chore(ci): use github runners for fork prs

.github/actions/setup-mbx/action.yml

@@ -0,0 +1,32 @@
+name: Set up mbx
+description: Install mbx from mise.toml and optionally restore the main-branch GHA cache
+
+inputs:
+  restore-cache:
+    description: Restore the read-only GitHub Actions cache built from main
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      if: inputs.restore-cache == 'true'
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git
+          ~/.cargo/.global-cache
+          ~/.cache/mbx
+        key: ${{ runner.os }}-${{ runner.arch }}-fork-pr-mbx-v0.2.0-${{ github.event.pull_request.base.sha }}
+        restore-keys: |
+          ${{ runner.os }}-${{ runner.arch }}-fork-pr-mbx-v0.2.0-
+    - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+      with:
+        cache: false
+        install_args: github:jdx/mr-boxington
+    - name: Verify mbx
+      shell: bash
+      run:
+        | # zizmor: ignore[github-env] PATH and cache paths use only runner-owned directories
+        mbx --version
+        echo "MBX_CACHE_DIR=$HOME/.cache/mbx" >> "$GITHUB_ENV"

.github/workflows/docs.yml

@@ -45,7 +45,7 @@ env:
 jobs:
   docs:
     if: github.repository == 'jdx/mise'
-    runs-on: namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux
+    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:

.github/workflows/github-runner-cache.yml

@@ -0,0 +1,50 @@
+name: github runner cache
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 0"
+  workflow_dispatch:
+
+concurrency:
+  group: github-runner-cache-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+
+jobs:
+  warm:
+    if: github.ref == 'refs/heads/main'
+    name: warm-${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-14]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            ~/.cargo/.global-cache
+            ~/.cache/mbx
+          key: ${{ runner.os }}-${{ runner.arch }}-fork-pr-mbx-v0.2.0-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-${{ runner.arch }}-fork-pr-mbx-v0.2.0-
+      - uses: ./.github/actions/setup-mbx
+      - run: mbx build build --all-features --ignore-rust-version
+      # Bound each immutable GHA cache entry so Linux and macOS can coexist
+      # within the repository cache quota.
+      - run: mbx gc --max-size 3GB
+        if: always()

.github/workflows/perf-pr.yml

@@ -16,6 +16,13 @@ name: perf-pr
 on:
   pull_request:
     types: [opened, synchronize, reopened]
+    # These files change the repository's development environment rather than
+    # the mise binary. In particular, root mise.toml tools are inherited by the
+    # benchmark fixture and would make the head and base inputs differ.
+    paths-ignore:
+      - ".github/**"
+      - "mise.lock"
+      - "mise.toml"
 
 permissions:
   contents: read

.github/workflows/registry.yml

@@ -22,7 +22,7 @@ env:
 
 jobs:
   check-changes:
-    runs-on: namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux
+    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux' }}
     timeout-minutes: 5
     outputs:
       registry-changed: ${{ steps.check.outputs.registry-changed }}
@@ -51,44 +51,35 @@ jobs:
 
   build:
     timeout-minutes: 20
-    runs-on: namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux
+    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux' }}
     needs: check-changes
     if: needs.check-changes.outputs.registry-changed == 'true'
     env:
       GITHUB_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             ~/.cargo/.global-cache
-            ~/.cache/sccache
-      - uses: taiki-e/install-action@51cd0b8c0499559d9a4d75c0f5c67bec3a894ec8 # v2
-        with: { tool: sccache }
-      - name: Configure sccache
-        run: |
-          export RUSTC_WRAPPER=sccache
-          export SCCACHE_DIR="$HOME/.cache/sccache"
-          export SCCACHE_CACHE_SIZE=20G
-          {
-            echo "RUSTC_WRAPPER=$RUSTC_WRAPPER"
-            echo "SCCACHE_DIR=$SCCACHE_DIR"
-            echo "SCCACHE_CACHE_SIZE=$SCCACHE_CACHE_SIZE"
-          } >> "$GITHUB_ENV"
-          sccache --zero-stats
-      - run: cargo build --all-features --ignore-rust-version
+            ~/.cache/mbx
+      - uses: ./.github/actions/setup-mbx
+        with:
+          restore-cache: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
+      - run: mbx build build --all-features --ignore-rust-version
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: mise
           path: target/debug/mise
-      - run: sccache --show-stats
+      - run: mbx cache stats
         if: always()
 
   list-changed-tools:
     timeout-minutes: 10
-    runs-on: namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux
+    runs-on: ${{ github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux' }}
     needs: check-changes
     if: github.event_name == 'pull_request' && needs.check-changes.outputs.registry-changed == 'true'
     outputs:
@@ -142,7 +133,7 @@ jobs:
           fi
 
   validate-new-tools:
-    runs-on: namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux
+    runs-on: ${{ github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux' }}
     timeout-minutes: 5
     needs: list-changed-tools
     if: |
@@ -171,7 +162,7 @@ jobs:
   test-tool:
     name: test-tool-${{ matrix.tranche }}
     timeout-minutes: 90
-    runs-on: namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux
+    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux' }}
     needs:
       - build
       - list-changed-tools
@@ -356,7 +347,7 @@ jobs:
         run: mise run test-tool-retry --check-only --grace-period ${{ steps.retry.outputs.failed_tools }}
 
   registry-ci:
-    runs-on: namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux
+    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux' }}
     timeout-minutes: 1
     needs:
       - check-changes

.github/workflows/release.yml

@@ -25,9 +25,9 @@ env:
 
 jobs:
   build-tarball-linux:
-    if: github.event_name != 'pull_request' || github.head_ref == 'release'
+    if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
     name: build-tarball-${{matrix.name}}
-    runs-on: namespace-profile-endev-linux-amd64-xlarge
+    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'namespace-profile-endev-linux-amd64-xlarge' }}
     # PGO and cross-built release tarballs can exceed 90 minutes on
     # loaded runners, especially once archive generation is included.
     timeout-minutes: 150
@@ -92,9 +92,9 @@ jobs:
             dist/mise-*.tar.zst
           if-no-files-found: error
   build-tarball-macos:
-    if: github.event_name != 'pull_request' || github.head_ref == 'release'
+    if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
     name: build-tarball-${{matrix.name}}
-    runs-on: namespace-profile-endev-macos-arm64
+    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'macos-14' || 'namespace-profile-endev-macos-arm64' }}
     timeout-minutes: 300
     env:
       MINIO_AWS_ACCESS_KEY_ID: ${{ secrets.MINIO_AWS_ACCESS_KEY_ID }}
@@ -141,7 +141,7 @@ jobs:
             dist/mise-*.tar.zst
           if-no-files-found: error
   build-tarball-windows:
-    if: github.event_name != 'pull_request' || github.head_ref == 'release'
+    if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
     name: build-tarball-windows-${{matrix.arch}}
     runs-on: windows-latest
     # Matches the Linux tarball job. 60 was sized for a non-LTO build; the fat-LTO
@@ -171,7 +171,7 @@ jobs:
           path: dist/*.zip
           if-no-files-found: error
   e2e-linux:
-    if: github.event_name != 'pull_request' || github.head_ref == 'release'
+    if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
     name: e2e-linux-${{matrix.tranche}}
     needs: [build-tarball-linux]
     runs-on: ubuntu-latest
@@ -213,7 +213,7 @@ jobs:
           max_attempts: 3
           command: ./e2e/run_all_tests
   rpm:
-    if: github.event_name != 'pull_request' || github.head_ref == 'release'
+    if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
     needs: [build-tarball-linux]
     timeout-minutes: 10
@@ -238,7 +238,7 @@ jobs:
           path: dist/rpmrepo
           if-no-files-found: error
   deb:
-    if: github.event_name != 'pull_request' || github.head_ref == 'release'
+    if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
     needs: [build-tarball-linux]
     container: ghcr.io/jdx/mise:deb@sha256:bf1cd854cde9a3c97c274c86a8fb164ea90811892999fe7a50ee42dcd54f2de8
@@ -274,10 +274,10 @@ jobs:
       - build-tarball-linux
       - build-tarball-macos
       - build-tarball-windows
-    if: ${{ !cancelled() && !failure() }}
+    if: ${{ !cancelled() && !failure() && (github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)) }}
     steps:
       - name: Verify all build targets succeeded
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
         run: |
           failed=""
           for result in \
@@ -322,36 +322,31 @@ jobs:
             echo "No release found for $VERSION"
             echo "exists=false" >> "$GITHUB_OUTPUT"
           fi
-      - name: Skip release for non-release branch PRs
-        if: github.event_name == 'pull_request' && github.head_ref != 'release'
-        run: |
-          echo "Skipping release steps for PR from non-release branch"
-          echo "All release operations will be skipped"
       - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
         with:
           gpg_private_key: ${{ secrets.MISE_GPG_KEY }}
           git_user_signingkey: true
           git_commit_gpgsign: true
       - run: ./scripts/setup-zipsign.sh
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
         env:
           ZIPSIGN: ${{ secrets.ZIPSIGN }}
       - name: Install fd-find
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
         run: |
           sudo apt-get update
           sudo apt-get install fd-find minisign
           mkdir -p "$HOME/.local/bin"
           ln -s "$(which fdfind)" "$HOME/.local/bin/fd"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
         with: { path: artifacts }
       - run: ls -R artifacts
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
         with:
           path: artifacts
           pattern: |
@@ -361,22 +356,22 @@ jobs:
             mise-v*.zip
           merge-multiple: true
       - run: echo "${{ secrets.MINISIGN_KEY }}" >minisign.key
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
       - run: ls -R artifacts
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
         with:
           name: tarball-x86_64-unknown-linux-gnu
           path: dist
       - run: tar -C "$HOME" -xvf "dist/mise-$(./scripts/get-version.sh)-linux-x64.tar.zst"
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
       - run: echo "$HOME/mise/bin" >> "$GITHUB_PATH"
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
       - run: which mise && mise -v && mise i
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
       - run: mise x -- scripts/release.sh
-        if: github.event_name != 'pull_request' || github.head_ref == 'release'
+        if: github.event_name != 'pull_request' || (github.head_ref == 'release' && github.event.pull_request.head.repo.full_name == github.repository)
       - name: Generate release notes
         if: startsWith(github.ref, 'refs/tags/v') && steps.check-release.outputs.exists != 'true'
         run: |

.github/workflows/test-vfox.yml

@@ -21,35 +21,28 @@ env:
 
 jobs:
   "test-vfox":
-    runs-on: namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux
+    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'namespace-profile-endev-linux-amd64;overrides.cache-tag=mise-pr-rust-linux' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             ~/.cargo/.global-cache
-            ~/.cache/sccache
-      - uses: taiki-e/install-action@51cd0b8c0499559d9a4d75c0f5c67bec3a894ec8 # v2
-        with: { tool: sccache }
-      - name: Configure sccache
-        run: |
-          export RUSTC_WRAPPER=sccache
-          export SCCACHE_DIR="$HOME/.cache/sccache"
-          export SCCACHE_CACHE_SIZE=20G
-          {
-            echo "RUSTC_WRAPPER=$RUSTC_WRAPPER"
-            echo "SCCACHE_DIR=$SCCACHE_DIR"
-            echo "SCCACHE_CACHE_SIZE=$SCCACHE_CACHE_SIZE"
-          } >> "$GITHUB_ENV"
-          sccache --zero-stats
+            ~/.cache/mbx
+      - uses: ./.github/actions/setup-mbx
+        with:
+          restore-cache: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
       - run: |
-          cargo build --all-features --ignore-rust-version
+          mbx build build --all-features --ignore-rust-version
           echo "$PWD/target/debug" >> "$GITHUB_PATH"
       - run: mise -v
-      - run: mise --cd crates/vfox run build
+      - run: mbx build build
+        working-directory: crates/vfox
       - run: mise --cd crates/vfox run lint
-      - run: mise --cd crates/vfox run test
-      - run: sccache --show-stats
+      - run: mbx build test
+        working-directory: crates/vfox
+      - run: mbx cache stats
         if: always()