build: migrate developer tasks to mise

[binaryaaron]

Why

Developer commands and CI duplicated task definitions across the Makefile and workflow files, which allowed local and CI behavior to drift. Mise provides one versioned task graph and pins the tools that execute it.

No linked issue required: maintainer-owned developer infrastructure migration.

Summary

• migrate developer tasks and CI invocation to Mise
• adopt the shared colon-delimited task vocabulary; public task names contain no hyphens or aliases
• compose prerequisites and ordered stages with native Mise task references
• preserve blocking ty 0.0.69 and DataDesigner 0.9 compatibility from current main
• require Mise 2026.7.6 or newer; pin uv 0.12.3 and Ruff 0.16.2
• add setup all for every locked dependency group and test:all for unit plus opt-in E2E suites
• keep benchmark and release workflow orchestration on the current revision while checking arbitrary historical targets into isolated directories
• install each isolated benchmark target's locked development group before running measurement tooling
• run wheel builds and documentation builds and deploys through repository-owned Mise tasks
• harden Mise installation with the fingerprint-pinned, versioned signed installer and a file-backed unsigned fallback download

Command tree

Intent	Command
Onboarding	mise run setup [runtime|dev|docs|notebooks|all]
Dependency sync	mise run deps:sync [runtime|dev|docs|notebooks|all]
Repository hooks	mise run hooks:install
Static checks	mise run check and mise run check:*
Default local gate	mise run check ::: test
Tests	mise run test, mise run test:all, mise run test:coverage, mise run test:e2e
Documentation	mise run docs:build, mise run docs:serve, mise run docs:deploy VERSION
Notebooks	mise run notebooks:execute
Build	mise run build:wheel
Lock update	mise run lock:update

Task names follow <domain>[:<action>[:<qualifier>...]]. Arguments select profiles or values. Commands containing check preserve tracked files. Mutating tasks state their outputs in mise tasks.

The default local gate stays explicit because it runs only static checks and unit tests; affected specialized suites remain separate. No validate task or removed Make compatibility alias is restored.

Task and environment boundaries

• Mise owns pinned tools, environment variables, virtual-environment activation, and task composition.
• uv owns Python dependency resolution and the contents of the project environment.
• uv run --locked --group <profile> makes leaf tasks independently runnable and synchronizes the requested locked profile.
• deps:sync remains the explicit command for preparing a profile without running another task.
• setup remains the shared local and CI entry point. CI uses --no-hooks to skip repository hook installation.
• Historical benchmark and release refs supply the target source only. Workflow YAML, local actions, and Mise tasks always come from the PR revision.

Base and compatibility

• rebased onto main at 46bcd1e
• preserve data-designer>=0.9,<0.10 and ty 0.0.69 from main; no dependency downgrades were introduced while regenerating uv.lock
• retain only make help, make install-mise, and make setup
• use make setup as the bootstrap path for machines without Mise
• keep Ruff and ty versions aligned between Mise and the uv development environment
• reject unknown dependency profiles through Mise usage validation
• preserve the Python version requested by each CI matrix job

Migration audits

• Ruff 0.16: enable E9, RUF100, UP015, UP017, UP035, and UP037; apply safe fixes; format and lint tracked Python files and rendered notebooks. The incidental library and tooling formatting edits are mechanical Ruff migrations with no intended behavior change.
• uv 0.12: use locked synchronization for every dependency profile and locked project execution where applicable.
• ty 0.0.69: preserve the blocking repository check and verify that the configured docs path discovers all rendered notebooks.
• pre-commit: run the blocking aggregate check, including read-only lock verification; lock regeneration remains the explicit lock:update operation.
• Make: confirm no repository automation or documentation depends on the removed forwarding aliases.

Security

GitHub Actions disables the unsigned fallback. When Mise must be installed, the pinned GPG-verified installer is required and setup fails if verification cannot complete. The installer fetches the pinned release key through HTTPS, verifies its fingerprint, downloads the signed installer from the exact pinned Mise release, and avoids dirmngr keyserver hangs. Local installation retains its documented unsigned fallback for slim development environments, but downloads the script completely to a temporary file before execution so curl retries cannot concatenate partial responses.

The PyPI task validates credentials before building, requires an explicit version, keeps credentials out of process arguments, and supports an upload-free --dry-run.

Validation

• mise tasks validate: all 26 tasks passed
• mise run deps:sync all: every locked dependency group synchronized successfully
• mise run --dry-run test:all: resolved to the unit suite followed by the opt-in E2E suite
• mise run check ::: test: 1,213 tests passed; Ruff, ty, lock, formatting, SPDX, and benchmark shell checks passed
• mise run docs:build: strict documentation build passed
• mise run test -- tests/tools/test_mise_configuration.py -q: 22 focused workflow and tooling tests passed
• current build:wheel and docs:build tasks built the wheel and strict docs from a separate checkout of historical tag v0.1.0
• benchmark shell regression coverage passed on Bash 5.2 and Bash 3.2.57
• bash -n tools/install-mise.sh: signed-installer script syntax passed

[greptile-apps]

Greptile Summary

The PR replaces duplicated Make and CI developer commands with a pinned Mise task graph while preserving isolated historical benchmark execution.

• Checks out the workflow revision before loading the repository-owned setup action.
• Checks arbitrary benchmark refs into benchmark-target so they cannot replace workflow-owned automation.
• Runs benchmark tooling from the target with its locked development dependency group.
• Routes setup, checks, tests, documentation, notebook, build, and release operations through Mise.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/benchmark-ci.yml	The workflow now loads setup from the workflow revision, isolates the requested benchmark ref, and consistently roots benchmark execution and artifacts in that target directory.
.github/actions/setup-python-env/action.yml	The composite action supports pre-checked-out workspaces and installs the pinned Mise-managed toolchain and requested dependency profile.
.mise/tasks/setup.toml	Defines validated setup and locked dependency synchronization profiles used by local development and CI.
.mise/tasks/tests.toml	Defines unit, coverage, and opt-in end-to-end test composition through Mise.
.github/workflows/release.yml	Keeps release orchestration on the workflow revision while building and documenting the requested release ref in an isolated checkout.

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Actions
    participant Root as Workflow revision
    participant Setup as Local setup action
    participant Target as benchmark-target
    GH->>Root: Checkout workflow revision
    Root->>Setup: Load setup-python-env
    Setup->>Setup: Install Mise, uv, and Python
    GH->>Target: Checkout BENCHMARK_REF
    Target->>Target: uv run --locked --group dev
    Target-->>GH: Summary and benchmark artifacts

Loading

_{Reviews (10): Last reviewed commit: "fix(ci): install benchmark dependency gr..." | Re-trigger Greptile}

[andreatnvidia]

The Mise direction looks good. I found three blockers around historical releases, the signed bootstrap, and macOS benchmark execution. There’s also one non-blocking argument-forwarding bug in the same benchmark task.