ci: refactor CI to use mise for shared tool setup (#25727)

.github/actions/go-cache/action.yml

@@ -0,0 +1,76 @@
+name: "Go cache"
+description: Restore and save Go build and module caches.
+inputs:
+  cache-path:
+    description: "Optional newline-delimited cache paths. Defaults to go env GOCACHE and GOMODCACHE."
+    required: false
+    default: ""
+  key-prefix:
+    description: "Prefix for the cache key."
+    required: false
+    default: "go"
+  download-modules:
+    description: "Whether to run go mod download after restoring cache."
+    required: false
+    default: "true"
+runs:
+  using: "composite"
+  steps:
+    - name: Compute Go cache key
+      id: go-cache
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        if [[ -n "${INPUT_CACHE_PATH}" ]]; then
+          paths="${INPUT_CACHE_PATH}"
+        else
+          paths="$(printf '%s\n%s' "$(go env GOCACHE)" "$(go env GOMODCACHE)")"
+        fi
+
+        go_version="$(go env GOVERSION)"
+        paths_hash="$(printf '%s\n' "${paths}" | git hash-object --stdin)"
+        hash="$(
+          {
+            printf '%s\n' "${go_version}"
+            for file in go.mod go.sum; do
+              if [[ -f "${file}" ]]; then
+                git hash-object "${file}"
+              fi
+            done
+          } | git hash-object --stdin
+        )"
+
+        {
+          echo "path<<EOF"
+          echo "${paths}"
+          echo "EOF"
+          echo "key=${INPUT_KEY_PREFIX}-${RUNNER_OS}-${RUNNER_ARCH}-${paths_hash}-${hash}"
+          echo "restore-key=${INPUT_KEY_PREFIX}-${RUNNER_OS}-${RUNNER_ARCH}-${paths_hash}-"
+        } >> "$GITHUB_OUTPUT"
+      env:
+        INPUT_CACHE_PATH: ${{ inputs.cache-path }}
+        INPUT_KEY_PREFIX: ${{ inputs.key-prefix }}
+
+    - name: Restore Go cache, save on main
+      if: ${{ github.ref == 'refs/heads/main' }}
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ${{ steps.go-cache.outputs.path }}
+        key: ${{ steps.go-cache.outputs.key }}
+        restore-keys: |
+          ${{ steps.go-cache.outputs.restore-key }}
+
+    - name: Restore Go cache read-only
+      if: ${{ github.ref != 'refs/heads/main' }}
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ${{ steps.go-cache.outputs.path }}
+        key: ${{ steps.go-cache.outputs.key }}
+        restore-keys: |
+          ${{ steps.go-cache.outputs.restore-key }}
+
+    - name: Download Go modules
+      if: ${{ inputs.download-modules == 'true' }}
+      shell: bash
+      run: ./.github/scripts/retry.sh -- go mod download -x

.github/actions/install-cosign/action.yaml

@@ -1,10 +0,0 @@
-name: "Install cosign"
-description: |
-  Cosign Github Action.
-runs:
-  using: "composite"
-  steps:
-    - name: Install cosign
-      uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
-      with:
-        cosign-release: "v2.4.3"

.github/actions/install-syft/action.yaml

@@ -1,10 +0,0 @@
-name: "Install syft"
-description: |
-  Downloads Syft to the Action tool cache and provides a reference.
-runs:
-  using: "composite"
-  steps:
-    - name: Install syft
-      uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
-      with:
-        syft-version: "v1.26.1"

.github/actions/pnpm-install/action.yml

@@ -0,0 +1,59 @@
+name: "pnpm install"
+description: Restore pnpm store cache and install root plus workspace dependencies.
+inputs:
+  directory:
+    description: "Workspace directory to install after the repository root."
+    required: false
+    default: "site"
+runs:
+  using: "composite"
+  steps:
+    - name: Compute pnpm cache key
+      id: pnpm-cache
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        store_path="$(pnpm store path --silent)"
+        hash="$(
+          for file in pnpm-lock.yaml "${INPUT_DIRECTORY}/pnpm-lock.yaml"; do
+            if [[ -f "${file}" ]]; then
+              git hash-object "${file}"
+            fi
+          done | git hash-object --stdin
+        )"
+
+        {
+          echo "store-path=${store_path}"
+          echo "key=pnpm-${RUNNER_OS}-${RUNNER_ARCH}-${INPUT_DIRECTORY}-${hash}"
+          echo "restore-key=pnpm-${RUNNER_OS}-${RUNNER_ARCH}-${INPUT_DIRECTORY}-"
+        } >> "$GITHUB_OUTPUT"
+      env:
+        INPUT_DIRECTORY: ${{ inputs.directory }}
+
+    - name: Restore and save pnpm cache
+      if: ${{ github.ref == 'refs/heads/main' }}
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ${{ steps.pnpm-cache.outputs.store-path }}
+        key: ${{ steps.pnpm-cache.outputs.key }}
+        restore-keys: |
+          ${{ steps.pnpm-cache.outputs.restore-key }}
+
+    - name: Restore pnpm cache
+      if: ${{ github.ref != 'refs/heads/main' }}
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ${{ steps.pnpm-cache.outputs.store-path }}
+        key: ${{ steps.pnpm-cache.outputs.key }}
+        restore-keys: |
+          ${{ steps.pnpm-cache.outputs.restore-key }}
+
+    - name: Install root node_modules
+      shell: bash
+      run: ./scripts/pnpm_install.sh
+
+    - name: Install node_modules
+      shell: bash
+      run: "${GITHUB_WORKSPACE}/scripts/pnpm_install.sh"
+      working-directory: ${{ github.workspace }}/${{ inputs.directory }}

.github/actions/setup-go-tools/action.yaml

@@ -1,12 +0,0 @@
-name: "Setup Go tools"
-description: |
-  Set up tools for `make gen`, `offlinedocs` and Schmoder CI.
-runs:
-  using: "composite"
-  steps:
-    - name: go install tools
-      shell: bash
-      run: |
-          ./.github/scripts/retry.sh -- go install tool
-          # NOTE: protoc-gen-go cannot be installed with `go get`
-          ./.github/scripts/retry.sh -- go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.30

.github/actions/setup-go/action.yaml

@@ -1,32 +0,0 @@
-name: "Setup Go"
-description: |
-  Sets up the Go environment for tests, builds, etc.
-inputs:
-  version:
-    description: "The Go version to use."
-    default: "1.26.2"
-  use-cache:
-    description: "Whether to use the cache."
-    default: "true"
-runs:
-  using: "composite"
-  steps:
-    - name: Setup Go
-      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
-      with:
-        go-version: ${{ inputs.version }}
-        cache: ${{ inputs.use-cache }}
-
-    - name: Install gotestsum
-      shell: bash
-      run: ./.github/scripts/retry.sh -- go install gotest.tools/gotestsum@0d9599e513d70e5792bb9334869f82f6e8b53d4d # main as of 2025-05-15
-
-    - name: Install mtimehash
-      shell: bash
-      run: ./.github/scripts/retry.sh -- go install github.com/slsyy/mtimehash/cmd/mtimehash@a6b5da4ed2c4a40e7b805534b004e9fde7b53ce0 # v1.0.0
-
-    # It isn't necessary that we ever do this, but it helps
-    # separate the "setup" from the "run" times.
-    - name: go mod download
-      shell: bash
-      run: ./.github/scripts/retry.sh -- go mod download -x

.github/actions/setup-mise/action.yml

@@ -0,0 +1,168 @@
+name: Setup mise
+description: Install mise tools from SHA256-pinned binaries, with CI-layer caching.
+inputs:
+  install-args:
+    description: Tool names or extra arguments passed to mise install. --locked is added by default.
+    required: false
+    default: ""
+  locked:
+    description: Whether to pass --locked to mise install.
+    required: false
+    default: "true"
+  cache-key-prefix:
+    description: Prefix for mise tool cache keys.
+    required: false
+    default: mise-ci-v1
+  mise-version:
+    description: mise version to install.
+    required: false
+    default: "2026.5.12"
+  mise-sha256:
+    description: SHA256 checksum for the mise binary.
+    required: false
+    default: ""
+  use-cache:
+    description: Whether to restore and save mise tool caches.
+    required: false
+    default: "true"
+runs:
+  using: composite
+  steps:
+    - name: Compute mise cache key
+      id: cache-key
+      shell: bash
+      env:
+        CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
+        INPUT_INSTALL_ARGS: ${{ inputs.install-args }}
+        INPUT_LOCKED: ${{ inputs.locked }}
+        MISE_VERSION: ${{ inputs.mise-version }}
+        RUNNER_ARCH: ${{ runner.arch }}
+        RUNNER_OS: ${{ runner.os }}
+      run: |
+        set -euo pipefail
+
+        case "${INPUT_LOCKED}" in
+          true)
+            if [[ -n "${INPUT_INSTALL_ARGS}" ]]; then
+              install_args="--locked ${INPUT_INSTALL_ARGS}"
+            else
+              install_args="--locked"
+            fi
+            ;;
+          false)
+            install_args="${INPUT_INSTALL_ARGS}"
+            ;;
+          *)
+            echo "::error::locked must be true or false."
+            exit 1
+            ;;
+        esac
+
+        install_args_hash="$(printf '%s' "$install_args" | git hash-object --stdin)"
+        files_hash="$(git hash-object mise.toml mise.lock | git hash-object --stdin)"
+        key="${CACHE_KEY_PREFIX}-${RUNNER_OS}-${RUNNER_ARCH}-${MISE_VERSION}-${install_args_hash}-${files_hash}"
+        restore_key="${CACHE_KEY_PREFIX}-${RUNNER_OS}-${RUNNER_ARCH}-${MISE_VERSION}-${install_args_hash}-"
+
+        {
+          echo "install-args<<EOF"
+          echo "${install_args}"
+          echo "EOF"
+          echo "key=$key"
+          echo "restore-key=$restore_key"
+        } >> "$GITHUB_OUTPUT"
+
+    - name: Select mise checksum
+      id: checksum
+      shell: bash
+      env:
+        CHECKSUMS_FILE: ${{ github.action_path }}/checksums.toml
+        INPUT_MISE_SHA256: ${{ inputs.mise-sha256 }}
+        MISE_CHECKSUM_SCRIPT: ${{ github.workspace }}/scripts/mise_checksum.sh
+        MISE_VERSION: ${{ inputs.mise-version }}
+        RUNNER_ARCH: ${{ runner.arch }}
+        RUNNER_OS: ${{ runner.os }}
+      run: |
+        set -euo pipefail
+
+        checksum="${INPUT_MISE_SHA256}"
+        if [[ -z "${checksum}" ]]; then
+          case "${RUNNER_OS}-${RUNNER_ARCH}" in
+            Linux-X64)
+              target="linux-x64"
+              ;;
+            Linux-ARM64)
+              target="linux-arm64"
+              ;;
+            macOS-X64)
+              target="macos-x64"
+              ;;
+            macOS-ARM64)
+              target="macos-arm64"
+              ;;
+            Windows-X64)
+              target="windows-x64"
+              ;;
+            *)
+              echo "::error::No mise checksum is pinned for ${RUNNER_OS}-${RUNNER_ARCH}."
+              exit 1
+              ;;
+          esac
+
+          checksum="$("${MISE_CHECKSUM_SCRIPT}" "${CHECKSUMS_FILE}" "${MISE_VERSION}" "${target}")"
+          if [[ -z "${checksum}" ]]; then
+            echo "::error::No mise checksum is pinned for mise ${MISE_VERSION} on ${target}."
+            exit 1
+          fi
+        fi
+
+        echo "sha256=${checksum}" >> "$GITHUB_OUTPUT"
+
+    - name: Configure mise data directory
+      id: mise-data-dir
+      shell: bash
+      env:
+        RUNNER_OS: ${{ runner.os }}
+      run: | # zizmor: ignore[github-env] MISE_DATA_DIR uses only runner-provided paths.
+        set -euo pipefail
+
+        if [[ "${RUNNER_OS}" == "Windows" ]]; then
+          data_dir="${LOCALAPPDATA:-${USERPROFILE}\\AppData\\Local}\\mise"
+        else
+          data_dir="${RUNNER_TEMP}/mise-data"
+        fi
+
+        {
+          printf 'path=%s\n' "${data_dir}"
+        } >> "$GITHUB_OUTPUT"
+        printf 'MISE_DATA_DIR=%s\n' "${data_dir}" >> "$GITHUB_ENV"
+
+    - name: Cache mise tools
+      if: ${{ inputs.use-cache == 'true' && github.ref == 'refs/heads/main' }}
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: |
+          ~/.cache/mise
+          ${{ steps.mise-data-dir.outputs.path }}
+        key: ${{ steps.cache-key.outputs.key }}
+        restore-keys: |
+          ${{ steps.cache-key.outputs.restore-key }}
+
+    - name: Restore mise tools
+      if: ${{ inputs.use-cache == 'true' && github.ref != 'refs/heads/main' }}
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: |
+          ~/.cache/mise
+          ${{ steps.mise-data-dir.outputs.path }}
+        key: ${{ steps.cache-key.outputs.key }}
+        restore-keys: |
+          ${{ steps.cache-key.outputs.restore-key }}
+
+    - name: Install mise tools
+      uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+      with:
+        version: ${{ inputs.mise-version }}
+        sha256: ${{ steps.checksum.outputs.sha256 }}
+        mise_dir: ${{ steps.mise-data-dir.outputs.path }}
+        install_args: ${{ steps.cache-key.outputs.install-args }}
+        cache: "false"

.github/actions/setup-mise/checksums.toml

@@ -0,0 +1,9 @@
+# SHA256 hashes of the extracted mise binary verified by jdx/mise-action.
+# Keys use the GitHub runner target for each release artifact.
+
+["2026.5.12"]
+linux-x64 = "a238972a3162d710b85b28c324372e96ca4e4b486c81fe78695000d9fbc77c48"
+linux-arm64 = "fd2d5227a8ad0b1e359c70527a8345a9ada72077f8dcbb559371653c3d95464f"
+macos-x64 = "de57e8dc82bbd880a69c9bc8aee06b9dcc578184b3e5cf86fcef80635d6a90b4"
+macos-arm64 = "e777070540ffe22cf8b2b9f88aed88b461d0887d940c4f1c1a97359463cde6e1"
+windows-x64 = "adf1b4c9f51e7d15cff723056fcd8fd51f40ebacadcca97fd5758c44d469d5ea"

.github/actions/setup-node/action.yaml

@@ -1,44 +0,0 @@
-name: "Setup Node"
-description: |
-  Sets up the node environment for tests, builds, etc.
-inputs:
-  directory:
-    description: |
-      The directory to run the setup in.
-    required: false
-    default: "site"
-runs:
-  using: "composite"
-  steps:
-    - name: Install pnpm
-      uses: pnpm/action-setup@739bfe42ca9233c5e6aca07c1a25a9d34aca49b0 # v6.0.7
-
-    - name: Setup Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-      with:
-        node-version: 22.19.0
-        # See https://github.com/actions/setup-node#caching-global-packages-data
-        cache: "pnpm"
-        cache-dependency-path: ${{ inputs.directory }}/pnpm-lock.yaml
-
-    - name: Verify Node
-      shell: bash
-      run: |
-        set -euo pipefail
-
-        expected="v22.19.0"
-        actual="$(node --version)"
-        if [[ "$actual" != "$expected" ]]; then
-          echo "::error::Expected Node.js $expected, but got $actual from $(command -v node)."
-          exit 1
-        fi
-        echo "Node.js $actual is active at $(command -v node)."
-
-    - name: Install root node_modules
-      shell: bash
-      run: ./scripts/pnpm_install.sh
-
-    - name: Install node_modules
-      shell: bash
-      run: ../scripts/pnpm_install.sh
-      working-directory: ${{ inputs.directory }}

.github/actions/setup-sqlc/action.yaml

@@ -1,17 +0,0 @@
-name: Setup sqlc
-description: |
-  Sets up the sqlc environment for tests, builds, etc.
-runs:
-  using: "composite"
-  steps:
-    - name: Setup sqlc
-      # uses: sqlc-dev/setup-sqlc@c0209b9199cd1cce6a14fc27cabcec491b651761 # v4.0.0
-      # with:
-      #   sqlc-version: "1.30.0"
-
-      # Switched to coder/sqlc fork to fix ambiguous column bug, see:
-      # - https://github.com/coder/sqlc/pull/1
-      # - https://github.com/sqlc-dev/sqlc/pull/4159
-      shell: bash
-      run: |
-        ./.github/scripts/retry.sh -- env CGO_ENABLED=1 go install github.com/coder/sqlc/cmd/sqlc@337309bfb9524f38466a5090e310040fc7af0203

.github/actions/setup-tf/action.yaml

@@ -1,11 +0,0 @@
-name: "Setup Terraform"
-description: |
-  Sets up Terraform for tests, builds, etc.
-runs:
-  using: "composite"
-  steps:
-    - name: Install Terraform
-      uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
-      with:
-        terraform_version: 1.15.5
-        terraform_wrapper: false

.github/workflows/ci.yaml

@@ -151,8 +151,13 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Setup Node
-        uses: ./.github/actions/setup-node
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "node pnpm"
+
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
 
       - name: Check docs
         run: pnpm check-docs
@@ -171,8 +176,10 @@ jobs:
   #         # See: https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#commits-made-by-this-action-do-not-trigger-new-workflow-runs
   #         token: ${{ secrets.CDRCI_GITHUB_TOKEN }}
 
-  #     - name: Setup Go
-  #       uses: ./.github/actions/setup-go
+  #     - name: Set up mise tools
+  #       uses: ./.github/actions/setup-mise
+  #       with:
+  #         install-args: "go"
 
   #     - name: Update Nix Flake SRI Hash
   #       run: ./scripts/update-flake.sh
@@ -208,18 +215,22 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Setup Node
-        uses: ./.github/actions/setup-node
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go node pnpm helm actionlint aqua:crate-ci/typos"
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
+
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
+
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:github.com/golangci/golangci-lint/cmd/golangci-lint go:github.com/coder/paralleltestctx/cmd/paralleltestctx
 
       - name: Get golangci-lint cache dir
         run: |
-          # mise.toml is the source of truth for tool versions baked into
-          # the dogfood image; pull the same version for the lint job.
-          linter_ver=$(grep -Eo '^golangci-lint = "[^"]+"' mise.toml | sed -E 's/.*"([^"]+)"/\1/')
-          ./.github/scripts/retry.sh -- go install "github.com/golangci/golangci-lint/cmd/golangci-lint@v$linter_ver"
           dir=$(golangci-lint cache status | awk '/Dir/ { print $2 }')
           echo "LINT_CACHE_DIR=$dir" >> "$GITHUB_ENV"
 
@@ -239,35 +250,13 @@ jobs:
 
       # Check for any typos
       - name: Check for typos
-        uses: crate-ci/typos@cf5f1c29a8ac336af8568821ec41919923b05a83 # v1.45.1
-        with:
-          config: .github/workflows/typos.toml
+        run: typos --config .github/workflows/typos.toml
 
       - name: Fix the typos
         if: ${{ failure() }}
         run: |
           echo "::notice:: you can automatically fix typos from your CLI:
-          cargo install typos-cli
-          typos -c .github/workflows/typos.toml -w"
-
-      # Needed for helm chart linting
-      - name: Install helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
-        with:
-          version: v3.9.2
-        continue-on-error: true
-        id: setup-helm
-
-      - name: Install helm (fallback)
-        if: steps.setup-helm.outcome == 'failure'
-        # Fallback to Buildkite's apt repository if get.helm.sh is down.
-        # See: https://github.com/coder/internal/issues/1109
-        run: |
-          set -euo pipefail
-          curl -fsSL https://packages.buildkite.com/helm-linux/helm-debian/gpgkey | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg > /dev/null
-          echo "deb [signed-by=/usr/share/keyrings/helm.gpg] https://packages.buildkite.com/helm-linux/helm-debian/any/ any main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list
-          sudo apt-get update
-          sudo apt-get install -y helm=3.9.2-1
+          mise exec aqua:crate-ci/typos -- typos -c .github/workflows/typos.toml -w"
 
       - name: Verify helm version
         run: helm version --short
@@ -287,15 +276,11 @@ jobs:
           key: ${{ steps.golangci-lint-cache.outputs.cache-primary-key }}
 
       - name: Check workflow files
-        run: |
-          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.7.4
-          ./actionlint -color -shellcheck= -ignore "set-output"
+        run: actionlint -color -shellcheck= -ignore "set-output"
         shell: bash
 
       - name: Check for unstaged files
-        run: |
-          rm -f ./actionlint ./typos
-          ./scripts/check_unstaged.sh
+        run: ./scripts/check_unstaged.sh
         shell: bash
 
   lint-actions:
@@ -303,7 +288,7 @@ jobs:
     # Only run this job if changes to CI workflow files are detected. This job
     # can flake as it reaches out to GitHub to check referenced actions.
     if: needs.changes.outputs.ci == 'true'
-    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
+    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-24.04-8' || 'ubuntu-24.04' }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
@@ -316,8 +301,10 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "actionlint zizmor"
 
       - name: make lint/actions
         run: make --output-sync=line -j lint/actions
@@ -341,30 +328,19 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Setup Node
-        uses: ./.github/actions/setup-node
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go node pnpm terraform protoc protoc-gen-go"
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
 
-      - name: Setup sqlc
-        uses: ./.github/actions/setup-sqlc
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
 
-      - name: Setup Terraform
-        uses: ./.github/actions/setup-tf
-
-      - name: go install tools
-        uses: ./.github/actions/setup-go-tools
-
-      - name: Install Protoc
-        run: |
-          mkdir -p /tmp/proto
-          pushd /tmp/proto
-          curl -L -o protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v23.4/protoc-23.4-linux-x86_64.zip
-          unzip protoc.zip
-          sudo cp -r ./bin/* /usr/local/bin
-          sudo cp -r ./include /usr/local/bin/include
-          popd
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:storj.io/drpc/cmd/protoc-gen-go-drpc go:github.com/coder/sqlc/cmd/sqlc
 
       - name: make gen
         timeout-minutes: 8
@@ -396,24 +372,26 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Setup Node
-        uses: ./.github/actions/setup-node
-
       - name: Check Go version
         run: IGNORE_NIX=true ./scripts/check_go_versions.sh
 
-      # Use default Go version
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go node pnpm terraform"
 
-      - name: Install shfmt
-        run: ./.github/scripts/retry.sh -- go install mvdan.cc/sh/v3/cmd/shfmt@v3.7.0
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
+
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
+
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:mvdan.cc/sh/v3/cmd/shfmt
 
       - name: make fmt
         timeout-minutes: 7
-        run: |
-          PATH="${PATH}:$(go env GOPATH)/bin" \
-            make --output-sync -j -B fmt
+        run: make --output-sync -j -B fmt
 
       - name: Check for unstaged files
         run: ./scripts/check_unstaged.sh
@@ -476,13 +454,18 @@ jobs:
       - name: Setup GNU tools (macOS)
         uses: ./.github/actions/setup-gnu-tools
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
         with:
-          use-cache: true
+          install-args: "go terraform"
 
-      - name: Setup Terraform
-        uses: ./.github/actions/setup-tf
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
+        with:
+          cache-path: ${{ steps.go-paths.outputs.cached-dirs }}
+
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:gotest.tools/gotestsum go:github.com/slsyy/mtimehash/cmd/mtimehash
 
       - name: Download Test Cache
         id: download-cache
@@ -651,11 +634,16 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go terraform"
 
-      - name: Setup Terraform
-        uses: ./.github/actions/setup-tf
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
+
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:gotest.tools/gotestsum
 
       - name: Download Test Cache
         id: download-cache
@@ -720,11 +708,16 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go terraform"
 
-      - name: Setup Terraform
-        uses: ./.github/actions/setup-tf
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
+
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:gotest.tools/gotestsum
 
       - name: Download Test Cache
         id: download-cache
@@ -799,8 +792,13 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go"
+
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
 
       # Used by some integration tests.
       - name: Install Nginx
@@ -826,8 +824,13 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Setup Node
-        uses: ./.github/actions/setup-node
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "node pnpm"
+
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
 
       - run: pnpm test:ci --max-workers "$(nproc)"
         working-directory: site
@@ -859,11 +862,16 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Setup Node
-        uses: ./.github/actions/setup-node
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go node pnpm"
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
+
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
 
       # Assume that the checked-in versions are up-to-date
       - run: make gen/mark-fresh
@@ -951,8 +959,13 @@ jobs:
           ref: ${{ github.event.pull_request.head.ref }}
           persist-credentials: false
 
-      - name: Setup Node
-        uses: ./.github/actions/setup-node
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "node pnpm"
+
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
 
       # This step is not meant for mainline because any detected changes to
       # storybook snapshots will require manual approval/review in order for
@@ -1030,29 +1043,21 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Node
-        uses: ./.github/actions/setup-node
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go node pnpm protoc protoc-gen-go"
+
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
         with:
           directory: offlinedocs
 
-      - name: Install Protoc
-        run: |
-          mkdir -p /tmp/proto
-          pushd /tmp/proto
-          curl -L -o protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v23.4/protoc-23.4-linux-x86_64.zip
-          unzip protoc.zip
-          sudo cp -r ./bin/* /usr/local/bin
-          sudo cp -r ./include /usr/local/bin/include
-          popd
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
-
-      - name: Install go tools
-        uses: ./.github/actions/setup-go-tools
-
-      - name: Setup sqlc
-        uses: ./.github/actions/setup-sqlc
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:storj.io/drpc/cmd/protoc-gen-go-drpc go:github.com/coder/sqlc/cmd/sqlc
 
       - name: Format
         run: |
@@ -1144,17 +1149,19 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Node
-        uses: ./.github/actions/setup-node
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go node pnpm"
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
 
-      - name: Install go-winres
-        run: ./.github/scripts/retry.sh -- go install github.com/tc-hib/go-winres@d743268d7ea168077ddd443c4240562d4f5e8c3e # v0.3.3
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
 
-      - name: Install nfpm
-        run: ./.github/scripts/retry.sh -- go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.35.1
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:github.com/tc-hib/go-winres go:github.com/goreleaser/nfpm/v2/cmd/nfpm
 
       - name: Install zstd
         run: sudo apt-get install -y zstd
@@ -1205,13 +1212,19 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Setup Node
-        uses: ./.github/actions/setup-node
-
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
         with:
-          use-cache: false
+          install-args: "go node pnpm cosign syft"
+
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
+
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
+
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:github.com/tc-hib/go-winres go:github.com/goreleaser/nfpm/v2/cmd/nfpm
 
       - name: Install rcodesign
         run: |
@@ -1241,21 +1254,9 @@ jobs:
           distribution: "zulu"
           java-version: "11.0"
 
-      - name: Install go-winres
-        run: ./.github/scripts/retry.sh -- go install github.com/tc-hib/go-winres@d743268d7ea168077ddd443c4240562d4f5e8c3e # v0.3.3
-
-      - name: Install nfpm
-        run: ./.github/scripts/retry.sh -- go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.35.1
-
       - name: Install zstd
         run: sudo apt-get install -y zstd
 
-      - name: Install cosign
-        uses: ./.github/actions/install-cosign
-
-      - name: Install syft
-        uses: ./.github/actions/install-syft
-
       - name: Setup Windows EV Signing Certificate
         run: |
           set -euo pipefail
@@ -1579,11 +1580,16 @@ jobs:
         with:
           fetch-depth: 1
           persist-credentials: false
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go"
 
-      - name: Setup sqlc
-        uses: ./.github/actions/setup-sqlc
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
+
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:github.com/coder/sqlc/cmd/sqlc
 
       - name: Setup and run sqlc vet
         run: |

.github/workflows/dogfood.yaml

@@ -71,9 +71,6 @@ jobs:
       packages: write # push the dogfood base image to ghcr.io/coder/oss-dogfood-base
     env:
       # MISE_EXPERIMENTAL opts into the experimental `oci` subcommand.
-      # Trust is set via a config file (see the Install mise step
-      # below) rather than MISE_TRUSTED_CONFIG_PATHS so the workspace
-      # template can keep parity with the same file-based approach.
       MISE_EXPERIMENTAL: "1"
     steps:
       - name: Harden Runner
@@ -135,32 +132,9 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
         if: matrix.image-version != 'nix'
 
-      - name: Install mise
-        if: matrix.image-version != 'nix'
-        # MISE_VERSION + MISE_SHA256 match dogfood/coder/ubuntu-*/Dockerfile.base
-        # so the mise binary baking the image is the same one a workspace
-        # ships with. `min_version` in mise.toml catches downgrades.
-        # Write trust config to ~/.config/mise/conf.d/ instead of using
-        # MISE_TRUSTED_CONFIG_PATHS so the same file-based approach
-        # works in workspaces (where the user owns the file).
-        env:
-          MISE_VERSION: v2026.5.12
-          MISE_SHA256: a238972a3162d710b85b28c324372e96ca4e4b486c81fe78695000d9fbc77c48
-          WORKSPACE: ${{ github.workspace }}
-        run: |
-          set -euo pipefail
-          curl --silent --show-error --location --fail \
-            "https://github.com/jdx/mise/releases/download/${MISE_VERSION}/mise-${MISE_VERSION}-linux-x64" \
-            --output /tmp/mise
-          echo "${MISE_SHA256}  /tmp/mise" | sha256sum -c
-          sudo install -m 0755 /tmp/mise /usr/local/bin/mise
-          rm /tmp/mise
-          mise --version
-          mkdir -p "$HOME/.config/mise/conf.d"
-          cat > "$HOME/.config/mise/conf.d/00-ci-trust.toml" <<EOF
-          [settings]
-          trusted_config_paths = ["$WORKSPACE"]
-          EOF
+      - name: Set up mise tools
+        if: matrix.image-version != 'nix' && !github.event.pull_request.head.repo.fork
+        uses: ./.github/actions/setup-mise
 
       - name: Compute image SHAs
         # Match the fork guard on the downstream consumers of these
@@ -216,25 +190,6 @@ jobs:
             ghcr.io/coder/oss-dogfood-base:${{ matrix.image-version }}-${{ steps.shas.outputs.base_sha }}
             ghcr.io/coder/oss-dogfood-base:${{ matrix.image-version }}-${{ steps.docker-tag-name.outputs.tag }}
 
-      - name: Install mise tools
-        if: matrix.image-version != 'nix' && !github.event.pull_request.head.repo.fork
-        # `mise oci build` packages already-installed tools into OCI
-        # layers; it does not install them. Run `mise install` first so
-        # the tools land in MISE_DATA_DIR on the runner.
-        # github_token raises aqua's API quota during tool installs.
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # --locked refuses to resolve URLs at install time and forces
-          # the runner to consume what mise.lock already committed,
-          # so a forgotten lockfile entry fails CI instead of silently
-          # being added on next run.
-          mise install --yes --locked
-          # Put mise's shims dir on PATH for subsequent steps so
-          # `mise oci push --tool crane` can find crane (and any other
-          # mise-managed binary it shells out to).
-          echo "$HOME/.local/share/mise/shims" >> "$GITHUB_PATH"
-
       - name: Build mise oci layer
         if: matrix.image-version != 'nix' && !github.event.pull_request.head.repo.fork
         env:
@@ -360,8 +315,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Setup Terraform
-        uses: ./.github/actions/setup-tf
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "terraform"
 
       - name: Authenticate to Google Cloud
         uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0

.github/workflows/flake-go.yaml

@@ -39,12 +39,16 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Set up Go
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go"
 
-      - name: Install whichtests
-        shell: bash
-        run: ./.github/scripts/retry.sh -- go install github.com/coder/whichtests@ec33bab1ec04cd86beb7a61a069db4463dba63f5
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
+
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:github.com/coder/whichtests
 
       - name: Select changed tests
         id: selector
@@ -57,9 +61,11 @@ jobs:
             --coalesce \
             --out-matrix "$RUNNER_TEMP/flake-matrix.json"
 
-      - name: Setup Terraform
+      - name: Set up Terraform
         if: ${{ fromJSON(steps.selector.outputs.matrix).include[0] != null }}
-        uses: ./.github/actions/setup-tf
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "terraform"
 
       - name: Run targeted Go flake checks
         id: flake_check

.github/workflows/nightly-gauntlet.yaml

@@ -62,11 +62,16 @@ jobs:
       - name: Setup GNU tools (macOS)
         uses: ./.github/actions/setup-gnu-tools
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go terraform"
 
-      - name: Setup Terraform
-        uses: ./.github/actions/setup-tf
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
+
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:gotest.tools/gotestsum
 
       - name: Setup Embedded Postgres Cache Paths
         id: embedded-pg-cache

.github/workflows/pr-deploy.yaml

@@ -238,14 +238,19 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Node
-        uses: ./.github/actions/setup-node
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go node pnpm"
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
 
-      - name: Setup sqlc
-        uses: ./.github/actions/setup-sqlc
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
+
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:github.com/coder/sqlc/cmd/sqlc
 
       - name: GHCR Login
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0

.github/workflows/release.yaml

@@ -172,13 +172,16 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
         with:
-          use-cache: false
+          install-args: "go node pnpm helm cosign syft"
 
-      - name: Setup Node
-        uses: ./.github/actions/setup-node
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
+
+      - name: Install Go mise tools
+        run: ./.github/scripts/retry.sh -- mise install --locked go:github.com/tc-hib/go-winres go:github.com/goreleaser/nfpm/v2/cmd/nfpm
 
       # Necessary for signing Windows binaries.
       - name: Setup Java
@@ -187,19 +190,9 @@ jobs:
           distribution: "zulu"
           java-version: "11.0"
 
-      - name: Install go-winres
-        run: ./.github/scripts/retry.sh -- go install github.com/tc-hib/go-winres@d743268d7ea168077ddd443c4240562d4f5e8c3e # v0.3.3
-
       - name: Install nsis and zstd
         run: sudo apt-get install -y nsis zstd
 
-      - name: Install nfpm
-        run: |
-          set -euo pipefail
-          wget -O /tmp/nfpm.deb https://github.com/goreleaser/nfpm/releases/download/v2.35.1/nfpm_2.35.1_amd64.deb
-          sudo dpkg -i /tmp/nfpm.deb
-          rm /tmp/nfpm.deb
-
       - name: Install rcodesign
         run: |
           set -euo pipefail
@@ -210,12 +203,6 @@ jobs:
             apple-codesign-0.22.0-x86_64-unknown-linux-musl/rcodesign
           rm /tmp/rcodesign.tar.gz
 
-      - name: Install cosign
-        uses: ./.github/actions/install-cosign
-
-      - name: Install syft
-        uses: ./.github/actions/install-syft
-
       - name: Setup Apple Developer certificate and API key
         run: |
           set -euo pipefail

.github/workflows/security.yaml

@@ -36,8 +36,13 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go"
+
+      - name: Restore Go cache
+        uses: ./.github/actions/go-cache
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v3.29.5

.github/workflows/weekly-docs.yaml

@@ -14,7 +14,54 @@ permissions:
   contents: read
 
 jobs:
+  prepare-linkspector-browser:
+    # later versions of Ubuntu have disabled unprivileged user namespaces, which are required by the action
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+    env:
+      CHROME_BUILD_ID: "145.0.7632.77"
+    outputs:
+      browser-cache-key: ${{ steps.browser-versions.outputs.cache-key }}
+      chrome-path: ${{ steps.install-chrome.outputs.path }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "node npm:@puppeteer/browsers"
+
+      - name: Get browser versions
+        id: browser-versions
+        run: |
+          set -euo pipefail
+          installer_version="$(mise current npm:@puppeteer/browsers)"
+          echo "cache-key=puppeteer-${RUNNER_OS}-${RUNNER_ARCH}-browsers-${installer_version}-chrome-${CHROME_BUILD_ID}" >> "$GITHUB_OUTPUT"
+
+      - name: Restore Puppeteer browser cache
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.cache/puppeteer
+          key: ${{ steps.browser-versions.outputs.cache-key }}
+
+      - name: Install Linkspector Chrome
+        id: install-chrome
+        run: |
+          set -euo pipefail
+          chrome_path="$(browsers install "chrome@${CHROME_BUILD_ID}" --path "${HOME}/.cache/puppeteer" --format '{{path}}')"
+          echo "path=${chrome_path}" >> "$GITHUB_OUTPUT"
+
   check-docs:
+    needs: prepare-linkspector-browser
     # later versions of Ubuntu have disabled unprivileged user namespaces, which are required by the action
     runs-on: ubuntu-22.04
     permissions:
@@ -54,15 +101,21 @@ jobs:
           corepack enable pnpm
           mkdir -p "$(pnpm store path --silent)"
 
+      - name: Restore Puppeteer browser cache
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.cache/puppeteer
+          key: ${{ needs.prepare-linkspector-browser.outputs.browser-cache-key }}
+
       - name: Check Markdown links
         uses: umbrelladocs/action-linkspector@036f295d12b67b0c4b445bc83db0538afb78db69 # v1.5.2
         id: markdown-link-check
         # checks all markdown files from /docs including all subfolders
         env:
-          # Use the runner-provided Chrome instead of letting linkspector's
-          # puppeteer download a specific version that may not match the
-          # runner's puppeteer cache. See: https://github.com/UmbrellaDocs/action-linkspector/issues/62
-          PUPPETEER_EXECUTABLE_PATH: /usr/bin/google-chrome
+          # Use the Chrome build prepared from mise-pinned Puppeteer instead
+          # of letting linkspector download a mutable browser at runtime.
+          # See: https://github.com/UmbrellaDocs/action-linkspector/issues/62
+          PUPPETEER_EXECUTABLE_PATH: ${{ needs.prepare-linkspector-browser.outputs.chrome-path }}
         with:
           reporter: github-pr-review
           config_file: ".github/.linkspector.yml"