deps: update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
codecov/codecov-action (changelog)	action	digest	fb8b358 → 303a32d
jdx/mise	uses-with	patch	2026.9.11 → 2026.9.12	v2026.9.13
jdx/mise-action (changelog)	action	digest	9e7f763 → c2a8761

---

Release Notes

jdx/mise (jdx/mise)

v2026.9.12: : Tasks that require daemons, worktree-aware ports and URLs, Scoop and zypper packages, and official Docker images

Compare Source

The experimental [daemons] system grows substantially: tasks can declare the daemons they need, [daemon_groups] selects subsets of a project's services, port = "auto" and stable <NAME>_URL hostnames let several git worktrees run the same stack side by side, and CockroachDB, NATS, and SpiceDB join the PostgreSQL and Redis presets. Outside daemons, [bootstrap.packages] gains scoop: and zypper: managers, mise install --system elevates with sudo only for the final publish step, official mise images are published to GHCR and Docker Hub, and a run of brew-cask fixes lets many more casks install unattended.

Highlights

• Daemons as part of the task graph (experimental): [tasks.x] daemons = [...] starts and waits for services before a task runs, daemons can run a mise task, [daemon_groups] and mise daemons start <group> select subsets, and mise daemons register, urls, and prune round out the lifecycle. Worktrees get deterministic ports, hostnames, and optionally checkout-local data_dir storage without hand-assigned numbers.
• More host software from one config: Scoop on Windows and zypper on openSUSE/SLE join the bootstrap managers; brew-cask now picks the right build for the host macOS release, runs installers that need sudo, applies pkg installer choices and set_ownership steps, upgrades pkg-only self-updating casks, and survives DMGs with license prompts or unreadable metadata; brew: resolves formula aliases such as openssl.
• Regressions and integrity fixes: enter hooks fire again when a shell starts inside a project, npm tools with only pre-releases resolve latest again, generated pre-push hooks no longer append git's arguments to the task command, and mise install refuses a lockfile entry whose download URL names a different release than its version. Lockfile sidecars now verify on Windows checkouts with CRLF line endings.

Added

• daemons: Tasks can require daemons and daemons can run tasks. daemons = ["postgres", "nats"] (or true for all project daemons) on a task starts them via pitchfork, waits for readiness, and then runs the task; already-running daemons are left alone, and --skip-deps / --dry-run skip them. A daemon can declare task = "dev:core" with args instead of run, and init = [...] runs idempotent setup commands before the long-running process on every start. mise tasks info shows a task's daemons. (#​13340)

  [daemons]
  postgres = "18"
  
  [daemons.nats]
  run = "exec nats-server"
  ready_port = 4222
  
  [tasks.dev]
  daemons = ["postgres", "nats"]
  run = "npm run dev"

• daemons: [daemon_groups] names project-scoped subsets of daemons; groups may nest other groups and work wherever a daemon name does, including --group. mise daemons start with no arguments now starts the default group when a project declares one, and every project daemon otherwise. (#​13347)

  [daemon_groups]
  default = ["postgres", "core", "node0"]
  two-cluster = ["default", "core2"]

• daemons: A daemon entry with project = "../other-checkout" and optional name runs a daemon defined in another project under that project's tools, environment, and data, and can be used in depends. [daemons_settings] namespace = "services" gives daemons stable namespace/name IDs (with a per-worktree suffix unless namespace_per_worktree = false). Requires pitchfork 2.25.0 or later. (#​13339)

• daemons: port = "auto" (or port = { auto = true, base = 3000, stride = 1 } for custom daemons) keeps the base port in the primary checkout and derives a deterministic offset in each linked git worktree. Resolved ports are exported before startup as PGPORT/DATABASE_URL for presets and <NAME>_PORT for custom daemons, and mise daemons ls --json reports port and port_auto. mise does not fall back to another port; startup diagnoses conflicts with running mise-managed daemons in other projects, and two daemons in one project claiming the same port now fail at config load. (#​13342)

• daemons: Every daemon with a port gets a stable hostname served by pitchfork's reverse proxy, exported as <NAME>_URL (for example api.shop.localhost in the primary checkout, or api.shop-pr-42.shop.localhost in a linked worktree). Per-daemon proxy (a label, true, or false) and proxy_tls ("terminate" or "passthrough") control routing; the postgres and redis presets opt out. mise daemons urls lists hostnames, ports, proxy modes, and status. Set proxy = false on custom daemons that do not speak HTTP. (#​13368)

• daemons: CockroachDB (preset = "cockroachdb"), NATS ("nats"), and SpiceDB ("spicedb") presets install the tool, initialize data, wait for readiness, and export DATABASE_URL, NATS_URL, SPICEDB_ENDPOINT, and SPICEDB_PRESHARED_KEY. Presets now support named-port overrides such as ports.http_port = 8081 and typed options. Unix-only; NATS and SpiceDB readiness checks need curl. (#​13346)

• daemons: mise daemons register installs missing tools, validates the daemon graph, and registers pitchfork configuration without starting anything, so a fresh checkout can start on its first hostname request. (#​13399)

• daemons: mise daemons prune finds daemon state left behind by deleted projects and worktrees, shows paths and sizes, and removes it after confirmation (--dry-run previews, --yes confirms ordinary cases). mise daemons ls --json adds root, state_dir, data_size, and data_size_human. (#​13338)

• daemons: data_dir = ".data/postgres" keeps a preset's persistent data inside the checkout (relative to the project root; absolute and ~/ paths also work), so each worktree gets its own database. Changing the path does not move existing data. (#​13408)

• bootstrap: A scoop manager for Windows. "scoop:extras/vscode" = "latest" adds the bucket if missing, pinned versions install via app@version, state = "absent" uninstalls, and --update opts in to scoop update. Only user-scope installs are managed; entries are skipped on other platforms. (#​13324)

• bootstrap: A zypper manager for openSUSE and SUSE Linux Enterprise, supporting status, install, name=version pins (including downgrades), upgrade, and removal, with retries when zypper asks for a package-manager restart. (#​13335, @​m407)

• bootstrap: process_type on [bootstrap.macos.launchd.agents.*] maps to launchd's ProcessType (Background, Standard, Adaptive, Interactive); misspellings are rejected at config time instead of being silently ignored by launchd. (#​13402, @​waynehoover)

• install: mise install --system on Unix downloads, verifies, and unpacks as the invoking user, then uses sudo only to publish into the system install and shim directories. Supports relocatable tools from aqua, github, gitlab, forgejo, http, and s3 without a tool-level postinstall; system_packages.sudo = false disables elevation. (#​13384)

• docker: Official release images at ghcr.io/jdx/mise and jdxcode/mise for linux/amd64 and linux/arm64, built from the minisign-verified release binaries. Tags 2026.9.12, 2026.9, and latest are a scratch image for COPY --from=; *-debian and debian are a Debian slim base with curl and git. (#​13413)

  FROM debian:13-slim
  COPY --from=ghcr.io/jdx/mise:2026.9.12 /usr/local/bin/mise /usr/local/bin/mise

• config: unix is accepted as an os selector in [tools], [bootstrap.packages], [doctor.checks], and [dotfiles] variants, matching every non-Windows platform. A concrete OS variant still wins over a unix one. (#​13395)

• go: With go in idiomatic_version_file_enable_tools, the toolchain line of an active go.work selects the Go version and, as with the go command, member go.mod files are ignored in workspace mode. GOWORK (auto, off, or an absolute path) is honored. (#​13337)

• bazel: .bazelversion is an idiomatic version file for bazel when enabled; only concrete releases are read, so latest, last_green, 8.x, and commit hashes select nothing rather than failing. (#​13336)

• tasks: File-task #USAGE include file="..." paths may be relative to the task file or use environment variables such as $MISE_CONFIG_ROOT, $MISE_TASK_DIR, and $MISE_PROJECT_ROOT, so shared flagsets no longer need absolute paths. (#​13372)

• dotfiles: mise dot apply now runs matching [history.reload] commands for the targets it actually wrote, once each after all writes; --dry-run and no-op applies run none. (#​13414)

• registry: Added codegraph (aqua:colbymchenry/codegraph). (#​13355, @​3w36zj6)

Fixed

• activate: Starting a shell inside a trusted project runs its enter hook again; a regression in 2026.9.x had limited it to cd into the project. (#​13383)
• npm: A tool that publishes only pre-releases (such as @deepseek-ai/dsh) is no longer reported missing after mise use npm:...@latest; latest falls back to the newest installed pre-release when no stable version is installed. (#​13390)
• npm: On a shared Linux machine, users other than the first to install an npm: tool no longer fail with failed to acquire project lock: Permission denied. (#​13379)
• generate: mise generate git-pre-commit hooks pass only the message file ("$1") for commit-msg, prepare-commit-msg, applypatch-msg, and sendemail-validate, and no arguments for other hooks, so a pre-push task no longer runs npm test origin <url>. Existing hooks change when regenerated. (#​13377)
• lockfile: mise install fails before downloading when a locked platform URL provably names a different release than the entry's version (for example after a tool bumped version in mise.lock without refreshing the platform block, or a release dropped a platform). mise lock still repairs the entry. (#​13401)
• lockfile: Dependency sidecars under .mise/locks/ verify on Windows checkouts where git rewrote them to CRLF, digests recorded from CRLF bytes by older versions keep working and heal on the next ordinary install, and a relocated sidecar is pinned to the bytes actually written. Repositories can drop .mise/locks/** -text workarounds. (#​13398, #​13403, #​13407)
• brew-cask: Installs the variations entry Homebrew publishes for the host macOS release instead of always the newest release's build (Raycast on Sequoia now gets 1.104.x, not the Tahoe-only 2.x), and reports not available for this platform for null variations. (#​13376)
• brew-cask: Installer scripts that declare sudo: true (such as logi-options+) run through mise's sudo path, and $HOMEBREW_PREFIX/$APPDIR placeholders in installer paths and arguments are expanded. (#​13380)
• brew-cask: Casks with pkg installer choices (microsoft-outlook, microsoft-teams) install via installer -applyChoiceChangesXML; casks whose flight steps use set_ownership (parsec) install; and mise bootstrap packages upgrade handles self-updating casks that install only from a .pkg (tailscale-app, karabiner-elements) by comparing pkgutil receipt versions. (#​13385, #​13386, #​13387)
• brew-cask: Third-party casks evaluated from Ruby can use staged_path, unblocking casks such as AeroSpace. (#​13369, @​soodoh)
• install: DMGs with an embedded license agreement no longer stall at hdiutil's Agree Y/N? prompt, and DMGs with unreadable root metadata such as .Trashes (for example mysqlworkbench) extract instead of failing with Permission denied. Applies to brew-cask, macos-app, and aqua DMG downloads. (#​13353, @​hisaac; #​13378)
• brew: Formula aliases and old names (openssl -> openssl@3, act_runner -> gitea-runner) resolve for brew: packages and tap formula dependencies instead of failing with a 404; mise warns to use the canonical name so status can track it. (#​13382)
• bootstrap: Two spellings of one WinGet or Scoop package (winget:Git.Git and winget:git.git) that disagree on state or version are rejected with both names, instead of converging differently per machine. Entries kept apart by os or env selectors are not compared. (#​13334)
• github: The GitHub token is sent to raw.githubusercontent.com, so private Homebrew taps resolve. (#​13345, @​waynehoover)
• github: {{ version }} in platforms.<target>.url is rendered with the resolved version for the GitHub, GitLab, and Forgejo backends, so versioned source archives can follow latest. (#​13359, @​casparbreloh)
• go: Version discovery for modules with hundreds of releases no longer times out with No versions found; latest resolves directly through the module proxy or go list, and release dates are fetched only for the newest versions. minimum_release_age stays exact by dating individual undated candidates on demand. (#​13362, #​13364)
• tasks: mise tasks validate recognizes child monorepo task references such as depends = ["//crates/gui:dev"] in depends, depends_post, wait_for, and structured run. (#​13373, @​nettlesh)
• daemons: ready_cmd and health_cmd probes run in the owning project's mise environment, so a supervisor shared by several worktrees no longer probes one checkout with another's API_PORT. (#​13396)
• dotfiles: mise dot edit opens tracked files (mode = "track") in place and inline content entries in their declaring config, instead of failing with No such file or directory; it warns when editing a tracked symlink whose destination history does not capture. (#​13332)
• history: Checkpoints record the non-default mode of directories containing tracked files, so a 0700 ~/.claude holding a tracked settings.json is recreated private on a new machine rather than 0755. (#​13412)
• history: The "histories are unrelated" refusal from mise dot origin set and mise dot sync now names the commands for each way out. (#​13411)

Documentation

• New "Set up a development stack" guide covering project daemons, worktree isolation, imports, registration, and idle shutdown. (#​13389)
• Task templates guide documents Tera v2 components for repeated parameterized snippets inside a run script. (#​13388)
• miser.nvim added to the IDE integration page. (#​13406, @​carldaws)
• Bootstrap package conflict guidance shortened and corrected. (#​13341)

Breaking Changes

• Docker latest tag: ghcr.io/jdx/mise:latest and jdxcode/mise:latest are now the scratch image (static binary and CA certificates, no shell). CI and dev-container users should switch to the debian tag and install their tools explicitly; the previous source-built image remains under the unsupported dev tag. (#​13413)
• Lockfile version/URL mismatch: Lockfiles whose version disagrees with a platform URL now fail mise install instead of silently installing the wrong release. Run mise lock to regenerate the entry. (#​13401)
• Generated git hooks: After regenerating with mise generate git-pre-commit, non-message hooks no longer receive git's arguments. To keep them, edit the hook to use "$@" and declare the arguments with usage. (#​13377)
• Bootstrap package spellings: Configs declaring one WinGet or Scoop package under two spellings with conflicting state or version are rejected; delete one entry. (#​13334)
• Daemons (experimental): mise daemons start with no arguments starts only the default group when one is declared; a project with two daemons resolving to the same port fails to load; custom daemons with a port now export <NAME>_PORT and <NAME>_URL, so set proxy = false on non-HTTP daemons. (#​13347, #​13342, #​13368)

New Contributors

• @​m407 made their first contribution in #​13335

Full Changelog: jdx/mise@v2026.9.11...v2026.9.12

💚 Sponsor mise

mise is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If mise saves you or your team time, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep mise fast, free, and independent.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • On day 15 of the month (* * 15 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.