ci: lock communique, so a release stops needing a human

[jdx]

The last three releases each shipped broken and were repaired by hand. This stops that.

Locked via mise.lock rather than pinned in mise.toml.

What happens

communique rewrites the release body in enhance-release-notes. Version 1.2.3 cleared the draft's tag_name while doing it, so GitHub renamed the draft:

id=359891214  tag=untagged-249d854d4260ba5ec6ec  draft=true
name=v0.0.4: tak compare

The next job ran gh release upload v0.0.4 … and got release not found. Eight built binaries with nowhere to attach, on a version already published to crates.io — so github:jdx/tak@0.0.4 404s for everyone until someone notices.

release	outcome
v0.0.3	untagged draft → repaired by hand
v0.0.4	untagged draft → repaired by hand
v0.0.5	untagged draft → repaired by hand

The job is continue-on-error: true, so it reported success every time while breaking a downstream job — the failure always surfaced two jobs later, pointing at the upload.

Why latest did not save us

jdx/communique#241 fixed it in 1.2.4. latest still resolved to 1.2.3 on both subsequent releases:

• v0.0.4's run — 1.2.4 was 23.68 hours old against mise's 24-hour minimum_release_age. Missed by ~19 minutes.
• v0.0.5's run — past the age floor, but mise-action's cache held a version list from before 1.2.4 existed.

Why the lockfile rather than a version in mise.toml

mise.toml still says latest; mise.lock decides what that means. That buys three things a version string does not:

• Checksums and attestation provenance for all six platforms, verified on install.
• mise lock as the ordinary, reviewable way to move it — the same mechanism every other repo in the fleet already uses.
• MISE_LOCKED: "1" on the job, so a stale lockfile is a hard failure rather than a quiet re-resolve. Without it the pin could drift back and nobody would see.

A short comment in mise.toml says so, since latest otherwise reads as floating.

Verified

Locally MISE_LOCKED trips over unrelated tools in my own global config, so I tested with a clean HOME — which is what CI has:

MISE_LOCKED=1 mise install  →  communique@1.2.4 ✓ installed  (checksum verified)
mise ls --current           →  communique  1.2.4  mise.toml  latest

The lockfile resolves latest to 1.2.4 exactly as intended.

zizmor at --persona=pedantic reports the same 11 findings on this branch as on origin/main — none added.

Worth considering separately

continue-on-error: true on that job is why this was invisible three times. The intent — do not fail a release because notes generation hiccups — is right, but it also swallows "notes generation broke the release". Re-asserting the tag after the enhance step would make the workflow correct regardless of which communique version mise hands it. Not in this PR; say the word.

---

🤖 Generated with Claude Code

[coderabbitai]

📝 Walkthrough

Walkthrough

The mise configuration pins communique to version 1.2.4 and adds comments explaining why the floating latest version is avoided for release tagging.

Changes

Tooling version management

Layer / File(s)	Summary
Pin communique release mise.toml	The communique tool changes from latest to 1.2.4, with comments documenting the fixed-version choice.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

I’m a rabbit with a pinned little tool,
No more hopping where versions rule.
One point two four sits snug and neat,
Release tags now land on steady feet.
Carrot cheers for builds complete!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main change: pinning communique in CI to remove manual release fixes.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Pins communique 1.2.4 for release-note generation.

• Adds a generated mise lockfile containing platform-specific communique 1.2.4 artifacts and checksums.
• Enforces locked mise installation in the release-note enhancement job.
• Documents why communique must not float during releases.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/release-plz.yml	Enforces the committed mise lockfile when installing communique in the non-blocking release-note enhancement job.
mise.lock	Locks communique 1.2.4 with platform-specific release assets and checksums.
mise.toml	Documents that the existing latest constraint is deliberately resolved through mise.lock.

_{Reviews (2): Last reviewed commit: "ci: lock communique, so a release stops ..." | Re-trigger Greptile}