chore: use mise lock for enhanced security (#2142)

downgraded node - to see if renovate updates work

---------

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Signed-off-by: Jay DeLuca <jaydeluca4@gmail.com>

Author: zeitlinger

.github/config/flint.toml

@@ -1,6 +1,6 @@
 [settings]
 # These paths are generated, vendored, or handled by other checks.
-exclude = ["CHANGELOG.md", "**/src/main/generated/**", "docs/themes/**", "mvnw", "simpleclient-archive/**"]
+exclude = ["CHANGELOG.md", "**/src/main/generated/**", "docs/themes/**", "mvnw", "simpleclient-archive/**", "mise.lock"]
 setup_migration_version = 2
 
 [checks.renovate-deps]

.github/workflows/build.yml

@@ -16,6 +16,8 @@ jobs:
         with:
           version: v2026.5.15
           sha256: a86aa65c8ca48a548c3f9904853489383bb8cdebfd8f2cf8ddd18b675e03bbf4
+          install_args: --locked  # prevents update of mise.lock - we check for clean git in "mise run generate"
+
       - name: Cache local Maven repository
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with: