chore(ci): adopt mise, move to Node 24 for npm OIDC trusted publishing

.github/workflows/pr-checks.yml

@@ -19,19 +19,20 @@ jobs:
             - name: Setup pnpm
               uses: pnpm/action-setup@v4
 
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 22
-                  cache: 'pnpm'
+            # Toolchains come from mise.toml, read here by mise-action so the runner
+            # and a developer's shell resolve identical versions.
+            - name: Setup toolchains (mise)
+              uses: jdx/mise-action@v4
 
-            - name: Setup Python
-              uses: actions/setup-python@v5
-              with:
-                  python-version: '3.13'
+            - name: Locate pnpm store
+              run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
 
-            - name: Setup uv
-              uses: astral-sh/setup-uv@v6
+            - name: Cache pnpm store
+              uses: actions/cache@v4
+              with:
+                  path: ${{ env.STORE_PATH }}
+                  key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+                  restore-keys: ${{ runner.os }}-pnpm-store-
 
             - name: Setup Rust toolchain
               uses: dtolnay/rust-toolchain@stable
@@ -43,12 +44,6 @@ jobs:
                       rust/file -> rust/file/target
                   cache-on-failure: true
 
-            - name: Setup Go
-              uses: actions/setup-go@v5
-              with:
-                  go-version: '1.23'
-                  cache-dependency-path: go/file/go.sum
-
             - name: Setup .NET
               uses: actions/setup-dotnet@v4
               with:

.github/workflows/release.yml

@@ -28,19 +28,20 @@ jobs:
             - name: Setup pnpm
               uses: pnpm/action-setup@v4
 
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 22
-                  cache: 'pnpm'
+            # Toolchains come from mise.toml, read here by mise-action so the runner
+            # and a developer's shell resolve identical versions.
+            - name: Setup toolchains (mise)
+              uses: jdx/mise-action@v4
 
-            - name: Setup Python
-              uses: actions/setup-python@v5
-              with:
-                  python-version: '3.13'
+            - name: Locate pnpm store
+              run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
 
-            - name: Setup uv
-              uses: astral-sh/setup-uv@v6
+            - name: Cache pnpm store
+              uses: actions/cache@v4
+              with:
+                  path: ${{ env.STORE_PATH }}
+                  key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+                  restore-keys: ${{ runner.os }}-pnpm-store-
 
             - name: Setup Rust toolchain
               uses: dtolnay/rust-toolchain@stable
@@ -52,12 +53,6 @@ jobs:
                       rust/file -> rust/file/target
                   cache-on-failure: true
 
-            - name: Setup Go
-              uses: actions/setup-go@v5
-              with:
-                  go-version: '1.23'
-                  cache-dependency-path: go/file/go.sum
-
             - name: Setup .NET
               uses: actions/setup-dotnet@v4
               with:

mise.toml

@@ -0,0 +1,16 @@
+# Toolchain versions for this repo — read by mise locally and by
+# jdx/mise-action in CI, so a developer's shell and the runner agree.
+#
+# Not listed here on purpose:
+#   pnpm  -> package.json "packageManager". pnpm self-substitutes to that
+#            version regardless of which pnpm binary launches it, so a mise
+#            pin would be cosmetic and would drift.
+#   dotnet-> actions/setup-dotnet. It installs several SDKs side by side
+#            (8/9/10 in some repos); mise's dotnet backend pins one.
+#   rust  -> rust-toolchain.toml + dtolnay/rust-toolchain. rustup is canonical
+#            and mise defers to it anyway.
+[tools]
+node = "24.14.0" # ships npm 11.9.0 — required (>=11.5.1) for npm OIDC trusted publishing
+python = "3.13"
+go = "1.23"
+uv = "latest"

package.json

@@ -122,5 +122,5 @@
         "vitest": "^3.0.9",
         "vitest-tsconfig-paths": "^3.4.1"
     },
-    "packageManager": "pnpm@10.6.1+sha512.40ee09af407fa9fbb5fbfb8e1cb40fbb74c0af0c3e10e9224d7b53c7658528615b2c92450e74cfad91e3a2dcafe3ce4050d80bda71d757756d2ce2b66213e9a3"
+    "packageManager": "pnpm@10.34.5"
 }