Skip to content

feat(mise): add lock file support#42591

Open
zeitlinger wants to merge 6 commits intorenovatebot:mainfrom
zeitlinger:feat/mise-lock-fixes
Open

feat(mise): add lock file support#42591
zeitlinger wants to merge 6 commits intorenovatebot:mainfrom
zeitlinger:feat/mise-lock-fixes

Conversation

@zeitlinger
Copy link
Copy Markdown

@zeitlinger zeitlinger commented Apr 13, 2026

Summary

Adds lock file support to the mise manager. This is a replacement for #42099 (@altendky's draft) with two additional fixes identified during review.

What's included (from #42099):

  • Extract lockedVersion from mise.lock during package file extraction
  • updateArtifacts(): run mise lock [tools] to update the lock file after dependency changes
  • updateLockedDependency(): return already-updated when the locked version already matches
  • Lock file maintenance support via mise lock
  • supportsLockFileMaintenance, lockFileNames exports

Additional fixes (not in #42099):

Fix 1 — --local flag for local config files

mise lock without --local updates mise.lock, not mise.local.lock. Processing mise.local.toml was silently updating the wrong lock file.

Fix 2 — MISE_ENV for environment-specific configs

mise lock for mise.test.toml needs MISE_ENV=test to select the right config and update mise.test.lock. Without it, mise defaults to mise.toml.

Closes #40568

@zeitlinger zeitlinger force-pushed the feat/mise-lock-fixes branch from fb246dc to b2c0310 Compare April 13, 2026 10:29
altendky and others added 4 commits April 13, 2026 10:34
- Add lockfile.ts with getLockFileName() for deriving lock file paths
- Add artifacts.ts with updateArtifacts() and updateLockedDependency()
- Add MiseLockFile Zod schema for parsing lock files
- Update extract.ts to be async and extract lockedVersion from lock files
- Export supportsLockFileMaintenance, lockFileNames, updateArtifacts, updateLockedDependency
Remove comments that simply restate what the code already clearly
communicates. Keep valuable comments that explain non-obvious behavior
(e.g., why temporary errors are rethrown) and move helpful examples
into JSDoc comments.
- Fix lock file key lookup for non-registry tools (aqua:, ubi:, etc.)
  Registry tools use short names (node), non-registry use full names
  (aqua:cli/cli). New getLockedVersion() tries both patterns.

- Add injection prevention test for shell quoting
- Add update-failed test for error handling
- Add comprehensive tests for getLockedVersion()
- Add null check for depName in updateLockedDependency
- Add JSDoc to updateArtifacts and extractPackageFile
- Add lock file support documentation to README
- Remove code duplication by consolidating into lockfile.ts
When updating mise.local.toml, `mise lock` updates mise.lock, not
mise.local.lock. Add --local flag to target the correct lock file.

For env-specific configs (mise.test.toml), set MISE_ENV=test so mise
reads and locks the correct configuration.

Extracted getConfigType() from getLockFileName() to share the parsing
logic between lock file name derivation and command flag generation.

Builds on renovatebot#42099 by altendky.
@zeitlinger zeitlinger force-pushed the feat/mise-lock-fixes branch from b2c0310 to 5482e81 Compare April 13, 2026 10:35
@zeitlinger zeitlinger changed the title fix(mise): use --local flag and MISE_ENV for local/env-specific lock files feat(mise): add lock file support Apr 13, 2026
@zeitlinger zeitlinger marked this pull request as ready for review April 13, 2026 11:02
tools is required by MiseFile schema so if(tools) is always true.
depName is always set by createDependency so if(dep.depName) is always true.

Add test for tool absent from lock file to cover the lockedVersion
assignment branch.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat(manager/mise): support lock file maintenance

2 participants