feat: support custom GitHub API base URL by jdx · Pull Request #45 · jdx/sigstore-verification

jdx · 2026-04-19T01:59:15Z

Summary

Adds a base_url option to GitHubSource and verify_github_attestation, so callers can verify attestations published on GitHub Enterprise Server instances (e.g. https://github.enterprise.com/api/v3) instead of always targeting api.github.com.
New surface (all additive, backward-compatible):
- GitHubSource::with_base_url(owner, repo, token, base_url)
- GitHubSource::with_client(owner, repo, client) — hand in a pre-built AttestationClient
- GitHubSource::builder() fluent builder
- verify_github_attestation_with_base_url(...) convenience wrapper mirroring verify_github_attestation
Existing GitHubSource::new and verify_github_attestation keep their current behavior (default to api.github.com).

Motivation

mise users who point the github backend at a GHES instance via api_url = \"https://github.enterprise.com/api/v3\" had their downloads succeed against GHES, but attestation verification then fell back to api.github.com and failed with a 401 because the GHES token isn't valid there. Details: jdx/mise#9176

The underlying AttestationClient::builder().base_url(...) already existed (#36); this PR plumbs it through the public GitHubSource and verify_github_attestation surfaces that callers actually use.

Test plan

cargo test — all existing tests still pass (10+6+3 in existing suites).
New tests/github_source_base_url.rs: GitHubSource::with_base_url, ::with_client, and ::builder() all route requests to the configured host and send the auth token; builder() surfaces missing-field errors.
New tests/verify_github_attestation_base_url.rs: end-to-end test of verify_github_attestation_with_base_url against a mockito server, asserting the request hits the custom host with the right auth header.
cargo clippy --all-targets -- -D warnings clean.
cargo fmt --all --check clean.

Note

Medium Risk
Moderate risk: changes how GitHub API clients are constructed and where auth tokens are sent, which can affect attestation fetching/verification behavior across hosts (dotcom vs GHES). Additive APIs and new tests reduce regression risk, but misconfiguration could lead to unexpected unauthenticated requests.

Overview
Enables attestation fetching and verify_github_attestation to target a custom GitHub API base URL (e.g. GitHub Enterprise Server) instead of always using api.github.com, by introducing verify_github_attestation_with_base_url and refactoring verification to build an AttestationClient with optional token + base URL.

Updates GitHubSource to support with_base_url, with_client, and a fluent builder() (with required-field validation), and adds mock-based tests to assert requests route to the configured host and include the expected auth/version headers. The changelog is updated to document the new capability.

^{Reviewed by Cursor Bugbot for commit dbe7653. Bugbot is set up for automated code reviews on this repo. Configure here.}

Adds a `base_url` to `GitHubSource` and `verify_github_attestation` so callers can verify attestations published on GitHub Enterprise Server instances (e.g. `https://github.enterprise.com/api/v3`) instead of always targeting `api.github.com`. - `GitHubSource::with_base_url(owner, repo, token, base_url)` - `GitHubSource::with_client(owner, repo, client)` for callers who need to configure the underlying `AttestationClient` directly - `GitHubSource::builder()` fluent builder - `verify_github_attestation_with_base_url(...)` convenience wrapper All existing entry points keep their current behavior and default to `api.github.com`, so the change is backward-compatible. Fixes the mise GHES attestation regression reported in jdx/mise#9176 where a tool configured with a custom `api_url` still had attestation verification dispatched to `api.github.com`, causing 401 Unauthorized with the GHES token.

greptile-apps · 2026-04-19T02:01:51Z

Greptile Summary

This PR plumbs the existing AttestationClient::builder().base_url(...) capability through the higher-level GitHubSource and verify_github_attestation public surfaces, enabling callers on GitHub Enterprise Server instances to route attestation API calls to their own host. The change is fully additive — GitHubSource::new and verify_github_attestation are unchanged, and the new entry points delegate to a shared verify_github_attestation_inner / GitHubSourceBuilder::build path that is well-exercised by new mockito tests.

Confidence Score: 5/5

Safe to merge — all changes are additive, backward-compatible, and well-tested.

No P0 or P1 findings. The implementation correctly scopes auth tokens to the configured base URL via the existing github_headers check, the builder validates required fields, and new mockito tests confirm routing and header behaviour across all three construction paths.

No files require special attention.

Important Files Changed

Filename	Overview
src/lib.rs	Adds `verify_github_attestation_with_base_url` and refactors the old implementation into a private `verify_github_attestation_inner`; logic is clean and backward-compatible.
src/sources/github.rs	Adds `with_base_url`, `with_client`, and a fluent `GitHubSourceBuilder` with required-field validation; delegates correctly to `AttestationClientBuilder` for URL and token handling.
tests/github_source_base_url.rs	Covers `with_base_url`, `with_client`, fluent builder routing + auth headers, and builder missing-field errors; comprehensive for the new surface.
tests/verify_github_attestation_base_url.rs	End-to-end mock test confirming `verify_github_attestation_with_base_url` routes to the custom host with the correct auth and API-version headers.
CHANGELOG.md	Adds an [Unreleased] entry for the new custom-base-URL feature.

Sequence Diagram

sequenceDiagram
    participant Caller
    participant verify_github_attestation_with_base_url
    participant verify_github_attestation_inner
    participant AttestationClientBuilder
    participant AttestationClient
    participant GHES as GitHub Enterprise Server (base_url)
    participant GH as api.github.com (default)

    Caller->>verify_github_attestation_with_base_url: (path, owner, repo, token, workflow, base_url)
    verify_github_attestation_with_base_url->>verify_github_attestation_inner: Some(base_url)
    verify_github_attestation_inner->>AttestationClientBuilder: .github_token(token)
    verify_github_attestation_inner->>AttestationClientBuilder: .base_url(base_url)
    AttestationClientBuilder->>AttestationClient: build()

    alt base_url provided
        AttestationClient->>GHES: GET /repos/{owner}/{repo}/attestations/{digest}
        GHES-->>AttestationClient: attestations[]
    else default (verify_github_attestation)
        AttestationClient->>GH: GET /repos/{owner}/{repo}/attestations/{digest}
        GH-->>AttestationClient: attestations[]
    end

    AttestationClient-->>verify_github_attestation_inner: attestations
    verify_github_attestation_inner-->>Caller: Ok(true) / Err(NoAttestations)

_{Reviews (2): Last reviewed commit: "docs: note predicate_type filter and tig..." | Re-trigger Greptile}

gemini-code-assist

Code Review

This pull request introduces support for custom GitHub API base URLs in GitHubSource and verify_github_attestation, enabling verification against GitHub Enterprise Server instances. Key changes include the refactoring of GitHubSource to utilize a builder pattern and the addition of new methods for flexible client configuration. Review feedback suggests deriving Clone for the GitHubSourceBuilder to allow reuse and improving the ergonomics of the with_base_url method by using impl Into for the URL parameter.

gemini-code-assist · 2026-04-19T02:03:42Z

+}
+
+/// Builder for [`GitHubSource`].
+#[derive(Debug, Default)]


The GitHubSourceBuilder struct could benefit from deriving Clone to allow users to reuse a partially configured builder for multiple sources.

Suggested change

#[derive(Debug, Default)]

#[derive(Debug, Default, Clone)]

gemini-code-assist · 2026-04-19T02:03:42Z

+    pub fn with_base_url(
+        owner: impl Into<String>,
+        repo: impl Into<String>,
+        token: Option<&str>,
+        base_url: &str,
+    ) -> Result<Self> {


For consistency with the owner and repo parameters, and to improve ergonomics, the base_url parameter should ideally use impl Into<String> instead of a fixed &str.

Suggested change

pub fn with_base_url(

owner: impl Into<String>,

repo: impl Into<String>,

token: Option<&str>,

base_url: &str,

) -> Result<Self> {

pub fn with_base_url(

owner: impl Into<String>,

repo: impl Into<String>,

token: Option<&str>,

base_url: impl Into<String>,

) -> Result<Self> {

- Document that `GitHubSource::fetch_attestations` filters the GitHub API response to SLSA provenance v1, unlike the `verify_github_attestation*` convenience functions which send no predicate filter. - Add the `x-github-api-version` header assertion to the builder-path test so it matches the `with_base_url` test coverage. Addresses review feedback on #45.

## 🤖 New release * `sigstore-verification`: 0.2.5 -> 0.2.6 (✓ API compatible changes) <details><summary>Changelog</summary> <blockquote> ## [0.2.6](v0.2.5...v0.2.6) - 2026-04-19 ### Added - support custom GitHub API base URL ([#45](#45)) ### Added - support custom GitHub API base URL for `GitHubSource` and `verify_github_attestation`, enabling verification against GitHub Enterprise Server instances </blockquote> </details> --- This PR was generated with [release-plz](https://github.com/release-plz/release-plz/).  --- > [!NOTE] > **Low Risk** > Low risk: this PR only bumps the crate version and updates the changelog; no functional code changes are included. > > **Overview** > Bumps `sigstore-verification` from `0.2.5` to `0.2.6` and adds a `0.2.6` entry to `CHANGELOG.md` documenting support for a custom GitHub API base URL (including GitHub Enterprise Server use cases). > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c5cd203. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).

#9254) ## Summary - When a github backend tool is configured with a custom `api_url` (e.g. a GitHub Enterprise Server instance like `https://github.enterprise.com/api/v3`), artifact downloads correctly hit the GHES API, but attestation verification was still dispatched to `api.github.com` — causing `401 Unauthorized` because the GHES token isn't valid there. - Bumps `sigstore-verification` to 0.2.6 (which adds [`verify_github_attestation_with_base_url`](jdx/sigstore-verification#45) and `GitHubSource::with_base_url`) and switches all three call sites in `src/backend/github.rs` to the new variants so the attestations API is queried against the same host that served the release. ## Motivation Reported in #9176 — user configured `api_url = \"https://github.enterprise.com/api/v3\"` and `MISE_GITHUB_ENTERPRISE_TOKEN`, saw the download succeed, then the `[2/3] verify GitHub artifact attestations` step failed against `api.github.com` with a dotcom-only 401. ## Test plan - [x] `cargo build` clean. - [x] `mise run test:unit` — 708 passed. - [x] `mise run lint` clean. - [ ] Manual verification against a GHES instance with artifact attestations (no instance available in CI). Closes #9176  --- > [!NOTE] > **Medium Risk** > Changes the GitHub attestation verification path and underlying `sigstore-verification` dependency, which affects supply-chain verification behavior and could cause new verification failures if the base URL is misconfigured. > > **Overview** > Ensures GitHub artifact attestation detection/verification uses the configured `api_url` (e.g., GitHub Enterprise) instead of implicitly querying `api.github.com`, by switching to `GitHubSource::with_base_url` and `verify_github_attestation_with_base_url` at all GitHub backend call sites. > > Bumps `sigstore-verification` from `0.2.5` to `0.2.6` to pick up the new base-URL-aware APIs. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 09ff8c3. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).

@bishopmatthew

* fix(progress): disable animated clx output in ci (jdx#9249) ## Summary - Compute the clx progress UI decision once from settings, stderr, force-progress, and CI state. - Keep text output as the default in CI even when stderr looks interactive because a CI runner allocated a PTY. - Store the resulting `use_progress_ui` decision on `MultiProgressReport` so later call sites reuse the same mode decision. ## Why Some CI systems expose stderr as a TTY so tools keep colors enabled, but their log capture strips cursor-control sequences. Animated progress frames can then become thousands of near-duplicate log rows. This keeps local interactive progress intact while making CI output quieter. ## Validation - `cargo fmt --check` - `cargo check -p mise` - pre-commit hook suite during commit, including `cargo check --all-features`, `cargo fmt --all -- --check`, `taplo`, `actionlint`, `markdownlint`, and schema validation  --- > [!NOTE] > **Low Risk** > Low risk: changes only adjust progress UI enablement logic to prefer plain text in CI, with minimal behavioral impact outside CI unless CI detection is incorrect. > > **Overview** > Disables clx’s animated progress UI when `settings.ci` is true, even if stderr appears interactive, to avoid CI logs being flooded by spinner frames. > > Refactors `MultiProgressReport` to compute and store a single `use_progress_ui` flag during initialization (including logging `ci`) and uses that flag when selecting `ProgressReport` vs text-based reports and when creating the header job. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 13548a6. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  * fix(lockfile): use unique temp file for atomic save to avoid concurrent rename race (jdx#9250) ## Problem `Lockfile::save` writes to a fixed `mise.lock.tmp` path, then renames it over the real lockfile. When two mise processes update the same lockfile concurrently, the second rename finds no source file and fails with `No such file or directory (os error 2)`, surfaced as `failed to update lockfiles`. This reproduces reliably via [`hk`](https://github.com/jdx/hk): its linter runner spawns multiple linters in parallel. If more than one linter's bin is missing, each invocation triggers `install_missing_bin` → `rebuild_shims_and_runtime_symlinks` → `update_lockfiles` → `save`. Two mise processes then race on the same `mise.lock.tmp`: 1. Both write `mise.lock.tmp` (second clobbers first — harmless, contents are the same). 2. Process A renames `mise.lock.tmp` → `mise.lock`. 3. Process B renames `mise.lock.tmp` → `mise.lock` → **ENOENT** (source already moved). Caught in the wild during parallel `cargo-machete` + `cargo-msrv` auto-install in CI: ``` cargo-machete – mise [email protected] ✓ installed cargo-machete – mise ERROR failed to update lockfiles cargo-machete – mise ERROR No such file or directory (os error 2) cargo-machete – mise ERROR cargo-binstall failed cargo-machete – mise ERROR Failed to install cargo:[email protected]: cargo-binstall exited with non-zero status: exit code 1 ``` The fixed-path temp pattern was introduced in jdx#8589 (`fix(lockfile): Resolve symlink when updating lockfiles`). ## Fix Switch to `tempfile::NamedTempFile::with_prefix_in(parent)` + `persist(target)`, matching the pattern already used in `src/http.rs`. Each save gets a random temp name, so concurrent writers never collide on the temp path. Persist remains atomic and same-filesystem. Precedent in the codebase: `src/backend/conda.rs` already uses `dest.with_extension(format!("tmp.{}", std::process::id()))` for the same reason. `src/backend/s3.rs` still has a similar fixed-`.tmp` pattern — worth a follow-up but out of scope here. ## Test Added `test_concurrent_save_no_enoent` which spawns 8 threads × 20 saves against the same lockfile and asserts none of them return ENOENT. The test fails on `main` and passes with the fix. 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Medium Risk** > Changes the lockfile persistence path and retry behavior during atomic writes, which could affect correctness/permissions of `mise.lock` updates across platforms. Scope is localized to `Lockfile::save` and is covered by new concurrency and permission regression tests. > > **Overview** > Prevents concurrent `Lockfile::save` calls from failing with `ENOENT` by replacing the fixed `mise.lock.tmp` rename flow with a uniquely named `tempfile::NamedTempFile` written alongside the target and atomically `persist`ed. > > Adds helpers to *preserve existing file permissions* on Unix and to *retry persist on Windows* for transient `PermissionDenied`, plus regression tests for concurrent saves and Unix permission preservation. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 49120aa. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> * feat(latest): add --before flag to mise latest (jdx#9168) ## Summary Adds `--before <BEFORE>` to `mise latest` so one-off latest-version lookups can be constrained by release date. - Parses `--before` with the existing duration/date parser, supporting absolute dates such as `2024-06-01` and relative durations such as `90d` or `1y`. - Passes the parsed CLI cutoff into the current `Backend::latest_version(config, query, before_date)` API, keeping fallback precedence centralized in the backend: CLI flag > backend/tool options > config tool options > global `install_before`. - Conflicts `--before` with `--installed`, because installed-version lookup does not use release metadata. - Regenerates CLI usage docs, manpage output, and Fig completion metadata. - Extends the npm `install_before` e2e coverage for CLI filtering, CLI override of global `MISE_INSTALL_BEFORE`, CLI override of per-tool `install_before`, and relative duration parsing. - Removes the stale e2e prerequisite that required `npm` on the runner `PATH` before `mise use node`; the test now exercises the same mise dependency environment the npm backend uses. ## Test plan - [x] `cargo fmt --check` - [x] `git diff --check` - [x] `cargo test --bin mise latest_version_tests` - [x] `mise run render:usage` - [x] `mise run test:e2e e2e/backend/test_npm_install_before` - [x] `mise run lint-fix` * fix(use): honor --quiet and --silent flags (jdx#9251) ## Summary - `mise use` was printing `mise <path> tools: ...` via `miseprintln!` (unconditional stdout), so `--quiet` and `--silent` had no effect on it. - Switch the "tools:", "removed:", and "would update" messages to `info!` so they route through the logger and get suppressed when those flags raise the log level to `error`. Fixes jdx#9152 ## Test plan - [x] `mise use [email protected]` — still prints `mise <path> tools: [email protected]` - [x] `mise use -q [email protected]` — silent - [x] `mise use --silent [email protected]` — silent - [x] `mise use -n [email protected]` — still prints `would update ...` - [x] `mise use -qn [email protected]` — silent - [x] `mise use --remove tiny` — still prints `removed: ...` - [x] `mise use -q --remove tiny` — silent 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Low Risk** > Low risk: only gates `mise use` success/dry-run status messages behind the existing `Settings::quiet` flag, without changing install/remove behavior or config writes. > > **Overview** > `mise use` now respects the global `--quiet` setting by suppressing its post-action status output (the “would update…”, “tools: …”, and “removed: …” messages) when quiet mode is enabled. > > Behavior for installs/removals, dry-run exit codes, and config saving is unchanged; only user-facing messaging is conditionally skipped. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9a8fcc0. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> * fix(vfox): opt backend plugins out of --locked URL check (jdx#9252) ## Summary - Custom Lua backend plugins (those using `BackendInstall` instead of a `PreInstall` hook) have no way to surface a download URL to mise. As a result, `mise lock` writes a version-only entry and `mise install --locked` then fails with `No lockfile URL found`. - Override `supports_lockfile_url` on `VfoxBackend` to return `false` when the plugin is a backend plugin. Same semantics as asdf / cargo / npm / pipx: when the backend can't provide a URL, the pinned version is the lock. Reported by @bishopmatthew in [jdx#7308](jdx#7308 (comment)). ## Test plan - [ ] Added `--locked --dry-run` assertion with a version-only lockfile entry to `e2e/backend/test_vfox_backend_npm`. - [ ] `mise run lint-fix` passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Low Risk** > Low risk: narrows the `--locked` URL validation for vfox *backend* plugins only, plus adds an e2e regression test. Main risk is allowing locked installs to proceed without per-platform URLs for these plugins, matching their current lockfile capabilities. > > **Overview** > Fixes `mise install --locked` for vfox custom backend plugins by making `VfoxBackend::supports_lockfile_url()` return `false` when the plugin is a backend plugin, so version-only lockfile entries no longer fail with "No lockfile URL found". > > Adds an e2e assertion in `test_vfox_backend_npm` that `--locked --dry-run` succeeds with a version-only `mise.lock` entry for `vfox-npm:prettier`. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 63ba299. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> * feat(spm): add filter_bins option to restrict built executables (jdx#9253) ## Summary - Adds a `filter_bins` tool option to the `spm` backend so users can restrict which executable products are built and linked - Filters before `swift build` runs, so unwanted products are never compiled (not just hidden from `PATH`) - Accepts either a TOML array (`filter_bins = ["swiftly"]`) or a comma-separated string (`filter_bins = "swiftly"`) — the naming matches the existing `filter_bins` option on the github backend - Returns a clear error if any listed name does not match an executable product in the package Closes jdx#9148 The motivating example is [`swiftlang/swiftly`](https://github.com/swiftlang/swiftly), which ships both `swiftly` and `test-swiftly` products. Without this option, mise builds and links both. ```toml [tools] "spm:swiftlang/swiftly" = { version = "latest", filter_bins = ["swiftly"] } ``` When unset, the existing behavior (build and link every executable product) is preserved. ## Test plan - [x] Added unit tests for `parse_filter_bins` (string, array, empty, whitespace-only) and `filter_executables` (passthrough, restrict+preserve-order, error on missing name) - [x] `cargo test backend::spm` — all 8 tests pass - [x] `mise run test:unit` — all 712 unit tests pass - [x] `mise run lint-fix` — clean - [ ] Manual verification with an actual Swift package that has multiple executable products 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Medium Risk** > Changes SPM install behavior to optionally filter and error on unknown executable names, which could impact tool installation when configured. Default behavior is preserved when `filter_bins` is unset. > > **Overview** > Adds a new SPM tool option, `filter_bins`, to restrict which Swift executable products are built and symlinked into `bin/` during installation. > > The backend now parses `filter_bins` from either a TOML array or comma-separated string, validates the requested executables exist, preserves the package-declared order when filtering, and fails fast with a clear error on unknown names. Documentation and unit tests were added to cover parsing, passthrough, ordering, and error cases. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit fa0a09a. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> * fix(github): route artifact attestation verification to custom api_url (jdx#9254) ## Summary - When a github backend tool is configured with a custom `api_url` (e.g. a GitHub Enterprise Server instance like `https://github.enterprise.com/api/v3`), artifact downloads correctly hit the GHES API, but attestation verification was still dispatched to `api.github.com` — causing `401 Unauthorized` because the GHES token isn't valid there. - Bumps `sigstore-verification` to 0.2.6 (which adds [`verify_github_attestation_with_base_url`](jdx/sigstore-verification#45) and `GitHubSource::with_base_url`) and switches all three call sites in `src/backend/github.rs` to the new variants so the attestations API is queried against the same host that served the release. ## Motivation Reported in jdx#9176 — user configured `api_url = \"https://github.enterprise.com/api/v3\"` and `MISE_GITHUB_ENTERPRISE_TOKEN`, saw the download succeed, then the `[2/3] verify GitHub artifact attestations` step failed against `api.github.com` with a dotcom-only 401. ## Test plan - [x] `cargo build` clean. - [x] `mise run test:unit` — 708 passed. - [x] `mise run lint` clean. - [ ] Manual verification against a GHES instance with artifact attestations (no instance available in CI). Closes jdx#9176  --- > [!NOTE] > **Medium Risk** > Changes the GitHub attestation verification path and underlying `sigstore-verification` dependency, which affects supply-chain verification behavior and could cause new verification failures if the base URL is misconfigured. > > **Overview** > Ensures GitHub artifact attestation detection/verification uses the configured `api_url` (e.g., GitHub Enterprise) instead of implicitly querying `api.github.com`, by switching to `GitHubSource::with_base_url` and `verify_github_attestation_with_base_url` at all GitHub backend call sites. > > Bumps `sigstore-verification` from `0.2.5` to `0.2.6` to pick up the new base-URL-aware APIs. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 09ff8c3. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  * registry: add aqua backend for bitwarden-secrets-manager (jdx#9255) # Summary This PR adds/updates the _bitwarden-secrets-manager_ shorthand to point to the _aqua:bitwarden/sdk-sm_ backend. ## Context Currently, mise registry points bitwarden-secrets-manager to a legacy asdf plugin. However, the bitwarden/sdk-sm repository now has a verified, stable aqua definition that provides the bws (Bitwarden Secrets) CLI across all major platforms (Darwin/Linux/Windows). ### Changes - Added `full = "aqua:bitwarden/sdk-sm"` to `registry/bitwarden-secrets-manager.toml`. - Verified that the bws binary is correctly mapped and executable via the aqua backend. ### Verification I have tested this locally using: 1. `aqua exec -- argd test bitwarden/sdk-sm` (Success) 2. `mise use aqua:bitwarden/sdk-sm` (Success) 3. `./target/debug/mise registry | grep bitwarden-secrets-manager` (Success) 4. `./target/debug/mise install bitwarden-secrets-manager@latest` (Success) 5. `./target/debug/mise exec bitwarden-secrets-manager -- bws --version` (Success) ### Impact This move aligns with mise’s preference for the aqua backend over asdf plugins for better security (checksum/SLSA verification) and a faster installation experience. * feat(vfox): support plugin-declared dependencies via metadata.lua (jdx#9051) ## Summary Allow vfox/Lua plugins to declare tool dependencies directly in `metadata.lua` via a new `depends` field: ```lua PLUGIN.depends = {"node", "python"} ``` This surfaces dependencies through the `Backend` trait's `get_dependencies()` method so mise resolves installation order automatically — removing the need for users to manually add `depends = [...]` on every tool entry in their config. ### Motivation Currently, users of vfox backend plugins must repeat dependency declarations in their `mise.toml` for every tool that needs another tool installed first. For example, a plugin ecosystem where 10+ tools all depend on `node` requires `depends = ["node"]` on each entry. With this change, the plugin author declares it once and all users benefit. Closes jdx#8774 ### Changes - **`crates/vfox/src/metadata.rs`**: Added `depends: Vec<String>` field to `Metadata` struct, parsed from the Lua table (defaults to empty when omitted — fully backward compatible) - **`src/backend/vfox.rs`**: `VfoxBackend` now overrides `get_dependencies()` to read from plugin metadata. Dependencies are cached via `OnceLock` and loaded synchronously from the plugin directory. Gracefully returns empty deps if the plugin isn't installed yet. - Updated snapshot for the new field in `Metadata`'s `Debug` output ### Plugin author usage ```lua -- metadata.lua PLUGIN = {} PLUGIN.name = "my-tool" PLUGIN.version = "1.0.0" PLUGIN.depends = {"node", "python"} ``` User-specified `depends` in `mise.toml` still works and is additive — this just provides a plugin-level default. ## Test plan - [x] Unit tests for metadata parsing with and without `depends` field - [x] Existing vfox test suite passes (66 tests) - [x] `cargo check` passes for the full workspace - [x] `cargo clippy -p vfox` clean - [ ] CI validation --------- Co-authored-by: Arthur Hemon <[email protected]> Co-authored-by: Claude Opus 4.6 <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: jdx <[email protected]> * feat: rename `mise prepare` to `mise deps` and add package management (jdx#9056) ## Summary - Renames the experimental `mise prepare` command to `mise deps`, positioning it as a proper dependency management command - Adds `mise deps add npm:react` and `mise deps remove npm:lodash` subcommands for managing individual packages - Implements add/remove for all 4 JS package managers (npm, yarn, pnpm, bun) - `mise deps` (bare) defaults to `mise deps install` which is the previous `mise prepare` behavior - Renames all config (`[prepare]` -> `[deps]`), settings (`show_prepare_stale` -> `show_deps_stale`), flags (`--no-prepare` -> `--no-deps`), and state files (`prepare-state.toml` -> `deps-state.toml`) - No backwards compatibility needed since prepare was experimental ## Test plan - [ ] `cargo build` compiles cleanly - [ ] `mise run lint` passes - [ ] `mise deps --help` shows subcommands (add, install, remove) - [ ] `mise dep --help` alias works - [ ] `mise deps add npm:react` installs react via npm - [ ] `mise deps add -D npm:vitest` installs as devDependency - [ ] `mise deps remove npm:lodash` uninstalls via npm - [ ] `mise deps` (bare) runs all configured providers - [ ] `mise deps install --dry-run` shows what would run - [ ] `mise run --no-deps` skips auto deps - [ ] e2e tests: `mise run test:e2e test_deps test_deps_depends test_deps_tool_install` 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Medium Risk** > Medium risk because this renames an end-to-end command/config surface (`prepare`→`deps`) and threads the new flag/state/schema through exec/run flows, which can break existing experimental users and monorepo provider discovery. Behavior is largely a rename plus new JS package add/remove execution, but touches multiple CLI entrypoints and config parsing. > > **Overview** > **Renames the experimental dependency workflow from `mise prepare` to `mise deps`.** This updates CLI wiring, help/manpages, usage spec, interactive config editor UI, and all documentation references, including the skip flag rename from `--no-prepare` to `--no-deps` in `mise exec`/`mise run`. > > **Promotes deps into a first-class config surface.** Config/schema/settings are renamed from `[prepare]` to `[deps]`, `status.show_prepare_stale` to `status.show_deps_stale`, and the persisted freshness state file from `.mise/prepare-state.toml` to `.mise/deps-state.toml`, with corresponding engine/provider renames. > > **Adds package management subcommands.** Introduces `mise deps add` and `mise deps remove`, parsing `ecosystem:package` specs, installing required tools first, and executing provider-specific commands (implemented for `npm`, `yarn`, `pnpm`, `bun`), while bare `mise deps` defaults to `deps install`. E2E tests are updated/added to cover listing/dry-run/explain, dependency ordering, tool-install-before-deps, and aliasing (`dep` and hidden `prepare`). > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9cb375e. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * feat(npm): add aube package manager support (jdx#9256) ## Summary - Add `npm.package_manager = "auto"` as the default, with `auto` preferring installed `aube` and falling back to `npm`. - Add explicit `npm.package_manager = "aube"` support for npm backend installs using `aube add --global` into mise-managed install/bin directories. - Make auto-selection consider the active install/exec toolset, so `mise x node aube npm:<pkg>` uses the requested `aube` instead of falling back to npm. - Resolve Windows bin paths from the created install layout, so aube-installed packages keep using `install_path/bin` even when aube is not discoverable later. - Normalize `.npmrc` path values to forward slashes and unit-test aube's minute-based `minimumReleaseAge` conversion. - Regenerate the settings schema and document the new npm backend behavior. - Add an e2e test that starts with `mise x node aube npm:cowsay`, verifies aube-specific install artifacts (`global-aube` and `aube-lock.yaml`), and executes `cowsay`. ## Validation - `cargo test -q backend::npm::tests` - `mise run test:e2e e2e/backend/test_npm_aube` - `cargo check -q --all-features` - `mise run render:schema` - `mise run lint-fix` *This PR was generated by an AI coding assistant.* * chore: release 2026.4.18 (jdx#9246) ### 🚀 Features - **(latest)** add --before flag to mise latest by @risu729 in [jdx#9168](jdx#9168) - **(npm)** add aube package manager support by @jdx in [jdx#9256](jdx#9256) - **(spm)** add filter_bins option to restrict built executables by @jdx in [jdx#9253](jdx#9253) - **(vfox)** support plugin-declared dependencies via metadata.lua by @ahemon in [jdx#9051](jdx#9051) - rename `mise prepare` to `mise deps` and add package management by @jdx in [jdx#9056](jdx#9056) ### 🐛 Bug Fixes - **(backend)** skip versions host for direct-source backends by @jdx in [jdx#9245](jdx#9245) - **(github)** route artifact attestation verification to custom api_url by @jdx in [jdx#9254](jdx#9254) - **(lockfile)** use unique temp file for atomic save to avoid concurrent rename race by @jdx in [jdx#9250](jdx#9250) - **(log)** drop noisy third-party debug/trace logs by @jdx in [jdx#9248](jdx#9248) - **(progress)** disable animated clx output in ci by @jdx in [jdx#9249](jdx#9249) - **(use)** honor --quiet and --silent flags by @jdx in [jdx#9251](jdx#9251) - **(vfox)** opt backend plugins out of --locked URL check by @jdx in [jdx#9252](jdx#9252) ### 📦 Registry - add aqua backend for bitwarden-secrets-manager by @msuzoagu in [jdx#9255](jdx#9255) ### New Contributors - @ahemon made their first contribution in [jdx#9051](jdx#9051) - @msuzoagu made their first contribution in [jdx#9255](jdx#9255) * fix(vfox): use github token for lua http requests (jdx#9257) ## Summary - pass mise's resolved GitHub token into vfox plugin runtimes - add default GitHub auth headers in the vfox Lua HTTP bridge for GitHub API requests - preserve explicit plugin-provided Authorization headers and avoid auth on GitHub release asset hosts ## Root Cause Embedded vfox plugins such as `vfox-neovim` call `api.github.com` through the Lua HTTP module. Those requests did not receive mise's configured GitHub token, so rate-limited users could hit `HTTP 403` while installing Neovim even when mise itself knew how to resolve a GitHub token. ## Validation - `cargo fmt --check` - `cargo test -p vfox lua_mod::http` - `cargo check -p mise` - `MISE_LOG_HTTP=1 cargo run -q -p mise -- ls-remote neovim | sed -n '1,20p'`  --- > [!NOTE] > **Medium Risk** > Touches outbound HTTP behavior by automatically adding `Authorization` headers for certain GitHub hosts, which could affect plugin networking and token exposure if host matching is wrong. Scope is limited and includes tests plus explicit opt-out when plugins already set `Authorization` and for GitHub release asset hosts. > > **Overview** > Ensures embedded vfox plugins can authenticate GitHub API calls by threading mise’s resolved GitHub token into the vfox Lua runtime and having the Lua `http` bridge auto-attach GitHub auth headers. > > The Lua HTTP module now conditionally adds `Authorization: Bearer …` (and `x-github-api-version` for `api.github.com`) when a token is available, while **preserving explicit plugin-provided `Authorization`** and **skipping GitHub release asset hosts**; behavior is covered by new unit tests. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f4d9320. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  * fix(cli): retrieve token from github helper for `self-update` command (jdx#9259) The `mise self-update` command now retrieves the GitHub API token via an internal helper rather than directly from environment variables. This ensures the token is fetched from the supported sources listed at https://mise.jdx.dev/dev-tools/github-tokens.html. --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * chore: bump communique to 1.0.1 (jdx#9264) ## Summary - Bump communique from 0.1.9 to 1.0.1 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Low Risk** > Low risk: this only updates the pinned `communique` devtool binary/version and its platform checksums/URLs in `mise.lock`, with no application/runtime code changes. > > **Overview** > Bumps the pinned `communique` tool in `mise.lock` from `0.1.9` to `1.0.1`, updating the associated per-platform download URLs, asset IDs, and checksums so `mise` installs the new release. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 3ff3610. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]> * docs: add aube hero banner (jdx#9265) ## Summary Adds a compact homepage hero banner that promotes aube as a new en.dev tool by @jdx. The banner links to https://aube.en.dev/ and notes that aube is currently in beta. ## Validation - `mise run docs:build` - commit hook suite via `hk`  --- > [!NOTE] > **Low Risk** > Low risk since changes are limited to docs theme markup/CSS and add no backend or data-handling logic. > > **Overview** > Adds a new homepage hero banner in `docs/.vitepress/theme/Layout.vue` promoting `aube` (linking to `https://aube.en.dev/`) with kicker/message text. > > Includes new styling for the banner (hover + dark-mode variants) and small responsive tweaks to center the banner and adjust message font size on mobile. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e1eb309. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  * docs: add en.dev footer (jdx#9267) ## Summary - Add a custom VitePress footer matching the aube.en.dev footer style. - Keep the visible brand mention to a single `en.dev` by using `MIT License · Copyright © YEAR · en.dev`. - Disable the built-in VitePress footer so only the custom footer renders. ## Validation - `mise run docs:build` - commit hook: `hk` lint suite  --- > [!NOTE] > **Low Risk** > Low risk: documentation theme-only changes that affect site layout/styling but not runtime logic beyond the docs build. > > **Overview** > Replaces the built-in VitePress footer with a custom `EndevFooter` component that renders `MIT License · Copyright © YEAR · en.dev` (with logo/link) at the bottom of the docs layout. > > Updates the docs theme layout to inject the new footer via `#layout-bottom`, and adds accompanying CSS styles for the new footer elements in `custom.css`. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4678b11. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  * docs: implement landing page design (jdx#9266) ## Summary - implement the exported landing-page design on the VitePress homepage - replace the default home feature cards with the hero, metaphor, feature menu, pantry ticker, comparison, quickstart, and CTA sections - keep every pantry ticker item in the same serif font ## Validation - npm run docs:build - pre-commit hook via git commit, including prettier, cargo-fmt, cargo-check, shellcheck, shfmt, pkl, taplo, lua-check, stylua, actionlint, markdownlint, and schema This PR was generated by an AI coding assistant.  --- > [!NOTE] > **Low Risk** > Low risk since changes are limited to VitePress homepage markup/styling plus a small clipboard-copy UX tweak; main risk is visual/layout regressions across breakpoints or browsers. > > **Overview** > Replaces the VitePress homepage hero + default feature cards with a new designed landing experience: updated hero copy/CTA, a terminal-style workflow preview, and a new long-form homepage (`docs/index.md`) with metaphor, feature menu, scrolling “pantry” ticker, aube promo, tabbed quickstart recipe, and final CTA. > > Updates theme styling to support the new layout (new `landing-*` and terminal styles, revised hero grid/breakpoints, and smaller feature-card rounding), and improves the install command copy interaction by switching to a button with a `navigator.clipboard` path plus a textarea fallback and clearer “copy/copied” state. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 818c9d2. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  * chore(deps): lock file maintenance (jdx#9268) This PR contains the following updates: | Update | Change | |---|---| | lockFileMaintenance | All locks refreshed | 🔧 This Pull Request updates lock files to use the latest dependency versions. --- ### Configuration 📅 **Schedule**: (in timezone America/Chicago) - Branch creation - "before 4am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/jdx/mise).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --------- Co-authored-by: jdx <[email protected]> Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]> Co-authored-by: Taku Kodama <[email protected]> Co-authored-by: MUA <[email protected]> Co-authored-by: ahemon <[email protected]> Co-authored-by: Arthur Hemon <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: mise-en-dev <[email protected]> Co-authored-by: Kentaro Suzuki <[email protected]> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: richardthe3rd <[email protected]>

greptile-apps Bot reviewed Apr 19, 2026

View reviewed changes

Comment thread tests/github_source_base_url.rs

gemini-code-assist Bot reviewed Apr 19, 2026

View reviewed changes

jdx merged commit 03cc0ac into main Apr 19, 2026
9 checks passed

jdx deleted the feat-custom-base-url-github-source branch April 19, 2026 02:12

jdx mentioned this pull request Apr 19, 2026

chore: release v0.2.6 #46

Merged

jdx mentioned this pull request Apr 19, 2026

fix(github): route artifact attestation verification to custom api_url jdx/mise#9254

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: support custom GitHub API base URL#45

feat: support custom GitHub API base URL#45
jdx merged 2 commits intomainfrom
feat-custom-base-url-github-source

jdx commented Apr 19, 2026 •

edited by cursor Bot

Loading

Uh oh!

greptile-apps Bot commented Apr 19, 2026 •

edited

Loading

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Apr 19, 2026

Uh oh!

gemini-code-assist Bot Apr 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jdx commented Apr 19, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

Test plan

Uh oh!

greptile-apps Bot commented Apr 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Apr 19, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Apr 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented Apr 19, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented Apr 19, 2026 •

edited

Loading