build: migrate developer tasks to mise

[binaryaaron]

Why

Developer commands and CI duplicated task definitions across the Makefile and workflow files, which allowed local and CI behavior to drift. Mise provides one versioned task graph and pins the tools that execute it.

No linked issue required: maintainer-owned developer infrastructure migration.

Summary

• migrate developer tasks and CI invocation to Mise
• adopt the shared colon-delimited task vocabulary; public task names contain no hyphens or aliases
• compose prerequisites and ordered stages with native Mise task references
• source the existing uv-managed virtual environment through Mise and let locked uv run tasks prepare their own profiles
• preserve blocking ty 0.0.69 and DataDesigner 0.9 compatibility from current main
• require Mise 2026.7.6 or newer; pin uv 0.12.3 and Ruff 0.16.2
• require a current uv.lock for dependency profiles and project-backed task execution
• enable audited Ruff error and safe-fix rules, then apply their fixes
• check tracked Python sources and rendered notebooks with Ruff and ty
• remove deprecated Make task aliases while retaining the minimal Mise bootstrap
• add setup all for every locked dependency group and test:all for unit plus opt-in E2E suites
• keep benchmark workflow/setup code on the workflow revision while checking arbitrary historical benchmark refs into an isolated target directory
• harden Mise installation using the fingerprint-pinned HTTPS key retrieval from Safe-Synthesizer #686, the exact versioned signed installer, and file-backed unsigned fallback downloads

Command tree

Intent	Command
Onboarding	mise run setup [runtime|dev|docs|notebooks|all]
Dependency sync	mise run deps:sync [runtime|dev|docs|notebooks|all]
Repository hooks	mise run hooks:install
Static checks	mise run check and mise run check:*
Default local gate	mise run check ::: test
Tests	mise run test, mise run test:all, mise run test:coverage, mise run test:e2e
Documentation	mise run docs:build, mise run docs:serve
Notebooks	mise run notebooks:execute
Build	mise run build:wheel
Lock update	mise run lock:update

Task names follow <domain>[:<action>[:<qualifier>...]]. Arguments select profiles or values. Commands containing check preserve tracked files. Mutating tasks state their outputs in mise tasks.

The default local gate stays explicit because it runs only static checks and unit tests; affected specialized suites remain separate. No validate task or removed Make compatibility alias is restored.

Task and environment boundaries

• Mise owns pinned tools, environment variables, virtual-environment activation, and task composition.
• uv owns Python dependency resolution and the contents of the project environment.
• uv run --locked --group <profile> makes leaf tasks independently runnable and synchronizes the requested locked profile.
• deps:sync remains the explicit command for preparing a profile without running another task.
• depends models prerequisites such as clean:pycache; structured task references model ordered stages such as build then publish.
• setup remains the shared local and CI entry point. CI uses --no-hooks to skip repository hook installation.

Base and compatibility

• rebased onto main at 46bcd1e
• preserve data-designer>=0.9,<0.10 and ty 0.0.69 from main; no dependency downgrades were introduced while regenerating uv.lock
• retain only make help, make install-mise, and make setup
• use make setup as the bootstrap path for machines without Mise
• keep Ruff and ty versions aligned between Mise and the uv development environment
• reject unknown dependency profiles through Mise usage validation
• preserve the Python version requested by each CI matrix job

Migration audits

• Ruff 0.16: enable E9, RUF100, UP015, UP017, UP035, and UP037; apply safe fixes; format and lint tracked Python files and rendered notebooks. The incidental library and tooling formatting edits are mechanical Ruff migrations with no intended behavior change.
• uv 0.12: use locked synchronization for every dependency profile and locked project execution where applicable.
• ty 0.0.69: preserve the blocking repository check and verify that the configured docs path discovers all rendered notebooks.
• pre-commit: run the blocking aggregate check, including read-only lock verification; lock regeneration remains the explicit lock:update operation.
• Make: confirm no repository automation or documentation depends on the removed forwarding aliases.

Security

GitHub Actions requires a GPG-verified Mise installer and fails closed if verification cannot complete. The installer fetches the pinned release key through HTTPS, verifies its fingerprint, downloads the signed installer from the exact pinned Mise release, and avoids dirmngr keyserver hangs. Local installation retains its documented unsigned fallback for slim development environments, but downloads the script completely to a temporary file before execution so curl retries cannot concatenate partial responses.

The PyPI task validates credentials before building, requires an explicit version, keeps credentials out of process arguments, and supports an upload-free --dry-run.

Validation

• mise tasks validate: all 25 tasks passed
• mise run deps:sync all: every locked dependency group synchronized successfully
• mise run --dry-run test:all: resolved to the unit suite followed by the opt-in E2E suite
• mise run check ::: test: 1,211 tests passed; Ruff, ty, lock, formatting, SPDX, and benchmark shell checks passed
• mise run docs:build: strict documentation build passed
• mise exec -- uv run --locked --group dev pytest tests/tools/test_mise_configuration.py -q: 20 focused workflow/tooling regression tests passed
• bash tests/tools/test_benchmark_task.sh: benchmark profiles and quoted forwarding passed on Bash 5.2
• docker run ... bash:3.2 bash tests/tools/test_benchmark_task.sh: the same shell regression suite passed on Bash 3.2.57
• bash -n tools/install-mise.sh: signed-installer script syntax passed

[greptile-apps]

Greptile Summary

The PR replaces duplicated Make and CI developer commands with a versioned Mise task graph. The follow-up changes successfully keep benchmark workflow setup on the workflow revision while checking the selected benchmark ref into an isolated target directory.

• Adds pinned Mise, uv, Ruff, and ty tooling with locked setup, quality, test, documentation, notebook, benchmark, build, and publishing tasks.
• Migrates CI workflows and contributor documentation to the shared Mise commands.
• Isolates historical benchmark targets under benchmark-target and consistently roots execution, summaries, and artifacts there.

Confidence Score: 5/5

The PR appears safe to merge because the previously reported benchmark checkout and local-action resolution failures no longer remain.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/benchmark-ci.yml	The workflow now loads setup from its own revision, isolates the selected benchmark ref, and consistently uses target-relative execution and artifact paths.
.github/actions/setup-python-env/action.yml	The composite action supports setup without an internal checkout and requires signed Mise installation in CI.
.mise/tasks/setup.toml	Setup and dependency synchronization use validated profiles and locked uv operations.
tools/install-mise.sh	CI installation fails closed on signature-verification failures, while the documented unsigned fallback remains limited to local bootstrap.
tests/tools/test_mise_configuration.py	Regression coverage verifies that benchmark setup remains on the workflow revision and the historical checkout remains isolated.

Sequence Diagram

sequenceDiagram
  participant CI as Benchmark workflow
  participant Root as Workflow revision
  participant Setup as setup-python-env
  participant Target as benchmark-target
  participant Runner as Benchmark runner
  CI->>Root: Checkout workflow revision
  CI->>Setup: Load current local action
  Setup->>Root: Install Mise and pinned tools
  CI->>Target: Checkout BENCHMARK_REF
  CI->>Runner: Run from benchmark-target
  Runner->>Target: Read target code, suite, and lockfile
  Runner-->>Target: Write benchmark outputs
  CI->>Target: Upload benchmark artifacts

Loading

_{Reviews (7): Last reviewed commit: "build: pin mise installer signature to v..." | Re-trigger Greptile}

[andreatnvidia]

Could we keep the workflow revision checked out while this local action runs, then check out release-ref into a separate directory like benchmark-ci.yml does? Right now the action comes from release-ref, so older tags use the old setup action: checkout: "false" is ignored, the workspace switches back to github.ref, and Mise never gets installed. Historical releases therefore fail at the build step, and the docs job has the same issue.

[binaryaaron]

Addressed in stacked follow-up #249. Instead of adding a second release checkout, it follows Safe Synthesizer’s tag-push strategy: pushed v* tags run the full production release from the triggering revision, while workflow_dispatch remains available with dry-run and create-gh-release controls but no release-ref input. Every job uses its ordinary checkout ref, so workflow orchestration, setup, build, and docs stay on one revision. The focused workflow suite passes (21 tests), the full local gate passes (1,212 tests), and the strict docs build passes. I am leaving this thread open until the stacked follow-up lands.

[andreatnvidia]

The Mise direction looks good. I found three blockers around historical releases, the signed bootstrap, and macOS benchmark execution. There’s also one non-blocking argument-forwarding bug in the same benchmark task.