[jdx]

https://entire.io/gh/jdx/mise/trails/663

A machine that installed aube 2.2–2.5 could not upgrade it. aube moved its signing workflow from release-plz.yml to release.yml at 2.6.0. mise's signer pin remembered the first one, so mise upgrade and latest resolution refused every newer release. This happened even though the registry entry's workflow list (#14092) names both workflows:

$ mise upgrade
mise WARN  Error getting latest version for aube: packslip:github.com/aubepkg/aube: this release is signed by https://github.com/aubepkg/aube/.github/workflows/release.yml (sigstore-oidc), but https://github.com/aubepkg/aube/.github/workflows/release-plz.yml (sigstore-oidc) signed what mise accepted before.
mise All tools are up to date

A workflow list is the explicit trust decision the signer pin waits for. The pin now accepts a release when both the pinned signer and the release's signer are among the listed workflows, and records the new one. The same machine now upgrades without mise packslip forget:

$ mise upgrade
Upgraded 1 tool:
  aube 2.5.1 → 2.7.0

This applies to a list in the user's own tool options as well as a registry default:

[tools]
"packslip:github.com/example/tool" = { version = "latest", workflow = ["release-plz.yml", "release.yml"] }

A single workflow, or a list that doesn't name the pinned signer, still refuses a new signer as before.

Reported in discussion #13948.

Validation

• New unit test in packslip_pins.rs: the move is refused without the list, accepted and recorded with it, and still refused when only one side is listed.
• Ran a debug build against isolated state: installed aube 2.5.1, which pinned release-plz.yml. Then mise upgrade installed 2.7.0 and moved the pin to release.yml, and reinstalling 2.5.1 moved it back. With workflow = "release.yml@refs/heads/main" alone, 2.7.0 is still refused against the old pin.
• cargo clippy --workspace --all-features --all-targets -- -D warnings is clean, and the packslip unit tests pass.

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5-5; version: 2.1.295.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes packslip trust and pin persistence logic; scope is limited to workflow-list continuity with existing refusal paths for unrelated signers.

Overview
Fixes upgrades that failed when a vendor moved its signing workflow (e.g. release-plz.yml → release.yml) even though the tool’s workflow list already trusted both paths.

Signer pin continuity now treats a multi-workflow workflow option as an explicit trust decision: if both the stored pin and the release’s signer appear in that list, the release is accepted and the pin is updated to the current workflow—no mise packslip forget. A single workflow or a list that omits the pinned signer still blocks a new signer.

Implementation adds listed on Observed, derives it from Pin::listed_signers() in the packslip backend, and adjusts record so the remembered signer follows accepted workflow moves (not only forge renames). Docs note the link between workflow lists and pinned signers; a unit test covers refuse/accept/partial-list cases.

^{Reviewed by Cursor Bugbot for commit a80a5f4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• New Features
  • Packslip can now accept signer transitions between workflows listed in the project’s workflow option, without requiring you to reset the signer pin.
• Documentation
  • Clarified that changes to a workflow path or signing key still require an explicit trust decision.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: ac44459c-3c23-4365-8b69-1d135cb90ced

---

📥 Commits

Reviewing files that changed from the base of the PR and between 6189cf9 and a80a5f4.

---

📒 Files selected for processing (1)

• crates/mise-util/src/packslip_pins.rs

---

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4affe016-146b-4cd1-a6a6-016d01d6e947

---

📥 Commits

Reviewing files that changed from the base of the PR and between 76c6466 and 6189cf9.

---

📒 Files selected for processing (5)

• crates/mise-util/src/packslip_pins.rs
• docs/dev-tools/backends/packslip.md
• docs/dev-tools/packslip-verification.md
• src/backend/packslip.rs
• src/packslip_forge.rs

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

---

📝 Walkthrough

Walkthrough

Packslip pin checks now accept signer transitions between workflows named in the workflow list. The listed signers pass through release verification and installation, and recording stores the observed signer after an accepted release.

Changes

Signer workflow continuity

Layer / File(s)	Summary
Pass listed signers through pin operations crates/mise-util/src/packslip_pins.rs, src/backend/packslip.rs	The observed-pin data and pending-pin state now carry listed workflow signers through release verification and installation.
Match and record workflow signer transitions crates/mise-util/src/packslip_pins.rs, src/packslip_forge.rs, docs/dev-tools/backends/packslip.md, docs/dev-tools/packslip-verification.md	Pin checks accept a signer transition when both signers are listed. Recording stores the observed signer. Tests and documentation cover the transition and the empty-list default.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant WorkflowOptions
  participant PinCheck
  participant PendingPin
  participant PinRecord
  WorkflowOptions->>PinCheck: provide listed workflow signers with observed signer
  PinCheck->>PinCheck: check pinned signer, listed transition, or forge continuation
  PinCheck-->>PendingPin: retain listed signers after accepted installation
  PendingPin->>PinRecord: record observed signer and listed signers

Loading

---

Merge Risk: ⚪ Minimal · up to 6189c

Listed workflows can carry the machine signer pin across a workflow move without silently changing an existing lockfile signer commitment. No issue identified here needs to block merging.

Pre-merge checks · 4 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 71.43% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 3 files. (2 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: preserving signer pins across workflow transitions when a workflow list authorizes the move.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 71.43% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 3 files. (2 skipped: 2 unsupported.)

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge.

Summary

The PR lets Packslip move a signer pin between workflows when both are named in the configured workflow list.

• Workflow lists let signer pins move between listed workflows.

_{Reviews (2) · Last reviewed commit: "test(packslip): refuse a move when only ..." · Reviewed by Greptile}

[github-actions]

Instruction counts

Nothing was compared, and so nothing was gated. No series appears on both sides: either the base has no measurements recorded, or the two were measured on different runner classes, which are deliberately not comparable — counts shift between machine types by more than a real regression does.

New, nothing to compare against: env on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, hook-env on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, ls on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, registry on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, startup on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{a80a5f443c95 vs 1cfa50cf9822 · measured on the runner, not pushed to the history.}