 �[36;1m# in-log A/B is what identified the cause.�[0m
 �[36;1mfor b in $STRESS_BINS; do�[0m
 �[36;1m  if ( ulimit -v 1048576; "./target/release/$b" --help >/dev/null 2>&1 ); then�[0m
 �[36;1m    echo "  ok: $b runs under a 1GiB virtual-memory cap"�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "::error::$b failed under a 1GiB virtual-memory cap"�[0m

GitHub Actions: Security / 0_Security Status.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mwf=.github/workflows/security-policy.yml�[0m
 �[36;1m# Top-level job keys: two-space indent under `jobs:`, nothing deeper.�[0m
 �[36;1mmapfile -t all_jobs < <(awk '/^jobs:/{f=1;next} f && /^[^ #]/{exit} f && /^  [A-Za-z0-9_-]+:$/ {sub(/^[[:space:]]+/,""); sub(/:$/,""); print}' "$wf")�[0m
 �[36;1mneeds_list=$(sed -n '/^    needs:$/,/^    if:/p' "$wf" | sed -n 's/^      - //p')�[0m
 �[36;1mfailed=0�[0m
 �[36;1mecho "jobs in workflow: ${#all_jobs[@]}"�[0m
 �[36;1mecho "aggregator needs:"�[0m
 �[36;1mecho "$needs_list" | sed 's/^/  - /'�[0m
 �[36;1mfor j in "${all_jobs[@]}"; do�[0m
 �[36;1m  [ "$j" = "security-status" ] && continue�[0m
 �[36;1m  if ! grep -qx -- "$j" <<<"$needs_list"; then�[0m
 �[36;1m    echo "::error::orphan job '$j' is consulted by no aggregator -- its failure reaches nothing (#850)."�[0m
 �[36;1m    failed=1�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1mfor j in $needs_list; do�[0m
 �[36;1m  if ! grep -qx -- "$j" <<<"$(printf '%s\n' "${all_jobs[@]}")"; then�[0m
 �[36;1m    echo "::error::aggregator needs '$j' but no such job exists in this workflow (#847)."�[0m
...
 �[36;1mecho "ok: every non-aggregator job is named in the aggregator's needs"�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 awk: fatal: cannot open file `.github/workflows/security-policy.yml' for reading: No such file or directory
 sed: can't read .github/workflows/security-policy.yml: No such file or directory
 ##[error]Process completed with exit code 2.

GitHub Actions: Security / 1_Secret Detection (TruffleHog).txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mzero='0000000000000000000000000000000000000000'�[0m
 �[36;1mcase "$EVENT" in�[0m
 �[36;1m  pull_request)�[0m
 �[36;1m    base="$PR_BASE"�[0m
 �[36;1m    head="$PR_HEAD"�[0m
 �[36;1m    if [ -z "$base" ] || [ -z "$head" ] || [ "$base" = "$head" ]; then�[0m
 �[36;1m      echo "::error::Degenerate TruffleHog range (base='$base' head='$head'). Refusing to let an unscanned tree report as scanned."�[0m
...
 �[36;1m    echo "trufflehog mode: pull_request diff | range: ${base}..${head} | commits: ${n}"�[0m
 �[36;1m    ;;�[0m
 �[36;1m  push)�[0m
 �[36;1m    head="$PUSH_AFTER"�[0m
 �[36;1m    if [ -z "$head" ] || [ "$head" = "$zero" ]; then�[0m
 �[36;1m      echo "::error::push event with no head commit (after='${head}'). Nothing to scan is not the same as nothing found."�[0m
...
 �[36;1m      n=$(git rev-list --count "$head" 2>/dev/null || echo 0)�[0m
 �[36;1m      echo "trufflehog mode: push, new branch | range: (root)..${head} | commits: ${n}"�[0m
 �[36;1m    else�[0m
 �[36;1m      base="$PUSH_BEFORE"�[0m
 �[36;1m      if [ "$base" = "$head" ]; then�[0m
 �[36;1m        echo "::error::push event with before == after (${base}). An empty range is not a clean scan."�[0m
...
 �[36;1m    n=$(git rev-list --count --all 2>/dev/null || echo 0)�[0m
 �[36;1m    echo "trufflehog mode: whole git history | commits: ${n}"�[0m
 �[36;1m    ;;�[0m
 �[36;1mesac�[0m
 �[36;1mif [ "${n:-0}" -eq 0 ]; then�[0m
 �[36;1m  echo "::error::0 commits in the resolved range. A scanner with an empty subject cannot report clean."�[0m
...
 ##[group]Run ##########################################
...
 �[36;1m    head_commit=$(git rev-parse "$HEAD" 2>/dev/null) || true�[0m
 �[36;1m  else�[0m
 �[36;1m    head_commit=""�[0m
 �[36;1m  fi�[0m
 �[36;1m  if [ "$base_commit" == "$head_commit" ] ; then�[0m
 �[36;1m    echo "::error::BASE and HEAD commits are the same. TruffleHog won't scan anything. Please see documentation (https://github.com/truff...

GitHub Actions: Security / 5_Rust License & Ban Check.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]Run bail() {
 �[36;1mbail() {�[0m
 �[36;1m  printf '::error::install-action: %s\n' "$*"�[0m
...
 ##[group]Run set -euo pipefail
...
   │
 8 │ unmaintained = "warn"
   │                 ━━━━ unexpected value
  [ERROR] failed to deserialize config from '/home/runner/work/hypatia/hypatia/deny.toml'
 ##[error]Process completed with exit code 1.

GitHub Actions: Security / 6_Rust Dependency Audit.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mset +e�[0m
 �[36;1mcargo audit --json > rust-audit-report.json�[0m
 �[36;1mrc=$?�[0m
 �[36;1mset -e�[0m
 �[36;1mif [ ! -s rust-audit-report.json ] || ! jq -e '.vulnerabilities' rust-audit-report.json >/dev/null 2>&1; then�[0m
 �[36;1m  echo "::error::cargo audit produced no parsable report (exit ${rc}). A crashed scanner is not a clean scan."�[0m
...
 �[36;1mvulns=$(jq -r '.vulnerabilities.count // 0' rust-audit-report.json)�[0m
 �[36;1mwarn_classes=$(jq -r '.warnings | keys | length // 0' rust-audit-report.json)�[0m
 �[36;1mecho "cargo-audit advisory database scan: vulnerabilities=${vulns} warning-classes=${warn_classes} (report: rust-audit-report.json)"�[0m
 �[36;1mecho "advisories found: ${vulns} | warning classes: ${warn_classes}"�[0m
 �[36;1mif [ "${vulns}" -gt 0 ]; then�[0m
 �[36;1m  echo "::error::cargo audit found ${vulns} vulnerable advisories in the dependency tree. This job fails on its own findings (#849)."�[0m
...
   CARGO_INCREMENTAL: 0
   CARGO_TERM_COLOR: always
 ##[endgroup]
 cargo-audit advisory database scan: vulnerabilities=11 warning-classes=3 (report: rust-audit-report.json)
 advisories found: 11 | warning classes: 3
 ##[error]cargo audit found 11 vulnerable advisories in the dependency tree. This job fails on its own findings (#849).
...
 �[0m�[0m�[1m�[33mCrate:    �[0m chacha20
 �[0m�[0m�[1m�[33mVersion:  �[0m 0.10.0
 �[0m�[0m�[1m�[33mWarning:  �[0m yanked
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / 1_governance _ Language _ package anti-pattern policy.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 2_governance _ Workflow security linter.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 3_governance _ Trusted-base reduction policy.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 4_governance _ Exemption ratchet.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 5_governance _ Check Workflow Staleness.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 6_governance _ Licence consistency.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 7_governance _ Live Actions policy (credentialed advisory).txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 8_governance _ Debt ratchet.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 9_governance _ Guix packaging policy (Nix retired).txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 10_governance _ Code quality + docs.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action

GitHub Actions: Governance / 11_governance _ Well-Known (RFC 9116 + RSR).txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 12_governance _ Security policy checks.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 13_governance _ Actions lockfile verify.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 14_governance _ Allowlist Preflight.txt: fix(mise): drop tools the registry cannot resolve and the invalid [alias] table

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

🔇 Additional comments: 2

mise.toml: 2

4-5: LGTM!

25-28: 🎯 Functional Correctness

The request is not an actionable finding. The diff removes the reported unresolved tools and the [alias] table, but no warning or failed configuration load is established. The repository also defines no requirement to report a successful mise load.

📝 Summary

Summary by CodeRabbit

• Configuration
  • The development tool configuration no longer includes cargo, go-task, or gofmt.
  • Shell and testing tools, along with task shortcuts, have also been removed from the configuration.
  • The existing NODE_ENV setting remains unchanged.

The mise configuration adds comments to the Rust and Go tool entries. It removes the cargo, go-task, gofmt, shell-tool, and testing-tool entries, plus the [alias] shortcuts. The [env] section and NODE_ENV value remain unchanged.

Changes: mise configuration

Layer / File(s)	Summary
Tool entries and aliases mise.toml	The Rust and Go entries gain comments. The cargo, go-task, gofmt, shell-tool, and testing-tool entries and the [alias] shortcuts are removed. The [env] section and NODE_ENV value remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to e9197

No actionable issue remains from this configuration change; it is ready to merge after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description check		The description clearly explains the unresolved mise tools, the deprecated [alias] table, the retained Zig pin, and the validation performed.
Title check		The title clearly identifies the main change: removing unresolved mise tools and the invalid [alias] table.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🛠️ Fix failing CI checks

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T23:04:23.663179Z	—	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.

⏭️ Checks skipped: 9 · already failing on `main` (not caused by this PR)

• GitHub Actions: Hypatia Security Scan / 0_hypatia _ Hypatia Neurosymbolic Analysis.txt
• GitHub Actions: Secret Scanner / 0_scan _ gitleaks.txt
• GitHub Actions: Secret Scanner / 1_scan _ shell-secrets.txt
• GitHub Actions: Secret Scanner / 2_scan _ rust-secrets.txt
• GitHub Actions: Tests (E2E / Integration / Stress / Bench) / 0_Integration Status.txt
• GitHub Actions: Tests (E2E / Integration / Stress / Bench) / 2_Integration Tests.txt
• GitHub Actions: Tests (E2E / Integration / Stress / Bench) / 3_E2E — Elixir Scanner Pipeline.txt
• GitHub Actions: Tests (E2E / Integration / Stress / Bench) / 7_stress-test.txt
• GitHub Actions: Security / 0_Security Status.txt

[coderabbitai]

Add Carrot credits or activate Agent usage billing to use Autofix

[hyperpolymath]

CodeRabbit's autofix pushed 43c2623 to this branch: a new deny.toml and a Cargo.lock rewrite. Neither belongs in a mise.toml-only change, and its deny.toml conflicted with the one now on main (the conflict that made this PR un-mergeable). I reverted it in 302947e (a normal commit, no force-push) and merged main in 81b895e. The PR diff against main is mise.toml only again.

The governance /, scan / and hypatia / failures on the earlier commits were the stale actions.lock pin, which #934 repaired on main. This push re-runs them on the repaired lockfile, so I'll check them rather than assume. The autofix is unticked and I'd leave it that way for this PR.

---

Generated by Claude Code