Allow jdx/mise-action v4.2.4

[tisonkun]

Request for adding a new GitHub Action to the allow list

Overview

Name of action: jdx/mise-action

URL of action: https://github.com/jdx/mise-action

Version to pin to (hash only): 7e36c90d9ab29c415a2384db3006f3ec8a8cc654 (v4.2.4)

Apache DataSketches TCK is migrating its tool setup and checks to mise in apache/datasketches-tck#3. The currently approved v3.6.3 release runs on Node.js 20, which GitHub Actions now warns is deprecated. v4.2.4 runs on Node.js 24 and includes the latest PATH propagation and lock-detection fixes. The existing approved SHA is retained for current consumers.

Permissions

The action uses the automatic GitHub token for authenticated release API requests and reads or writes the GitHub Actions cache by default. It does not require repository write access. Its optional OIDC-based cache integration is disabled by default and is not used by DataSketches TCK.

Related Actions

jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db (v3.6.3) is already approved. This request adds the current v4 release rather than replacing the existing SHA.

Checklist

• The action is listed in the GitHub Actions Marketplace
• The action is not already on the list of approved actions (v3.6.3 is already approved)
• The action has a sufficient number of contributors or has contributors within the ASF community
• The action has a clearly defined license
• The action is actively developed or maintained
• The action has CI/unit tests configured
• Compiled JavaScript in dist/ matches a clean rebuild (verify with uv run utils/verify-action-build.py org/repo@hash)

Verification note

uv run utils/verify-action-build.py --ci jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 confirms Node.js 24, signed-checksum download verification, and that the compiled JavaScript matches a clean rebuild. The command currently exits non-zero on lock-file presence because v4.2.4 uses aube-lock.yaml, which the verifier does not yet recognize. This PR is draft pending guidance on adding aube support to the verifier.

---

Drafted-by: Codex (GPT-5)

[raboof]

check_action_tags failure is #1153, can be ignored here I think.

'Verify Manual Allowlist PR` is not recognizing the aube-lock.yaml as a lockfile. Probably fine but might be good if someone with more nodejs experience had a closer look?

[potiuk]

The block here is our tooling, not your PR. verify-action-build's lock-file check only knew package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock and bun.lockb - mise-action v4.2.4 moved its build to aube, which writes aube-lock.yaml. That file is pnpm lockfileVersion 9 with resolved versions and sha512 integrity for all 460 transitive deps, so the pinning guarantee the check exists to enforce is fully met.

Fix is up in #1175 (teaches the check the filename, and teaches the rebuild container to install from it). Once that merges I'll re-run CI here and this should go green. Nothing needed from you.

---

Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting

[potiuk]

@raboof - following up on your node question above, both halves now have fixes up and green:

• verify-action-build: recognise aube-lock.yaml as a node lock file #1175 teaches the lock-file check about aube-lock.yaml. It is pnpm lockfileVersion 9 with resolved versions plus sha512 integrity for all 460 transitive deps, so the pinning guarantee the check exists to enforce is fully met. It also teaches the rebuild to install from it, which otherwise fell through to an unpinned npm install. Verified pnpm 11 consumes the real file in a node:24-slim container.
• verify-action-build: detect the tarball root instead of assuming package/ #1174 fixes a separate false positive in the same tool, surfaced by action-allowlist-review: bump JamesIves/github-pages-deploy-action from 4.8.0 to 4.9.0 in /.github/actions/for-dependabot-triggered-reviews #1171: npm tarball roots were assumed to be package/, so DefinitelyTyped @types/* tarballs had every file reported as injected code after already passing integrity verification.

Neither is a change to what gets enforced, only to the tool recognising what is in front of it. Once they land, this PR and #1171 just need a branch update to re-run verify. Would you take a look?

@tisonkun - nothing needed from you here, the block was on our side.