SRE-805: Harden Docker mise tool installation against transient upstream failures

.config/mise/config.toml

@@ -1,11 +1,12 @@
-min_version = "2026.4.22"
+min_version = "2026.6.13"
 
 [env]
 TURBO_GLOBAL_WARNING_DISABLED = 1
 _.file                        = [".env", ".env.local"]
 
 [settings]
 idiomatic_version_file_enable_tools = ["rust"]
+lockfile                            = true
 minimum_release_age                 = "5d"
 
 [tools]

README.md

@@ -69,7 +69,7 @@ Install these on the host first:
 - **[Docker](https://docs.docker.com/get-docker/)** (≥ 20.10), including:
   - **[Docker Compose](https://docs.docker.com/compose/)** (≥ 2.17) — orchestrates the stack
   - **[Docker Buildx](https://docs.docker.com/build/install-buildx/)** (≥ 0.10) — builds the images
-- **[mise](https://mise.jdx.dev/)** (≥ 2026.4.22) — installs and pins Node, Rust, protoc and the other required tool versions
+- **[mise](https://mise.jdx.dev/)** (≥ 2026.6.13) — installs and pins Node, Rust, protoc and the other required tool versions
 
 Give Docker at least **8 GB RAM** (Preferences → Resources) and keep ~15 GB of disk free for build artefacts, images and volumes.
 
@@ -80,7 +80,7 @@ git --version            # ≥ 2.17
 docker --version         # ≥ 20.10
 docker compose version   # ≥ 2.17
 docker buildx version    # ≥ 0.10
-mise --version           # ≥ 2026.4.22
+mise --version           # ≥ 2026.6.13
 ```
 
 #### Setup

apps/hash-ai-worker-ts/docker/Dockerfile

@@ -14,7 +14,7 @@ COPY .config/mise /etc/mise
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
+    export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
     mise --version && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
@@ -65,17 +65,22 @@ FROM rust AS builder
 
 WORKDIR /usr/local/src/
 
+# Install system packages and tools before copying the JS dependency manifests
+# so this layer stays cached across dependency changes and tools are not
+# re-downloaded from upstream sources on every dependency bump.
+RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
+    apt-get update && \
+    apt-get install -y --no-install-recommends build-essential && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
 COPY --from=base /app/out/full/.yarn .yarn
 COPY --from=base /app/out/full/turbo.json turbo.json
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    apt-get update && \
-    apt-get install -y --no-install-recommends build-essential && \
-    apt-get clean && \
-    rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc && \
     yarn install --immutable && \
     yarn cache clean
 

apps/hash-api/docker/Dockerfile

@@ -14,7 +14,7 @@ COPY .config/mise /etc/mise
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
+    export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
     mise --version && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
@@ -65,17 +65,22 @@ FROM rust AS builder
 
 WORKDIR /usr/local/src/
 
+# Install system packages and tools before copying the JS dependency manifests
+# so this layer stays cached across dependency changes and tools are not
+# re-downloaded from upstream sources on every dependency bump.
+RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
+    apt-get update && \
+    apt-get install -y --no-install-recommends build-essential && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
 COPY --from=base /app/out/full/.yarn .yarn
 COPY --from=base /app/out/full/turbo.json turbo.json
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    apt-get update && \
-    apt-get install -y --no-install-recommends build-essential && \
-    apt-get clean && \
-    rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc && \
     yarn install --immutable && \
     yarn cache clean
 

apps/hash-frontend/docker/Dockerfile

@@ -12,7 +12,7 @@ COPY .config/mise /etc/mise
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    export MISE_VERSION=2026.4.22 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
+    export MISE_VERSION=2026.7.0 MISE_INSTALL_EXT=tar.gz && curl https://mise.run | sh && \
     mise --version && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
@@ -62,17 +62,22 @@ FROM rust AS builder
 
 WORKDIR /usr/local/src/
 
+# Install system packages and tools before copying the JS dependency manifests
+# so this layer stays cached across dependency changes and tools are not
+# re-downloaded from upstream sources on every dependency bump.
+RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
+    apt-get update && \
+    apt-get install -y --no-install-recommends build-essential && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+
 COPY --from=base /app/out/json/ .
 COPY --from=base /app/out/yarn.lock ./yarn.lock
 COPY --from=base /app/out/full/.yarn .yarn
 COPY --from=base /app/out/full/turbo.json turbo.json
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
-    apt-get update && \
-    apt-get install -y --no-install-recommends build-essential && \
-    apt-get clean && \
-    rm -rf /var/lib/apt/lists/* && \
-    mise install node npm:turbo java oxfmt npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc && \
     yarn install --immutable && \
     yarn cache clean
 

apps/hash-frontend/vercel-install.sh

@@ -23,7 +23,7 @@ echo "Adding wasm32-unknown-unknown target"
 rustup target add wasm32-unknown-unknown
 
 echo "Installing prerequisites"
-mise install node npm:turbo java biome npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
+mise install node npm:turbo java npm:@redocly/cli cargo-binstall cargo:wasm-pack cargo:wasm-opt protoc
 
 echo "Rust installation completed. Checking versions:"
 mise list rust