Run project verification independently of deployment tooling

.github/dependency-policy.json

@@ -6,7 +6,12 @@
   "integration_job": "ci",
   "dispatch_workflow": "ci.yml",
   "max_group_size": 10,
-  "managed_dependencies": ["aviorstudio/gdam-actions/*", "nicodes/komizo-actions/*", "nicodes/komizo/*"],
+  "managed_dependencies": [
+    "aviorstudio/gdam-actions/*",
+    "nicodes/komizo-actions/*",
+    "nicodes/komizo/*",
+    "nicodes/tools/*"
+  ],
   "sensitive_dependencies": [
     "*clerk*",
     "*pocketbase*",

.github/readme-source.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "sha256": "c35a63a402592887a7ff1f8a18757a680c945ffa09432bc84555737455defb82",
+  "sha256": "295a1a40e9463136319dce8c110fba77f4a7b5d9f3723798132cef1bf9e54e8b",
   "history": {
     "forbidden_commits": ["ec050dfdfec522d814f1e1e8eb1c7aaf42e880be"]
   }

.github/workflows/ci.yml

@@ -28,19 +28,16 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
-    - name: Set up locked komizo
-      uses: nicodes/komizo/setup@2ca94e2fd4bb05f41bb228e9c366e5cc733c75e6
+    - name: Set up development tools
+      uses: nicodes/tools/setup@7dd151b7c2cac851d46591cad4a14d74d923dd77
       env:
         GH_TOKEN: ${{ github.token }}
       timeout-minutes: 5
     - name: Record tested integration identity
       if: github.event_name == 'pull_request'
       env:
         EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }}
-      run: |
-        komizo exec --tools python -- bash -euo pipefail <<'KOMIZO_COMMAND'
-        python3 "$CICD_ENGINEERING/helpers/integration-identity.py"
-        KOMIZO_COMMAND
+      run: python3 "$TOOLS_ROOT/helpers/integration-identity.py"
     - name: Upload artifacts
       if: github.event_name == 'pull_request'
       uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
@@ -51,6 +48,7 @@ jobs:
         retention-days: 7
         include-hidden-files: true
     - name: Check project
-      uses: nicodes/komizo/run@2ca94e2fd4bb05f41bb228e9c366e5cc733c75e6
-      with:
-        target: check
+      shell: bash
+      run: |-
+        set -euo pipefail
+        mise run check

.github/workflows/dependency-policy.yml

@@ -26,8 +26,8 @@ concurrency:
 jobs:
   auto-merge:
     name: Apply dependency policy
-    if: github.ref == 'refs/heads/main' && (github.event_name != 'pull_request_target' || (github.event.pull_request.user.login == 'dependabot[bot]'
-      && github.event.pull_request.draft == false))
+    if: github.ref == 'refs/heads/main' && (github.event_name != 'pull_request_target' || (github.event.pull_request.user.login
+      == 'dependabot[bot]' && github.event.pull_request.draft == false))
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
@@ -44,16 +44,14 @@ jobs:
         persist-credentials: false
         ref: main
       timeout-minutes: 3
-    - name: Set up locked komizo
-      uses: nicodes/komizo/setup@2ca94e2fd4bb05f41bb228e9c366e5cc733c75e6
-      env:
-        GH_TOKEN: ${{ github.token }}
-      timeout-minutes: 5
     - name: Reconcile verified dependency updates
-      run: komizo dependencies apply --output "$RUNNER_TEMP/dependency-report.json"
       env:
         GH_TOKEN: ${{ github.token }}
       timeout-minutes: 7
+      uses: nicodes/tools/dependencies@7dd151b7c2cac851d46591cad4a14d74d923dd77
+      with:
+        apply: 'true'
+        output: ${{ runner.temp }}/dependency-report.json
     - name: Upload artifacts
       if: always()
       uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9

.gitignore

@@ -25,7 +25,4 @@ pnpm-debug.log*
 
 # Generated CI evidence
 .artifacts/
-
-.komizo.mise*.toml
-
-.komizo.mise*.lock
+/.ci-tools/

README.md

@@ -1,16 +1,16 @@
-<!-- Generated from private documentation source. Do not edit directly. Source SHA256: 2600f8e036116e21dc20c098cb3e90094635918cf6d5efd66c6a61aa91c224e4 -->
+<!-- Generated from private documentation source. Do not edit directly. Source SHA256: 893baf3e3bf3a6e5f5e2963465ee2dcafc61a3d06aa04a1fe3cda439b4d7e0ee -->
 
 # aviorstudio-web
 
 Static website built with Astro.
 
-Install the [komizo release](https://github.com/nicodes/komizo#install) matching `komizo.lock`, then run:
+Install [mise](https://mise.jdx.dev/) and run `mise install`, then run:
 
 ```sh
-komizo dev                 # Foreground development server
-komizo check               # Complete applicable source, build and output checks
-komizo run build           # Generate dist/
-komizo describe            # Inspect tools and available commands
+mise run dev                 # Development server
+mise run check               # Complete applicable source, build and output checks
+mise run build           # Generate dist/
+mise tasks ls            # Inspect tools and available commands
 ```
 
 Ctrl-C stops development. This website needs no runtime credentials or credential `.env` file.

mise.toml

@@ -0,0 +1,31 @@
+[tools]
+"python" = "3.13.11"
+"bun" = "1.4.1"
+"node" = "24.18.1"
+
+[env]
+TOOLS_ROOT = "{{ get_env(name='TOOLS_ROOT', default=config_root ~ '/.ci-tools') }}"
+GOTOOLCHAIN = "local"
+PYTHONDONTWRITEBYTECODE = "1"
+
+[tasks."install"]
+run = ["bun install --frozen-lockfile"]
+
+[tasks."build"]
+run = ["bun run build"]
+
+[tasks."artifact-check"]
+run = ["python3 scripts/check-output.py"]
+depends = ["build"]
+
+[tasks."dev"]
+run = ["bun run dev"]
+
+[tasks."clean"]
+run = ["bun -e 'const fs=require('\"'\"'node:fs'\"'\"');for(const p of ['\"'\"'dist'\"'\"','\"'\"'.astro'\"'\"'])fs.rmSync(p,{recursive:true,force:true})'"]
+
+[tasks."lint"]
+run = ["bun x --no-install biome check", "bun run typecheck"]
+
+[tasks."check"]
+run = [{"task" = "install"}, {"task" = "lint"}, {"task" = "build"}, {"task" = "artifact-check"}]