[posquit0]

👋 Background

GitHub Releases HTTP 504 responses exhausted mise-action v4's short, fixed download retries before Gitleaks could run. The common setup action also needs a bounded cache retry policy and periodic cache refresh.

🔗 Related Issues

• Port of merged https://github.com/datarize-infra/github-actions/pull/29

• Failing Helm charts job

• mise-action v5.2.7 release

⚙️ Description

Upgrade the single setup step to jdx/mise-action@v5.2.7 and configure:

Setting	Value	Behavior
mise_minimum_release_age	Wrapper input, explicit default 72h	Only select releases at least 72 hours old when mise_version is empty.
cache_max_age_days	14	Rotate the default cache key on 14-day calendar periods. Pinned tool versions remain pinned.
cache_restore_retry_budget	60s	Allow up to 60 seconds of cumulative retry waits per throttled cache-restore operation.
cache_save_retry_budget	120s	Allow up to 120 seconds of cumulative retry waits per throttled cache-save operation.
fetch_from_github	Existing wrapper input, explicit default true	Prefer GitHub; use the upstream CDN fallback only when eligible.
persist_github_token	true	Preserve token availability for later steps.
monorepo	false	Preserve the existing install scope.

The wrapper input mise_minimum_release_age is forwarded to upstream minimum_release_age.

Download retries use the upstream exponential backoff with jitter: five waits of 1–2s, 2–4s, 4–8s, 8–16s and 15–30s, retrying transport errors and HTTP 408/429/5xx. There are no wrapper retries or duplicated setup steps.

Cache retries apply only to HTTP 429, honor Retry-After plus jitter, and stop when the next wait would exceed the budget. Cache misses and save-reservation conflicts are not retried. The budgets cover retry waits, not total network-operation time. Custom cache_key values must include {{cache_period}} or {{default}} to retain periodic rotation.

Download fallback is available for future callers, but is not active by default. The mise CLI stays pinned to v2026.10.8. In v5.2.7, fallback requires both the version and release age to be empty; even mise_minimum_release_age: 0s is treated as an age-filtered install. A caller can explicitly opt into latest-only GitHub → CDN fallback with:

- uses: tedilabs/github-actions/.github/actions/mise.setup-tools@main
  with:
    mise_version: ""
    mise_minimum_release_age: ""
    fetch_from_github: "true"

Setting fetch_from_github: "false" reverses source preference when eligible. Pinned or age-filtered installs always use GitHub. Signed verification still applies; this is not independence from all GitHub endpoints.

🚨 To Reviewers

• Validation: yamllint, action metadata schema validation and git diff --check passed.
• The resulting action file matches the merged source PR byte-for-byte. Upstream download/cache retry tests were verified during the source PR work; actual hosted-runner cache throttling or failover has not been induced.
• v5 also changes config hashing and binary verification. An initial cache miss after upgrading is expected; this PR intentionally enables subsequent 14-day cache rotation.
• Repository CI references the shared setup action at @main, so its bootstrap does not execute this branch's new action version before merge.

[github-actions]

GitHub Actions Integration

Repository	jactionlint	check-jsonschema (workflows)	check-jsonschema (actions)
tedilabs/github-actions	✅	✅	✅

✅ All 1 passed.