ci(deps): update actions

[renovate]

This PR contains the following updates:\n\n| Package | Type | Update | Change | Pending |\n|---|---|---|---|---|\n| jdx/mise-action | action | minor | v4.2.5 → v4.3.0 | |\n| linear/linear-release-action | action | minor | v0.16.0 → v0.17.1 | v0.17.2 |\n\n---\n\n### Release Notes\n\n

\n

jdx/mise-action (jdx/mise-action)

\n\n### v4.3.0: : Install age-filtered mise releases\n\nCompare Source\n\nA small release that adds an opt-in way to hold back from installing brand-new mise releases.\n\n##### Added\n\n##### minimum_release_age input (#​604 by @​jdx)\n\nWhen version is omitted, you can now set minimum_release_age to install the newest stable, non-draft mise release that is older than a given cutoff — a simple way to avoid picking up a mise release the moment it ships (closes #​603).\n\nyaml\n- uses: jdx/mise-action@v4\n with:\n minimum_release_age: 7d\n\n\nIt accepts relative durations (24h, 7d, 6mo, 1y) as well as absolute ISO dates and timestamps. Age-filtered versions are resolved from the GitHub Releases API (the CDN only serves the latest binary) and downloaded by their exact version. If mise is already present on disk, an age-filtered run updates it to the resolved version rather than keeping the existing binary. An explicit version always takes precedence over minimum_release_age, and invalid dates fail fast.\n\nFull Changelog: jdx/mise-action@v4.2.5...v4.3.0\n\n

\n\n

\n

linear/linear-release-action (linear/linear-release-action)

\n\n### v0.17.1\n\nCompare Source\n\n##### What's Changed\n\n- Document publish-time version assignment by @​RomainCscn in #​64\n- Release v0.17.1 by @​RomainCscn in #​66\n\nFull Changelog: linear/linear-release-action@v0.17.0...v0.17.1\n\n### v0.17.0\n\nCompare Source\n\n#### What's Changed\n\n- Release v0.17.0 by @​RomainCscn in #​63\n\nFull Changelog: linear/linear-release-action@v0.16.1...v0.17.0\n\n### v0.16.1\n\nCompare Source\n\n#### What's Changed\n\n- Verify downloaded CLI artifacts before execution by @​RomainCscn in #​60\n- Authenticate the CI install test's GitHub API calls by @​RomainCscn in #​62\n- Release v0.16.1 by @​RomainCscn in #​61\n\nFull Changelog: linear/linear-release-action@v0.16.0...v0.16.1\n\nNote: cli_version: latest now resolves the release through the GitHub API, which requires jq and a token. Both are present on GitHub-hosted runners; minimal self-hosted runners without jq will fail with a clear error.\n\n

\n\n---\n\n### Configuration\n\n📅 Schedule: (UTC)\n\n- Branch creation\n - At any time (no schedule defined)\n- Automerge\n - At any time (no schedule defined)\n\n🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.\n\n♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.\n\n👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.\n\n---\n\n - [ ] If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by Mend Renovate. View the repository job log.\n\n

---

Closes CLOUD-1235

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Free

Run ID: d9e37978-58ab-4502-a730-eb5a82f0fa83

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[linear-code]

CLOUD-999 ci(deps): update jdx/mise-action action to v4.2.5

Why

A bot proposed this change and no human refined it, which is exactly the
case CLOUD-693 exists for:
the row is derived from the pull request's own manifest diff so the merge
moves the board like any other landing. Nothing here was authored by an
agent, and nothing here is a judgement.

Pull request: #676 (renovate/actions, opened by renovate[bot]).

Manifests touched:

• .github/workflows/auto-bot-land.yml
• .github/workflows/auto-release-land.yml
• .github/workflows/branch-hygiene.yml
• .github/workflows/ci-drift.yml
• .github/workflows/ci.yml
• .github/workflows/commit-lint.yml
• .github/workflows/coverage.yml
• .github/workflows/fuzz.yml
• .github/workflows/hook-latency-drift.yml
• .github/workflows/land-divergence.yml
• .github/workflows/lock-currency.yml
• .github/workflows/nonverdict-rate.yml
• .github/workflows/perf.yml
• .github/workflows/release-artifacts.yml
• .github/workflows/release-assets.yml
• .github/workflows/release-plz.yml
• .github/workflows/rust.yml
• .github/workflows/scorecard.yml
• .github/workflows/timeout-drift.yml
• .github/workflows/zizmor-advisories.yml
• .github/workflows/zizmor.yml

Refinement — Ready

Refinement gate: Definition of Ready & Done. This body carries only specializations.

• Source of truth (§1). The manifest diff on #676. It is the one
  description of this change that cannot disagree with the change, which
  is why nothing here re-types the versions it carries.
• Computable predicate (§2). Every required check green on the head
  SHA, decided by mise run checks-green — the same predicate that
  gates every other landing, asked of the SHA that fast-forwards.
• Effect (§3). No command-surface change: a dependency or toolchain
  bump moves no verb, no flag and no effect row.
• Output & exit (§5). Unchanged — this row proposes no new output.
• Commit / bump (§6). ci → no bump.
• Test obligation (§7). The existing suite, unchanged and unskipped:
  a bump whose breakage this repo covers reds CI, and one it does not is
  a coverage gap to file rather than a reason to hold the bump.
• Blockers (§8). None.

Acceptance

• #676 lands on main by fast-forward with every required check green,
  through auto-bot-land.yml and with no human in the loop.
• This row moves to In Review by the merge, from the Closes key in the
  pull request body.

CLOUD-1235 ci(deps): update actions

Why

A bot proposed this change and no human refined it, which is exactly the
case CLOUD-693 exists for:
the row is derived from the pull request's own manifest diff so the merge
moves the board like any other landing. Nothing here was authored by an
agent, and nothing here is a judgement.

Pull request: button-inc/batten#676 (renovate/actions, opened by renovate[bot]).

Manifests touched:

• .github/workflows/auto-bot-land.yml
• .github/workflows/auto-release-land.yml
• .github/workflows/branch-hygiene.yml
• .github/workflows/ci-drift.yml
• .github/workflows/ci.yml
• .github/workflows/commit-lint.yml
• .github/workflows/coverage.yml
• .github/workflows/fuzz.yml
• .github/workflows/hook-latency-drift.yml
• .github/workflows/land-divergence.yml
• .github/workflows/linear-release-backfill.yml
• .github/workflows/lock-currency.yml
• .github/workflows/mutant.yml
• .github/workflows/nonverdict-rate.yml
• .github/workflows/perf.yml
• .github/workflows/release-artifacts.yml
• .github/workflows/release-assets.yml
• .github/workflows/release-plz.yml
• .github/workflows/rust.yml
• .github/workflows/scorecard.yml
• .github/workflows/timeout-drift.yml
• .github/workflows/zizmor-advisories.yml
• .github/workflows/zizmor.yml

Refinement — Ready

Refinement gate: Definition of Ready & Done. This body carries only specializations.

• Source of truth (§1). The manifest diff on button-inc/batten#676. It is the one
  description of this change that cannot disagree with the change, which
  is why nothing here re-types the versions it carries.
• Computable predicate (§2). Every required check green on the head
  SHA, decided by mise run checks-green — the same predicate that
  gates every other landing, asked of the SHA that fast-forwards.
• Effect (§3). No command-surface change: a dependency or toolchain
  bump moves no verb, no flag and no effect row.
• Output & exit (§5). Unchanged — this row proposes no new output.
• Commit / bump (§6). ci → no bump.
• Test obligation (§7). The existing suite, unchanged and unskipped:
  a bump whose breakage this repo covers reds CI, and one it does not is
  a coverage gap to file rather than a reason to hold the bump.
• Blockers (§8). None.

Acceptance

• button-inc/batten#676 lands on main by fast-forward with every required check green,
  through auto-bot-land.yml and with no human in the loop.
• This row moves to In Review by the merge, from the Closes key in the
  pull request body.

[wenzowski]

Frozen with renovate-frozen, so Renovate will stop rebasing this branch.

Why. This head has been red since it opened, and every main advance was
rebasing it into another full matrix that could never land — 372 workflow runs on
this branch in seven days.

Two checks were refusing it:

• commit-lint — claims no CLOUD-<n> issue. Fixed on main in fix(bot-lane): stop a structurally-red bot head from buying a matrix per main advance #771: a
  bot-authored bump touching only the manifests renovate.json5 can move is now
  keyless by construction, because the row is minted from the PR after the commit
  exists and no bump can carry the trailer.
• sbom-check — 34 × sbom-action-unmapped. Still open, and not something a bump
  can fix: mise-tasks/sbom-actions.tsv maps each pinned action's licence by repo
  and sha, so moving the pins orphans every row. Regenerating it is
  mise run sbom plus a commit, by a person. That is CLOUD-1213.

To resume: run mise run sbom, commit the regenerated table to main, then
remove the renovate-frozen label. The next rebase mints a fresh head, the lane
readies it once, and it lands if it is green.

Nothing here retries on its own, deliberately — waiting now costs no CI minutes.

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud