fix: use mise bootstrap script so renovate works without pre-installed mise

provider-ci/.gitignore

@@ -1,2 +1,4 @@
 bin/
+!internal/pkg/templates/base/bin/
+!internal/pkg/templates/base/bin/mise
 providers/*/repo

provider-ci/internal/pkg/generate.go

@@ -327,8 +327,9 @@ func renderTemplateFile(tmpl *template.Template, outPath string, ctx templateCon
 		return err
 	}
 
-	// Make shell scripts executable
-	if strings.HasSuffix(outPath, ".sh") {
+	// Make shell scripts and the mise bootstrap script executable
+	isMiseBinary := filepath.Base(outPath) == "mise" && filepath.Base(filepath.Dir(outPath)) == "bin"
+	if strings.HasSuffix(outPath, ".sh") || isMiseBinary {
 		err = os.Chmod(outPath, 0o755)
 		if err != nil {
 			return err

provider-ci/internal/pkg/migrations/allow_bin_mise.go

@@ -0,0 +1,50 @@
+package migrations
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// bin/mise is a committed bootstrap script that allows mise to be installed
+// in environments where it is not already present (e.g. the Renovate CE container).
+// If a repo's .gitignore excludes bin/, we add an explicit exception so
+// bin/mise is tracked.
+type allowBinMise struct{}
+
+func (allowBinMise) Name() string {
+	return "Allow bin/mise in .gitignore"
+}
+func (allowBinMise) ShouldRun(templateName string) bool {
+	return templateName == "bridged-provider" || templateName == "all"
+}
+func (allowBinMise) Migrate(templateName, outDir string) error {
+	gitignorePath := filepath.Join(outDir, ".gitignore")
+	gitignore, err := os.ReadFile(gitignorePath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return fmt.Errorf("error reading .gitignore: %w", err)
+	}
+	gitignoreString := string(gitignore)
+
+	// Only add the exception if bin/ is already being ignored.
+	binIgnored := strings.Contains(gitignoreString, "\nbin\n") ||
+		strings.Contains(gitignoreString, "\nbin/\n") ||
+		strings.HasPrefix(gitignoreString, "bin\n") ||
+		strings.HasPrefix(gitignoreString, "bin/\n")
+	if !binIgnored {
+		return nil
+	}
+
+	if !strings.Contains(gitignoreString, "!bin/mise") {
+		gitignoreString += "\n# Allow the committed mise bootstrap script\n!bin/mise\n"
+		err := os.WriteFile(gitignorePath, []byte(gitignoreString), 0644)
+		if err != nil {
+			return fmt.Errorf("error writing to .gitignore: %w", err)
+		}
+	}
+	return nil
+}

provider-ci/internal/pkg/migrations/migrations.go

@@ -26,6 +26,7 @@ func Migrate(templateName, outDir string) error {
 		maintainMiseLock{},
 		maintainGolangciConfig{},
 		unignoreSDKSchemaGo{},
+		allowBinMise{},
 	}
 	for i, migration := range migrations {
 		if !migration.ShouldRun(templateName) {

provider-ci/internal/pkg/templates/base/Makefile

@@ -86,10 +86,10 @@ install_sdks:#{{ range .Config.Languages }}# install_#{{ . }}#_sdk#{{ end }}#
 mise_install: .make/mise_install | mise_env
 
 mise_env:
-	@mise env -q  > /dev/null
+	@./bin/mise env -q  > /dev/null
 
 .make/mise_install:
-	@mise install -q
+	@./bin/mise install -q
 	@touch $@
 
 
@@ -262,7 +262,7 @@ build_registry_docs: .make/build_registry_docs
 
 clean:
 	rm -rf sdk/{dotnet,nodejs,go,python}
-	rm -rf bin/*
+	find bin -mindepth 1 ! -name mise -delete
 	rm -rf .make/*
 	rm -rf "$(GEN_PULUMI_CONVERT_EXAMPLES_CACHE_DIR)"
 	if dotnet nuget list source | grep "$(WORKING_DIR)/nuget"; then \