Preset MISE_GITHUB_TOKEN in the mise-setup action

[gtbuchanan]

Workaround for a CI failure hit on #404: the Codecov Upload job died inside mise-setup, before reaching any repo code.

mise already installed (2026.8.2), but different version requested (2026.8.3)
[command] .../mise self-update 2026.8.3 -y
mise ERROR NetworkError: api request failed with status: 403
        - for: "https://api.github.com/repos/jdx/mise/releases/tags/v2026.8.3"

Cause

mise-action exports MISE_GITHUB_TOKEN only after it has already run mise self-update, and the exec inherits the environment without an override. So that one subprocess queries the GitHub releases API unauthenticated and 403s under rate limiting. Supplying the action's github_token input doesn't help — it already defaults to github.token; the problem is when the variable reaches the environment, not whether it's set. There's no ambient fallback either, since the action exports MISE_GITHUB_TOKEN rather than GITHUB_TOKEN.

Only self-update is affected — every later mise install is authenticated — and only when a restored cache holds a mise version other than the pinned one, which is why it presents as intermittent.

Change

Export the token from the step that already writes MISE_DATA_DIR and MISE_LOCKED to $GITHUB_ENV, so it's in place before mise-action runs. The action skips any variable already present in the environment, so presetting takes precedence.

It's the same ambient github.token the action would have exported anyway, just earlier — no new exposure. The value goes through an env: binding rather than inline interpolation, matching how DATA_DIR is handled.

Caveat

Not verified end to end. The failure path only triggers when the cache is a mise version behind the pin, and the cache is now warm at the pinned version — so CI here will very likely pass without ever entering the self-update path. The reasoning rests on reading the action source plus the failing log, not on observing a fixed run. It should stop the failure from recurring after the next mise bump.

Reported upstream as jdx/mise-action#292 (existing open issue covering the same 403; I added the cause analysis). The comment in the action carries the removal trigger.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ab6961d9-7d31-4777-81dc-20eb30061a40

📥 Commits

Reviewing files that changed from the base of the PR and between 6b1453b and c5ab25d.

📒 Files selected for processing (2)

• .changeset/olive-donkeys-repeat.md
• .github/actions/mise-setup/action.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• gtbuchanan/tooling (manual)

📜 Recent review details

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2026-06-17T04:54:26.509Z

Learnt from: gtbuchanan
Repo: gtbuchanan/tooling PR: 183
File: .changeset/mise-release-age-excludes.md:4-4
Timestamp: 2026-06-17T04:54:26.509Z
Learning: In the gtbuchanan/tooling repo, `.changeset/*.md` files should intentionally omit the Markdown H1 heading (MD041). Follow the changesets CLI convention: `frontmatter` followed by a blank line and then a plain summary text line. Do not prepend the summary with `# `, because the changesets CLI consumes that summary verbatim as the CHANGELOG entry; adding `# ` would introduce an unwanted stray H1 into the generated changelog. MD041 is not enforced by the repo’s `eslint-markdownlint` config for these files; any MD041 warnings for `.changeset/*.md` come from markdownlint-cli2 defaults rather than the repo’s own lint configuration.

Applied to files:

• .changeset/olive-donkeys-repeat.md

🪛 markdownlint-cli2 (0.23.2)

.changeset/olive-donkeys-repeat.md

[warning] 4-4: First line in a file should be a top-level heading

(MD041, first-line-heading, first-line-h1)

🔇 Additional comments (3)

.github/actions/mise-setup/action.yml (2)

16-25: 🩺 Stability & Availability

Exercise the stale-cache self-update path.

The supplied context says this path has not run. The pinned jdx/mise-action@v4.2.4 invokes setupMise before its later environment export, so a normal cache miss does not validate this workaround. (raw.githubusercontent.com)

Before merge, restore an older mise binary under ${{ runner.temp }}/.mise, run the composite action with version: 2026.8.3, and assert that mise self-update completes without the unauthenticated 403.

---

26-35: LGTM!

.changeset/olive-donkeys-repeat.md (1)

1-4: LGTM!

---

📝 Walkthrough

Walkthrough

The mise-setup action now exports github.token as MISE_GITHUB_TOKEN through GITHUB_ENV. A changeset documents this behavior.

Changes

mise GitHub token setup

Layer / File(s)	Summary
Export the GitHub token .github/actions/mise-setup/action.yml, .changeset/olive-donkeys-repeat.md	The setup action initializes GH_TOKEN from github.token and exports MISE_GITHUB_TOKEN. The changeset records the new preset.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to c5ab2

This localized CI change presets the existing GitHub token before mise initialization to prevent an unauthenticated self-update; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the CI failure, its cause, the token-export change, and the verification caveat.
Title check	✅ Passed	The title is concise, descriptive, under 50 characters, and accurately identifies the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}