The previous commit added a 2-line comment above the
golangci-lint cache-dir step in ci.yaml, shifting the
`actions/cache` line from 188 to 190 and invalidating the
line-anchored zizmor suppression.

Change-Id: Id41fa6a2c4f9939eb7b594b5b4f75ffbbe08feaa
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

Aggregated fixes from a code review of the dogfood mise migration:

- Restore `gh` to apt-installed /usr/bin/gh (and remove from mise.toml)
  so the `files/usr/local/bin/gh` wrapper continues to bridge
  `coder external-auth` into gh authentication. Mise's shim at
  ${MISE_DATA_DIR}/shims would otherwise win PATH precedence and
  bypass the wrapper.
- Replace the line-anchored zizmor `cache-poisoning` suppression
  in `.github/zizmor.yml` with an inline `# zizmor: ignore` comment
  on the offending step in `ci.yaml`, so the suppression survives
  future line shifts.
- Fix the stale `GOLANGCI_LINT_VERSION=` grep in `Makefile:748`'s
  `lint/go` target; matches the same `mise.toml` read used in
  `.github/workflows/ci.yaml`.
- Replace literal `/opt/mise/data` / `/home/coder:/etc/mise`
  occurrences in the dogfood Dockerfiles with the existing
  `$MISE_DATA_DIR` and `$MISE_TRUSTED_CONFIG_PATHS` ENV references.
- Drop the pointless `bash -c 'set -euo pipefail; …'` wrapper that
  was only protecting a single `mise install` invocation.
- Trim a narrative comment in `mise.toml` and replace an emdash so
  `make lint/emdash` stays happy.

Change-Id: Id4358de0710390d39f0e6d8637ac175785435263
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

The inline `# zizmor: ignore[cache-poisoning]` was on the same line
as `- name:`, but zizmor anchors the cache-poisoning finding to the
`uses: actions/cache@…` line and ignores comments on the step name.
Move the comment to its own line directly above the `uses:` line,
matching the pattern already used in `.github/workflows/contrib.yaml`
for `dangerous-triggers`.

Change-Id: I7ca0b1023db2227fb2a8945d1f99614319f0c9be
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

…risk

The single `actions/cache` step ran on every trigger including
`pull_request`, so a PR could write content into the cache that
subsequent runs (on main or other PRs) would restore from. The
previous workaround was a zizmor `cache-poisoning` suppression on
that line.

Replace it with the standard restore/save split:

- `actions/cache/restore` runs unconditionally (PRs may read trusted
  caches saved by main).
- `actions/cache/save` only runs on `refs/heads/main` and only when
  there was no exact-key hit, so PRs cannot write to the cache.

This makes the suppression unnecessary; both have been removed.

Change-Id: I1698113632c267b13df1c36b98f75ef4404f3050
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

v4.15.1 transitively requires github.com/mitchellh/osext, whose
upstream GitHub repo has been deleted, so `mise install` fails to
resolve the module graph. v4.16.0+ drops the dep, and v4.19.0 matches
the version already pinned in go.mod.

Change-Id: I825e43bf2bc963333a23f28af5382ceb48e827f5
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

Change-Id: I37df49e9b1470ed592b4e4063b90b48626cf8dd6
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

Mount mise.lock alongside /etc/mise/config.toml so the dogfood image
build verifies download checksums during `mise install` (closes the
build-time integrity half of jdomeracki-coder's review).

Mechanics:

- COPY mise.toml /etc/mise/config.toml + COPY mise.lock
  /etc/mise/mise.lock. mise reads the lockfile via name-match next to
  the system config (verified empirically with a deliberately-bad
  checksum probe).
- Pre-create /etc/mise as 0755 before the COPYs. BuildKit's
  --chmod=0644 on a COPY whose destination dir does not exist
  apparently propagates the mode to the implicitly-created parent,
  leaving /etc/mise without the x bit and unreachable for the coder
  user (which silently produced "0 tools to install"). Use
  --chmod=0644 explicitly on the file COPYs so a future regen under
  a tight umask doesn't ship an unreadable lockfile.
- MISE_GLOBAL_CONFIG_FILE is NOT overridden — `mise use --global`
  must continue to write to ~/.config/mise/config.toml on the
  per-workspace home volume so user-installed tools persist.
- Pin helm to "v3.12.0" so the manifest version matches the
  upstream tarball naming (mise's aqua plugin still drops the `v`
  from URL templates, so the lockfile URL is patched by
  scripts/mise_lock.sh after each `mise lock`).

Adds scripts/mise_lock.sh to wrap `mise lock` with the helm URL
workaround so future regens don't reintroduce 404s.

Change-Id: I499605a1231901bc84ffe46532db57cf121f8512
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

aqua's helm plugin emits an URL without the `v` prefix (404).
github backend can't resolve a binary (helm only ships .asc files
on GitHub). ubi is deprecated in favor of github. http backend
with `mise.jdx.dev/dev-tools/backends/http.html` templating lets
us point at get.helm.sh directly with a single URL that handles
linux + macos via {{os()}}/{{arch()}} remapping.

Drops scripts/mise_lock.sh — no sed wrapper needed anymore since
the http backend doesn't have the URL-templating bug.

Trade-off: mise.lock doesn't auto-populate per-platform checksums
for http-backend tools (only the version pin is recorded). For
helm specifically, we accept "URL is pinned, checksum is not". The
other ~30 tools still get full URL+checksum verification.

Windows-x64 is omitted from the helm template because helm's
windows release uses .zip and would need a separate platform
override. The dogfood image is linux/amd64-only and nobody on the
team runs helm via mise on Windows.

Change-Id: I2020d8d23b5cad70777dcb7597ea13d0f4357640
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>

`make lint/emdash` rejected four emdash characters I introduced in
mise-related comments on ubuntu-22.04 and ubuntu-26.04 Dockerfiles
during this PR. Replace with semicolons per the lint rule's example.

Change-Id: I93c36ee572db212a9e8956288f2c374d0a905f32
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Kosiewski <tk@coder.com>