Update weekly update

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v6.0.2 → v6.0.3
github/codeql-action	action	patch	v4.36.0 → v4.36.2
graalvm/setup-graalvm	action	patch	v1.5.3 → v1.5.4
jdx/mise-action	action	minor	v4.0.1 → v4.1.0

---

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

github/codeql-action (github/codeql-action)

v4.36.2

Compare Source

v4.36.1

Compare Source

graalvm/setup-graalvm (graalvm/setup-graalvm)

v1.5.4

Compare Source

What's Changed

• Bump the "all" group with 2 updates across multiple ecosystems by @​dependabot[bot] in #​217

Full Changelog: graalvm/setup-graalvm@v1.5.3...v1.5.4

jdx/mise-action (jdx/mise-action)

v4.1.0: : automatic --locked installs

Compare Source

This release adds automatic locked installs when a mise.lock is present, and fixes a long-standing cache-key collision that could poison tool installs when workflows migrate between runner providers.

Added

Automatic --locked install when mise.lock exists (#​495) by @​zeitlinger

When a repo contains mise.lock, the action now automatically passes --locked to mise install (on mise versions that support it). This removes the need to manually set install_args: --locked and prevents mise install from silently mutating the lockfile in CI. Explicit install_args and older mise versions are still respected.

Note: workflows with a stale lockfile may now fail earlier and more explicitly instead of silently updating mise.lock mid-run — this surfaces lockfile drift rather than hiding it.

Fixed

• Cache key collisions across runner providers (#​456) — the default cache key now includes the runner image (e.g. macos15, ubuntu24 for GitHub-hosted runners; self-hosted otherwise). Previously, repos migrating between providers like github-hosted, namespace.so, BuildJet, and self-hosted runners with the same OS/arch could restore a peer provider's ~/.local/share/mise/installs/*, causing failures like does not have an executable named '…' or SIGILL crashes from binaries built against a different glibc/CPU featureset. Expect a one-time cache miss after upgrading; thereafter the cache stays scoped per image.
• mise-shim.exe missing on Windows (#​476) by @​risu729 — the action now installs mise-shim.exe alongside mise.exe and repairs restored caches that lack the shim. Fixes #​475.

Changed

• Migrated the bundled action build from ncc (CommonJS) to Rollup (ESM) (#​436). No user-facing behavior change.

Full Changelog: jdx/mise-action@v4.0.1...v4.1.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 07:59 AM, only on Tuesday (* 0-7 * * 2)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.00%. Comparing base (fdaca61) to head (2397258).

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #8462   +/-   ##
=========================================
  Coverage     91.00%   91.00%           
  Complexity     7817     7817           
=========================================
  Files           893      893           
  Lines         23721    23721           
  Branches       2364     2364           
=========================================
  Hits          21588    21588           
  Misses         1410     1410           
  Partials        723      723           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.