fix(release): bump mise pin past github tsa trust-root rotation#253
Merged
Conversation
GitHub rotated its TSA cert on 2026-06-12; mise builds before 2026.7.0 embed a stale Sigstore trust root and fail every post-rotation GitHub artifact attestation with 'TSA timestamp verification failed: no certificate matches issuer and serial number' (jdx/mise#10680). This broke Self-Release v0.2.5.7 at the betterleaks install. - auto-release.yml: mise_version default 2026.6.14 -> 2026.7.0 (restores the documented lockstep with mise-task.yml) - self-release.yml: pass mise_version explicitly -- the self-caller runs auto-release.yml@main, so a dev-side default bump only lands after the NEXT promotion; the explicit value lets the promotion that carries this fix release itself - ci/betterleaks header: drop the stale 'pinned to 1.5.0' note that wrongly blamed betterleaks 1.6.0's attestation; the artifact was legitimate all along
Contributor
There was a problem hiding this comment.
Pull request overview
此 PR 透過將 reusable release 工作流程的 mise 釘版更新到 2026.7.0，修復因 GitHub 於 2026-06-12 進行 TSA 憑證輪替、而舊版 mise 內嵌 Sigstore trust root 過期導致「GitHub artifact attestation 驗不過」進而卡死 Secret Scan / tool install 的問題，讓自動發版與自我發版流程恢復可用。
Changes:
- 將
auto-release.yml的mise_version預設值 bump 至2026.7.0，並補充為何需要>= 2026.7.0的背景說明。 - 在
self-release.yml明確傳入mise_version: "2026.7.0"，避免自我發版呼叫auto-release.yml@main時仍吃到舊預設值而失敗。 - 更新
.mise/tasks/ci/betterleaks與CLAUDE.md的註解/說明，使根因與版本需求與現況一致。
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.github/workflows/auto-release.yml |
更新 mise_version 預設釘版到 2026.7.0，避免舊 trust root 導致 attestation 驗證失敗。 |
.github/workflows/self-release.yml |
self-release 呼叫 auto-release.yml@main 時顯式傳入 mise_version，確保本次 promotion 自己就能跑成功。 |
.mise/tasks/ci/betterleaks |
校正 betterleaks 安裝/attestation 失敗的根因註解，並標註對 mise 版本的需求。 |
CLAUDE.md |
將 mise-action 釘版與 trust root / TSA 輪替背景整理進工作流架構說明，對齊目前 lockstep 策略。 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Self-Release v0.2.5.7 在 Secret scan 卡死:mise 2026.6.14 內嵌的 Sigstore trust root 早於 GitHub 2026-06-12 的 TSA 憑證輪替,任何後於該日簽的 GitHub artifact attestation 都驗不過(betterleaks 1.6.1 中獎;artifact 本身合法,jdx/mise#10680 已確認並在 2026.7.0 修復)。
mise-task.yml已在 2026.7.0(PR CI 因此是綠的),但auto-release.ymldefault 脫鉤。Changes
auto-release.yml:mise_versiondefault2026.6.14→2026.7.0(恢復註解宣稱的 lockstep;13 個 consumer caller 用 default,promote 後自動受惠)self-release.yml:顯式傳mise_version: "2026.7.0"— self-caller 跑的是auto-release.yml@main,dev 端 default bump 要等下一次 promotion 才生效;顯式傳值讓「載著本修正的這次 promotion」自己就能跑.mise/tasks/ci/betterleaks:改寫檔頭註解 — 移除過時的「Pinned to 1.5.0(1.6.0 attestation 壞)」說法(錯怪了 betterleaks,真因是 mise trust root),記錄 mise ≥ 2026.7.0 需求;釘版行照常由 Renovate 管理CLAUDE.md:mise-action 釘版說明對齊 2026.7.0 lockstepVerification
MISE_DATA_DIR下 mise 2026.7.0 安裝github:betterleaks/betterleaks@1.6.1:✓ GitHub artifact attestations verified合併後將重新 dispatch Self-Release v0.2.5.7。
Closes #252