I don't think we support this but we should

Alright so the IT folks at my work talked to the GHE folks and apparently there are currently no plans to support this feature for enterprise server (yet). Does it make sense to just disable this check for GitHub tools from non-default api endpoints? Feels weird though. Any ideas on what the correct approach is here?

Good question — and you're right that it feels weird. The cleanest answer in mise's case is "yes, skip when the tool resolves to a custom api_url":

• The GHE Server attestations endpoint doesn't exist, so every verification attempt is guaranteed to fail. The current global MISE_GITHUB_ATTESTATIONS=false workaround forces you to weaken the default for every github.com tool too, which is exactly the wrong tradeoff.
• For tools that do resolve to https://api.github.com, behavior stays the same — attestations still verified by default.
• SLSA provenance is asset-based (the .intoto.jsonl lives next to the release asset), not API-based, so SLSA verification still runs on GHE if the release publishes provenance.
• If/when GHE Server adds the endpoint, we can revisit and either flip the default back or add an opt-in setting.

Patched in #9486. Once that lands you should be able to drop the per-invocation env var and let your github.com tools keep their attestation guarantees.

This comment was generated by an AI coding assistant.

thanks so much!