[roxanachiric-sonar]

Update all eleven explicit mise 2026.10.6 pins to 2026.10.17 across eight shared actions and three test workflows. The mise 2026.10.17 release removes trust in the compromised eMudhra certificates from its bundled npm backend through rustls-webpki 0.103.16 and webpki-root-certs 1.0.10.

Shared actions covered: config-uv, config-poetry, update-release-channel, promote, build-npm, config-npm, build-yarn, and build-poetry. Test workflows covered: test-build-number.yml, test-shell-scripts.yml, and test-update-release-channel.yml. This completes the version-pin coverage requested in the review, including the npm/yarn actions. Existing StepSecurity action pins are preserved.

Release/adoption: publish the corrected shared-action release and advance the intended release ref after merge. Callers pinned to earlier commits must adopt a corrected commit or release; merging this PR alone does not update those callers.

Cross-PR check: the older review compared #361 at 956bf98, which proposed mise 2026.10.13. As checked at d0be3e4c0fdbcea67a50800b2e0f499fc031f8f2, #361 now only updates gh-action_cache references and does not change mise versions. When reconciling any later changes, retain mise 2026.10.17 or newer in these actions; do not restore the earlier 2026.10.13 value.

Validation: all ten additionally changed YAML files passed syntax parsing, and git diff --check passed. A repository-wide scan found no remaining 2026.10.6 or 2026.10.13 mise pins in tracked YAML. All CI checks passed on commit 332fde14e10b030519b4eccfbb16f108badc720d, including shell-script tests, release-channel tests, Linux/Windows build-number tests, pre-commit, SCA and SonarCloud analysis. PR #366 was merged as 962ef7df7705843d591dc528a566a46bbecee7a5. At the post-merge check, config-uv@v2 still selected mise 2026.10.6, so release publication/adoption remains outstanding.

[hashicorp-vault-sonar-prod]

PREQ-9667

[gitar-bot]

Code Review ✅ Approved 2 closed / 2 findings

🟡 Medium risk · Updating mise across shared build and configuration actions changes toolchain and certificate trust, which could disrupt dependency access or builds for callers.

Bumps the shared config-uv action's mise pin from 2026.10.6 to 2026.10.17 to pick up the eMudhra certificate trust removal. Resolved this session: the fix is now applied beyond config-uv, with the remaining actions moved off 2026.10.6, and the risk that merging #361 afterward could drop config-uv below the fix is addressed. No open issues found.

✅ 2 closed

✅ Edge Case: eMudhra fix only applied to config-uv; 7 other actions stay on 2026.10.6

📄 config-uv/action.yml:104
The PR moves mise to 2026.10.17 to remove trust in the compromised eMudhra certificates, but it only changes config-uv. Seven other shared actions still pin jdx/mise-action to version: 2026.10.6: config-poetry:116, update-release-channel:62, promote:62, build-npm:126, config-npm:91, build-yarn:121 and build-poetry:112. Several of these are npm/yarn actions. The release notes say the fix is in mise's bundled npm backend, so these actions are more directly affected than config-uv, and callers that adopt the next release still get the vulnerable mise version from them. Test workflows test-build-number.yml:132, test-shell-scripts.yml:25 and test-update-release-channel.yml:37 also still pin 2026.10.6. Fix: change every version: 2026.10.6 mise pin to 2026.10.17 in this PR, or follow-up PRs, so the certificate fix covers all actions.

✅ Cross-PR: Merging #361 after this PR could drop config-uv's mise below the fix

📄 config-uv/action.yml:104
Breaks when #361 merges after this PR, or is rebased onto it, and the overlapping config-uv version line is resolved to #361's value.

How

1. This PR sets the config-uv mise-action version input to 2026.10.17 (config-uv/action.yml:104). Per the PR description, this is the release that removes trust in the eMudhra certificates.
2. Update GitHub actions #361 changes the same line to 2026.10.13 (config-uv/action.yml:104). That release predates the fix.
3. Nothing in the repo enforces a minimum mise version, so a conflict resolved toward Update GitHub actions #361 would put config-uv back on a vulnerable mise and still pass CI.

Fix

• This PR: nothing needed.
• Update GitHub actions #361: when rebasing onto this change, keep version: 2026.10.17 or higher in config-uv/action.yml. Ideally, raise Update GitHub actions #361's other mise pins to 2026.10.17 too.

Compared 32a71af with #361 at 956bf98

Verification Rules 3/3 met PRs 2 inspected

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners
✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 361: Update GitHub actions Inspected
PR 364: BUILD-13184: Pin third-party actions to StepSecurity Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud