ci: move release-plz flow into mise tasks

.github/renovate-tracked-deps.json

@@ -4,19 +4,19 @@
       "mise"
     ]
   },
-  ".github/workflows/release.yml": {
+  ".github/workflows/release-assets.yml": {
     "regex": [
       "mise"
     ]
   },
-  ".github/workflows/test.yml": {
+  ".github/workflows/release-plz.yml": {
     "regex": [
       "mise"
     ]
   },
-  "README.md": {
+  ".github/workflows/test.yml": {
     "regex": [
-      "grafana/flint"
+      "mise"
     ]
   },
   "mise.toml": {
@@ -37,6 +37,7 @@
       "node",
       "npm:renovate",
       "pipx:codespell",
+      "release-plz",
       "ruff",
       "rumdl",
       "rust",

.github/renovate.json5

@@ -23,16 +23,6 @@
       matchStrings: ["https://raw\\.githubusercontent\\.com/(?<depName>[^/]+/[^/]+)/(?<currentDigest>[a-f0-9]{40})/.*#\\s*(?<currentValue>v\\S+)"],
       datasourceTemplate: "github-tags",
     },
-    {
-      customType: "regex",
-      description: "Update flint version in README.md install snippets",
-      managerFilePatterns: ["/^README\\.md$/"],
-      matchStrings: ['"github:grafana/flint"\\s*=\\s*"(?<currentValue>[^"]+)"'],
-      datasourceTemplate: "github-releases",
-      depNameTemplate: "grafana/flint",
-      packageNameTemplate: "grafana/flint",
-      extractVersionTemplate: "^v?(?<version>.+)$",
-    },
     {
       customType: "regex",
       description: "Update mise version in GitHub Actions workflows",

.github/workflows/release.yml → .github/workflows/release-assets.yml

@@ -1,5 +1,5 @@
 ---
-name: Release
+name: Release Assets
 
 on:
   push:

.github/workflows/release-plz.yml

@@ -1,5 +1,5 @@
 ---
-name: Release-plz
+name: Release Management
 
 on:
   push:
@@ -12,8 +12,8 @@ jobs:
   release:
     # Runs on every push to main. If the release PR was just merged (i.e. Cargo.toml
     # version was bumped), creates a git tag and a draft GitHub release, then triggers
-    # release.yml to build platform binaries and publish the release.
-    name: Release
+    # release-assets.yml to build platform binaries and publish the release.
+    name: Create Release
     runs-on: ubuntu-24.04
     if: ${{ github.repository == 'grafana/flint' }}
     permissions:
@@ -24,26 +24,22 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: release-plz/action@1528104d2ca23787631a1c1f022abb64b34c1e11  # v0.5
-        id: release-plz
+      - name: Setup mise
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151  # v4.0.1
         with:
-          command: release
+          version: v2026.4.18
+          sha256: 6ae2d5f0f23a2f2149bc5d9bf264fe0922a1da843f1903e453516c462b23cc1f
+      - name: Create release metadata
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Trigger binary release
-        if: ${{ steps.release-plz.outputs.releases_created == 'true' }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: >
-          gh workflow run release.yml
-          -f tag=${{ fromJSON(steps.release-plz.outputs.releases)[0].tag }}
+        run: mise run release:create
 
   release-pr:
     # Runs on every push to main. Keeps an open PR that bumps Cargo.toml version
     # and updates CHANGELOG.md based on conventional commits since the last release.
     # Merging this PR triggers the release job above.
     # Depends on release so the new git tag exists before we compute the next version.
-    name: Release PR
+    name: Update Release PR
     needs: [release]
     runs-on: ubuntu-24.04
     if: ${{ github.repository == 'grafana/flint' }}
@@ -58,8 +54,12 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: release-plz/action@1528104d2ca23787631a1c1f022abb64b34c1e11  # v0.5
+      - name: Setup mise
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151  # v4.0.1
         with:
-          command: release-pr
+          version: v2026.4.18
+          sha256: 6ae2d5f0f23a2f2149bc5d9bf264fe0922a1da843f1903e453516c462b23cc1f
+      - name: Update release PR
+        run: mise run release:pr
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.mise/tasks/release/create

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+#MISE description="Create git tags and GitHub releases when a release PR was merged"
+#USAGE arg "[args]" var=#true help="Additional arguments passed to release-plz release"
+
+set -euo pipefail
+
+if [ -z "${GITHUB_TOKEN:-}" ]; then
+	echo "GITHUB_TOKEN environment variable is not set. Exiting."
+	exit 1
+fi
+
+tmp_json="$(mktemp)"
+trap 'rm -f "${tmp_json}"' EXIT
+
+release_args=()
+if [ -n "${usage_args:-}" ]; then
+	# Mise provides variadic args as a shell-escaped string.
+	eval "release_args=(${usage_args})"
+fi
+
+release-plz release -o json "${release_args[@]}" >"${tmp_json}"
+
+jq -e '.releases and (.releases | type == "array")' "${tmp_json}" >/dev/null
+
+if ! jq -e '.releases | length > 0' "${tmp_json}" >/dev/null; then
+	echo "No releases created."
+	exit 0
+fi
+
+if [ -z "${GH_TOKEN:-}" ]; then
+	export GH_TOKEN="${GITHUB_TOKEN}"
+fi
+
+tag="$(jq -r '.releases[0].tag' "${tmp_json}")"
+
+gh workflow run release-assets.yml -f "tag=${tag}"

.mise/tasks/release/docs-sync

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+#MISE description="Refresh release-managed docs snippets"
+
+set -euo pipefail
+
+cargo run --bin sync-readme-snippets
+cargo run -q --bin flint -- run --fix --allow-fixed

.mise/tasks/release/update

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+#MISE description="Update release-plz state locally"
+#USAGE arg "[args]" var=#true help="Additional arguments passed to release-plz update"
+
+set -euo pipefail
+
+update_args=()
+if [ -n "${usage_args:-}" ]; then
+	# Mise provides variadic args as a shell-escaped string.
+	eval "update_args=(${usage_args})"
+fi
+
+release-plz update "${update_args[@]}"
+mise run release:docs-sync

README.md

@@ -36,7 +36,7 @@ Add `flint` to your repo's `mise.toml`:
 
 ```toml
 [tools]
-"github:grafana/flint" = "0.20.4"
+"github:grafana/flint" = "0.21.0"
 ```
 
 Bootstrap a repo with `flint init` (scaffolds config). Install a
@@ -50,29 +50,29 @@ enable during the prompt, or trim the generated tool list afterward if you run
 
 Flint reads your `[tools]` section to discover which linters to run — declaring
 a tool is the opt-in. No separate configuration needed to activate a check: if
-ShellCheck's Flint-managed tool key is in `[tools]`, flint runs shellcheck; if
-it isn't, that check is skipped. `mise install` puts all declared tools on PATH;
-flint picks up whatever is there.
+ShellCheck's Flint-managed tool key is present in `[tools]`, flint runs
+shellcheck; otherwise that check is skipped. `mise install` puts all declared
+tools on PATH; flint picks up whatever is there.
 
 Add the linting tools your project needs alongside the `flint` binary itself:
 
 ```toml
 [tools]
-"github:grafana/flint" = "0.20.4"
+"github:grafana/flint" = "0.21.0"
 
 # Add whichever linters apply to your repo:
 "github:koalaman/shellcheck" = "0.11.0"
-shfmt                   = "3.13.1"
+shfmt                   = "v3.13.1"
 actionlint              = "1.7.10"
 rumdl                   = "0.1.78"
-ruff                    = "0.15.11"
+ruff                    = "0.15.12"
 "aqua:owenlamont/ryl"   = "0.6.0"
 taplo                   = "0.10.0"
 biome                   = "2.4.12"
-rust                    = "1.87.0"    # activates cargo-fmt + cargo-clippy
-go                      = "1.24.0"    # activates gofmt
-lychee                  = "0.18.0"    # activates links check
-"npm:renovate"          = "39.0.0"    # activates renovate-deps check
+rust                    = "1.95.0"    # activates cargo-fmt + cargo-clippy
+go                      = "1.26.2"    # activates gofmt
+lychee                  = "0.22.0"    # activates links check
+"npm:renovate"          = "43.141.5"  # activates renovate-deps check
 ```
 
 Then wire up lint tasks: