security(ci): avoid exposing MISE_GH_TOKEN to test-tool scripts by jdx · Pull Request #9053 · jdx/mise

jdx · 2026-04-11T17:11:58Z

Summary

GITHUB_TOKEN was set at workflow level to MISE_GH_TOKEN, making it available to all tool install scripts run by mise test-tool
Moved MISE_GH_TOKEN to only the build job that needs it
test-tool job now only gets the pooled token from the token pool API

Test plan

Verify registry CI jobs still pass (checkout works without token for public repos)
Verify test-tool still gets pooled token for rate limits

🤖 Generated with Claude Code

Note

Low Risk
Low risk workflow scoping change, but could affect CI if any non-build steps implicitly relied on GITHUB_TOKEN being pre-set to MISE_GH_TOKEN.

Overview
Removes the workflow-level override of GITHUB_TOKEN (previously set to secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN) in registry.yml and scopes it to the build job only.

This reduces secret exposure to mise test-tool/tool install scripts while keeping the elevated token available where the build needs it.

^{Reviewed by Cursor Bugbot for commit 5d1e6e1. Bugbot is set up for automated code reviews on this repo. Configure here.}

GITHUB_TOKEN was set at workflow level to MISE_GH_TOKEN, making it available to all tool install scripts run by test-tool. Move it to only the build job that needs it, and ensure test-tool only gets the pooled token (or nothing). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

gemini-code-assist · 2026-04-11T17:12:07Z

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

greptile-apps · 2026-04-11T17:16:24Z

Greptile Summary

This PR tightens the scope of MISE_GH_TOKEN in the registry.yml workflow by removing it from the workflow-level environment (where it was accessible to every job, including test-tool) and moving it to only the build job env and the specific "Check grace period" step that genuinely need it. The test-tool job now exclusively uses a pooled token fetched from the internal token-pool API as its GITHUB_TOKEN inside Docker.

Confidence Score: 5/5

Safe to merge — clear security hardening with no functional regressions expected.

The change is a straightforward scope reduction: the org token is moved from workflow-level env (all jobs) to only the build job and one specific step that explicitly needs it. The test-tool job correctly substitutes the pooled token. The fetch-token action already calls ::add-mask:: before emitting the token, so log exposure is handled. No P0 or P1 findings.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/registry.yml	Moves MISE_GH_TOKEN from workflow-level env to build job only; test-tool job correctly uses the pooled token via fetch-token action instead.

Sequence Diagram

sequenceDiagram
    participant B as build job
    participant T as test-tool job
    participant P as Token Pool API
    participant D as Docker Container

    B->>B: Uses scoped org token for cargo build
    B->>B: Upload mise binary artifact

    T->>P: Fetch pooled token (api-secret)
    P-->>T: Returns pooled token
    T->>T: Mask token in logs
    T->>T: Store as POOL_TOKEN in env
    T->>D: Pass POOL_TOKEN as GITHUB_TOKEN
    D->>D: mise test-tool runs with rate-limit token

    Note over B: MISE_GH_TOKEN scoped to build job only
    Note over T: test-tool never sees MISE_GH_TOKEN

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into fix/test-tool-t..." | Re-trigger Greptile}

github-actions · 2026-04-11T17:33:53Z

Hyperfine Performance

`mise x -- echo`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.8 x -- echo`	22.1 ± 0.4	21.4	24.2	1.00
`mise x -- echo`	22.4 ± 0.4	21.5	24.1	1.02 ± 0.03

`mise env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.8 env`	21.8 ± 0.6	20.9	27.1	1.00
`mise env`	22.0 ± 0.5	21.2	25.4	1.01 ± 0.04

`mise hook-env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.8 hook-env`	22.3 ± 0.4	21.6	25.0	1.00
`mise hook-env`	22.7 ± 0.4	21.8	25.6	1.02 ± 0.03

`mise ls`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.4.8 ls`	19.6 ± 0.4	18.9	23.3	1.00
`mise ls`	20.0 ± 0.4	19.2	23.1	1.02 ± 0.03

`xtasks/test/perf`

Command	mise-2026.4.8	mise	Variance
install (cached)	147ms	147ms	+0%
ls (cached)	77ms	77ms	+0%
bin-paths (cached)	81ms	81ms	+0%
task-ls (cached)	814ms	795ms	+2%

@jdx

### 🐛 Bug Fixes - **(docs)** upgrade esbuild to 0.28.0 with es2022 build target by @jdx in [#9047](#9047) - **(env)** skip tools=true module hooks in dependency_env by @jdx in [#9011](#9011) - **(lockfile)** resolve SLSA provenance URLs deterministically for all platforms by @cameronbrill in [#8982](#8982) - **(registry)** test of docuum in registry by @jylenhof in [#8996](#8996) - **(release)** publish extracted mise.exe alongside Windows zip by @zeitlinger in [#8997](#8997) - **(schema)** add missing config fields by @risu729 in [#9044](#9044) - **(task)** support sandbox fields in task templates by @risu729 in [#9046](#9046) - **(tasks)** respect env precedence for task config by @risu729 in [#9039](#9039) - prevent implicit enabling of `self_update` when rustls features are enabled by @salim-b in [#9040](#9040) - allow installing bun and others when downloads folder is on a different mount by @bgeron in [#9032](#9032) ### 📚 Documentation - discourage direnv compatibility PRs and remove issue suggestions by @jdx in [ca78346](ca78346) - tighten direnv compatibility language by @jdx in [ab140c8](ab140c8) - add Tera tip for unsupported version files by @risu729 in [#9048](#9048) ### 📦️ Dependency Updates - update ghcr.io/jdx/mise:deb docker digest to 49fa8a4 by @renovate[bot] in [#8999](#8999) - update ghcr.io/jdx/mise:copr docker digest to 61ba7b6 by @renovate[bot] in [#8998](#8998) - update ghcr.io/jdx/mise:copr docker digest to fa351ff by @renovate[bot] in [#9002](#9002) - update ghcr.io/jdx/mise:alpine docker digest to f3bb475 by @renovate[bot] in [#9001](#9001) - update ghcr.io/jdx/mise:rpm docker digest to d45af2d by @renovate[bot] in [#9005](#9005) - update ghcr.io/jdx/mise:deb docker digest to d7463ac by @renovate[bot] in [#9004](#9004) - update jdx/mise-action digest to 5228313 by @renovate[bot] in [#9007](#9007) - update rust docker digest to e8e2bb5 by @renovate[bot] in [#9008](#9008) - update taiki-e/install-action digest to 97a5807 by @renovate[bot] in [#9010](#9010) - update autofix-ci/action action to v1.3.3 by @renovate[bot] in [#9015](#9015) - update ubuntu:24.04 docker digest to 84e77de by @renovate[bot] in [#9012](#9012) - update actions/checkout action to v4.3.1 by @renovate[bot] in [#9014](#9014) - update ubuntu:26.04 docker digest to cc925e5 by @renovate[bot] in [#9013](#9013) - update rust crate tokio to v1.51.1 by @renovate[bot] in [#9018](#9018) - update rust crate zip to v8.5.1 by @renovate[bot] in [#9019](#9019) - update rust crate ctor to 0.9 by @renovate[bot] in [#9024](#9024) - update ubuntu docker tag to resolute-20260404 by @renovate[bot] in [#9020](#9020) - update dependency vitepress-plugin-tabs to ^0.8.0 by @renovate[bot] in [#9023](#9023) - update rust crate indexmap to v2.14.0 by @renovate[bot] in [#9025](#9025) - update rust crate nix to 0.31 by @renovate[bot] in [#9030](#9030) - update taiki-e/install-action digest to 7a4939c by @renovate[bot] in [#9027](#9027) - update dependency esbuild to v0.28.0 by @renovate[bot] in [#9022](#9022) - update rust crate rand to 0.10 by @renovate[bot] in [#9031](#9031) - update rust crate digest to 0.11.0 by @renovate[bot] in [#9028](#9028) - update rust crate confique to 0.4 by @renovate[bot] in [#9026](#9026) - update rust crate rattler to 0.40 by @renovate[bot] in [#9034](#9034) - lock file maintenance by @renovate[bot] in [#8416](#8416) - disable renovate for aws-config/aws-sdk-* crates by @jdx in [#9052](#9052) - update swatinem/rust-cache digest to e18b497 by @renovate[bot] in [#9009](#9009) ### 📦 Registry - remove broken tool tests by @jdx in [#9017](#9017) - update granted aqua backend repo by @risu729 in [#9033](#9033) - fix atlas-community test expected output by @jdx in [#9054](#9054) ### Chore - use deprecated_at! macro for ubi backend deprecation by @jdx in [#9049](#9049) ### Security - **(ci)** run test-tool inside Docker container by @jdx in [#9055](#9055) - **(ci)** avoid exposing MISE_GH_TOKEN to test-tool scripts by @jdx in [#9053](#9053) ### New Contributors - @bgeron made their first contribution in [#9032](#9032) - @salim-b made their first contribution in [#9040](#9040) ## 📦 Aqua Registry Updates #### Updated Packages (2) - [`cloudnative-pg/cloudnative-pg/kubectl-cnpg`](https://github.com/cloudnative-pg/cloudnative-pg/kubectl-cnpg) - [`gleam-lang/gleam`](https://github.com/gleam-lang/gleam)

chore: simplify pool token step

4a7c623

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

jdx changed the title ~~security: avoid exposing MISE_GH_TOKEN to test-tool scripts~~ security(ci): avoid exposing MISE_GH_TOKEN to test-tool scripts Apr 11, 2026

Merge branch 'main' into fix/test-tool-token-exposure

5d1e6e1

jdx enabled auto-merge (squash) April 11, 2026 19:17

jdx merged commit 4569ad4 into main Apr 11, 2026
44 checks passed

jdx deleted the fix/test-tool-token-exposure branch April 11, 2026 19:31

mise-en-dev mentioned this pull request Apr 11, 2026

chore: release 2026.4.9 #9000

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

security(ci): avoid exposing MISE_GH_TOKEN to test-tool scripts#9053

security(ci): avoid exposing MISE_GH_TOKEN to test-tool scripts#9053
jdx merged 3 commits intomainfrom
fix/test-tool-token-exposure

jdx commented Apr 11, 2026 •

edited by cursor Bot

Loading

Uh oh!

gemini-code-assist Bot commented Apr 11, 2026

Uh oh!

greptile-apps Bot commented Apr 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 11, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jdx commented Apr 11, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

gemini-code-assist Bot commented Apr 11, 2026

Uh oh!

greptile-apps Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

github-actions Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hyperfine Performance

mise x -- echo

mise env

mise hook-env

mise ls

xtasks/test/perf

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented Apr 11, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented Apr 11, 2026 •

edited

Loading

github-actions Bot commented Apr 11, 2026 •

edited

Loading

`mise x -- echo`

`mise env`

`mise hook-env`

`mise ls`

`xtasks/test/perf`