fix(aqua): improve GitHub token handling for sigstore verification

.devcontainer/devcontainer.json

@@ -31,6 +31,11 @@
   // Configure tool-specific properties.
   // "customizations": {},
 
+  // Environment variables to set in the container
+  "containerEnv": {
+    "MISE_TRUSTED_CONFIG_PATHS": "/"
+  },
+
   // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
   "remoteUser": "root"
 }

.devcontainer/post-create.sh

@@ -22,3 +22,5 @@ chmod +x /usr/local/bin/mise
 
 echo "Mise development shim created at /usr/local/bin/mise"
 echo "You can now run 'mise' commands which will use 'cargo run' under the hood" 
+
+mise --cd /workspaces/mise install

.github/workflows/test-plugins.yml

@@ -27,6 +27,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - name: Install cross
+        uses: taiki-e/install-action@0aa4f22591557b744fe31e55dbfcdfea74a073f7 # v2
+        with:
+          tool: cross
       - name: Rust Cache
         uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
         with:

packaging/dev/Dockerfile

@@ -23,10 +23,13 @@ RUN    apt-get update \
     && apt-get install -y --no-install-recommends \
     bison \
     build-essential \
+    clang \
     cmake \
     direnv \
     fd-find \
     fish \
+    libclang-dev \
+    pkg-config \
     python3-venv \
     pipx \
     && ln -s /usr/bin/{fdfind,fd} \

src/backend/aqua.rs

@@ -654,9 +654,7 @@ impl AquaBackend {
         let artifact_path = tv.download_path().join(filename);
 
         // Use our new attestation verification library
-        let token = env::var("GITHUB_TOKEN")
-            .ok()
-            .or_else(|| env::var("GH_TOKEN").ok());
+        let token = env::GITHUB_TOKEN.as_ref().cloned();
 
         // Get expected workflow from registry
         let signer_workflow = pkg