[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
jdx/mise-action	action	patch	v5.2.2 → v5.2.3	v5.2.4

---

Release Notes

jdx/mise-action

v5.2.3: : Faster cache key computation in large workspaces

Compare Source

The cache key no longer comes from searching the whole workspace for mise config files. In repos that already contain node_modules or vendor/bundle, this removes a delay of several minutes in "Restoring mise cache".

Fixed

• "Restoring mise cache" no longer takes minutes after installing dependencies. To build the cache key, the action used to match about 25 **/… glob patterns. That meant it walked every subdirectory of the workspace, including node_modules and vendor/bundle, before checking the cache at all. When the action ran after a step like pnpm install or ruby/setup-ruby with bundler-cache: true, this could take 3–7 minutes. The action now looks for mise config files the same way mise does: only in the working directory and each parent directory up to the workspace root. It checks for mise.toml, .mise.toml, .config/mise/…, conf.d fragments, .tool-versions, and their local, env-specific and .lock variants. The step also logs Hashed mise config files in N.Ns. (#​703 by @​jdx and @​corsicanec82)
  • If you set a custom cache_key that doesn't use {{file_hash}} or {{default}}, the action no longer hashes config files at all.
  • Config files in subdirectories, such as monorepo sub-projects, no longer affect the cache key. mise only loads them with --monorepo.
  • Cache keys change, so the first run after you upgrade will miss the cache.

New Contributors

• @​corsicanec82 made their first contribution in 91e7f82 (#​703)

Full Changelog: jdx/mise-action@v5.2.2...v5.2.3

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SONARJAVA-7258

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Updating mise-action across CI workflows changes tool setup and cache-key discovery, which could cause cache misses or affect configured tool versions.

Updates the jdx/mise-action GitHub Action from v5.2.2 to v5.2.3, which computes cache keys by checking only the working directory and its parents for mise config files instead of globbing the whole workspace. No issues found.

Verification Rules 1/3 met PRs 1 inspected

Rules 2 failed 1 passed

❌ Approved GitHub Actions runners - Retired sonar-xs-public runner is used in build.yml (line 484) and PrepareNextIteration.yml (line 13); replace with sonar-xs (pre-existing, not changed by this PR).
❌ Repository license compliance - LICENSE.txt contains SONAR Source-Available License v1.0, but the central audit policy approves LGPL-3.0 for sonar-java (pre-existing, not introduced by this PR).
✅ Internal artifact registries

Functional validation No results

Broader impact PRs 1 inspected

Cross-PR 1 PR inspected 0 open impacts

PR 153: Update jdx/mise-action action to v5 Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[vdiez]

Auto-approved: Renovate dependency update.