Bump jdx/mise-action from 4.3.0 to 5.0.0

[dependabot]

Bumps jdx/mise-action from 4.3.0 to 5.0.0.

Release notes

Sourced from jdx/mise-action's releases.

v5.0.0: Default minimum release age of 24 hours for mise

If you don't pin a version, mise-action now installs the newest stable mise release that is at least 24 hours old. Upgrading mise on a runner that already has it is also less likely to hit GitHub API rate limits.

Breaking Changes

minimum_release_age now defaults to 24h (#632 by @​jdx)

Before this release, minimum_release_age was an opt-in setting. It now defaults to 24h. If you don't set version, the action picks the highest-numbered stable mise release published at least 24 hours ago. A mise release that just shipped won't be installed until it's a day old.

To get the latest stable release right away, as in v4, set the delay to 0s. You can also choose a longer delay:

- uses: jdx/mise-action@v5
  with:
    minimum_release_age: 0s   # or e.g. 7d

• An explicit version input still takes precedence and skips the delay.
• The setting applies only to the mise binary, not to tools installed by mise.
• The action now gets the release list from a public CDN index (releases.tsv on mise.jdx.dev) instead of paging through the GitHub Releases API. Picking a release doesn't use GitHub API quota, even when an installed binary is reused. If the index is missing or malformed, the action fails instead of skipping the release-age check.
• Replacing an older installed binary still runs mise self-update, which may call the GitHub API to fetch that exact release.

Fixed

• mise self-update now runs with MISE_GITHUB_TOKEN. When a runner already had a different mise version installed, the action runs mise self-update to switch versions. That GitHub API call used to go out without authentication, so busy shared or self-hosted runners could hit the rate limit and fail with HTTP 403 RateLimitedError. If you already set a token in your environment, the action leaves it unchanged. (#619 by @​hegde5)

New Contributors

• @​hegde5 made their first contribution in #619

Full Changelog: jdx/mise-action@v4.3.0...v5.0.0

Changelog

Sourced from jdx/mise-action's changelog.

5.0.0 - 2026-09-28

🚀 Features

• breaking default minimum release age to 24 hours (#632) by @​jdx in 279d505

🐛 Bug Fixes

• fix: authenticate mise self-update to avoid GitHub API rate limits (#619) by @​hegde5 in #619

⚙️ Miscellaneous Tasks

• (entire) store checkpoints in a private repository by @​jdx in 15b2b0f
• (entire) commit codex session hooks by @​jdx in b0eb15f
• (entire) commit claude session hooks by @​jdx in 6ac0f83
• (entire) restore lower-cost trail findings by @​jdx in aa79241
• remove entire and codex agent hooks by @​jdx in 07f40cf
• add entire trail runners (#624) by @​jdx in #624
• remove Entire trail runners (#630) by @​jdx in #630
• float jdx tools and aube on latest without a release-age delay (#631) by @​jdx in #631

New Contributors

• @​hegde5 made their first contribution in #619

---

Commits

• 9149ea8 chore: release v5.0.0 (#620)
• 279d505 feat!: default minimum release age to 24 hours (#632)
• aa79241 chore(entire): restore lower-cost trail findings
• 6ac0f83 chore(entire): commit claude session hooks
• b0eb15f chore(entire): commit codex session hooks
• 15b2b0f chore(entire): store checkpoints in a private repository
• d672874 chore: float jdx tools and aube on latest without a release-age delay (#631)
• 9b0b1ab chore(deps): upgrade mise.lock to lockfile format v2
• d43a4b0 chore(deps): update communique to 1.4.2 in mise.lock
• aa6fd18 chore(deps): pin jdx/renovate-config workflows to v1.0.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)