Trust generated mise config before running mise env/install - #2414
Open
eon-pulumi-agent[bot] wants to merge 2 commits into
Open
Trust generated mise config before running mise env/install#2414eon-pulumi-agent[bot] wants to merge 2 commits into
eon-pulumi-agent[bot] wants to merge 2 commits into
Conversation
pose
requested changes
Jul 22, 2026
pose
left a comment
pose
left a comment
Member
There was a problem hiding this comment.
@corymhall I would like to this discuss this since it's related to: https://github.com/pulumi/home/issues/4462#issuecomment-4934728789
corymhall
removed their request for review
July 23, 2026 12:30
Renovate's postUpgradeTasks runner (and any other environment that hasn't pre-trusted the repo) causes 'mise env'/'mise install' to abort with 'Config files ... are not trusted', which in turn aborts 'make renovate' -> 'make generate_sdks' before any artifacts are regenerated. The PR then lands with the dependency bumped but stale generated SDK/schema output. Run 'mise trust --yes -q' ahead of 'mise env -q' and 'mise install -q' in the generated Makefile's mise_env / .make/mise_install targets so mise commands work regardless of whether the runner has pre-trusted the generated .config/mise.toml. This is the first suggested fix from issue #2413. Fixes #2413
Trusting the generated .config/mise.toml in the shared mise_env/ .make/mise_install targets affects every provider and every make invocation, not just Renovate. Since the mise config staleness problem only manifests in Renovate's postUpgradeTasks runner, move the 'mise trust --yes -q' call into the generated 'renovate' Makefile target instead (only rendered when .Config.RenovateCmd is set), right before it invokes the provider's renovate command. Trust is persisted by mise, so this covers the recursive 'make generate_sdks' invocation that renovate.sh performs. This reduces the diff footprint to only the providers that opt into RenovateCmd (currently just the eks test provider) plus the two template files.
pose
force-pushed
the
fix-2413-mise-trust-postupgrade
branch
from
July 24, 2026 13:07
f2d413a to
2dc6727
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Renovate can run
make renovatebefore mise trusts the generated.config/mise.toml. This stops SDK and schema files from being regenerated after dependency updates.This PR makes the generated
renovatetarget trust the mise config before running the provider’s Renovate script. Other Makefile targets are unchanged.Fixes #2413.
Alternative / possible follow-up
We could instead configure the Renovate runner to trust mise configs globally using
MISE_TRUSTED_CONFIG_PATHSorMISE_YES=1. That would cover all uses of mise in Renovate, but it would grant broader trust and require a change outside this repository.Reviewer feedback on whether the scoped fix in this PR or a central Renovate configuration is preferable would be welcome.
Testing
cd provider-ci && make all