[onedr0p]

Overview

Unblocks CI, which has been red on main since 2026-07-25T14:04.

mise 2026.7.13 added a supply-chain trust check that refuses the entire renovate
dependency tree during Setup Mise, before any workflow logic runs:

mise ERROR Failed to install npm:renovate@43.280.1: aube install failed: failed to resolve dependencies
  caused by: trust downgrade for @yarnpkg/libzip@3.2.2 (trustPolicy=no-downgrade):
  earlier published version 3.2.0 had provenance attestation but this version has no trust evidence

Why rolling renovate back does not fix it

@yarnpkg/libzip is not a direct dependency. It arrives via @yarnpkg/core, and
the requirement is a floor:

package	requires
@yarnpkg/core 4.7.0 / 4.8.0 / 4.9.0	@yarnpkg/libzip: ^3.2.2
renovate 43.270.0 … 43.280.5	@yarnpkg/core: 4.9.0 (exact)

^3.2.2 cannot resolve to 3.2.0 or 3.2.1, so no pin in that band avoids the
flagged version. Escaping it would mean going back past @yarnpkg/core 4.7.0 —
and Renovate would immediately propose bumping it again.

The fix

trust_policy_excludes is mise's own escape hatch, suggested verbatim in the
error. It is scoped to the single flagged package, so every other dependency in
the tree stays checked.

Renovate keeps bumping the pin despite the table form — its mise manager reads
.version out of an object (parseVersion, modules/manager/mise/extract.js),
and has a matching parseOptions for the extra key.

mise.lock gains the corresponding [tools."npm:renovate".options] entry.

Verification

Reproduced and fixed against mise 2026.7.13 specifically (the version CI uses;
local was 2026.7.11, which predates the check), with a cold MISE_DATA_DIR so
nothing was served from cache:

config	exit
"npm:renovate" = "43.280.1"	1 — the error above, byte-for-byte
+ trust_policy_excludes = ["@yarnpkg/libzip"]	0

mise run lint and renovate-config-validator --strict (19 files) both pass
locally.

Once this is green, this repo can take the Build Success required status check
alongside the rest of the org.

Requirements

• I have read and agree with the contributing guidelines
• AI usage disclosure: YES — the investigation, change and this description were written by an AI agent (Claude Code) under maintainer direction.

[greptile-apps]

Greptile Summary

Updates the mise Renovate tool configuration to bypass the trust downgrade check only for @yarnpkg/libzip.

• Converts the Renovate tool declaration to table form while retaining version 43.280.1.
• Records the matching trust_policy_excludes option in the generated mise lockfile.

Confidence Score: 4/5

The PR is safe to merge, with a non-blocking concern that the package-wide trust exception lacks a bounded removal mechanism.

The configuration and lockfile consistently apply the intended exception, while the exclusion remains active until manually removed after upstream restores attestation.

Files Needing Attention: .mise/config.toml

Security Review

The package-wide @yarnpkg/libzip trust-policy exception has no automated expiry or tracked removal mechanism, leaving the package exempt after the original provenance issue is resolved.

T-Rex Logs

What T-Rex did

• We reviewed the general contract validation proof and confirmed there is a reproducible harness named run-mise-trust-validation.sh that produced the validation log.
• We examined the mise-trust-validation.log to verify the invoked commands, the working directory, the mise version, isolated directory paths, verbose installation and validation output, and exit codes.
• We verified that run-mise-trust-validation.sh is the exact reproducible harness used to generate the log, enabling re-run for verification.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.mise/config.toml	Adds the package-specific trust-policy exclusion using mise's object-form tool declaration, but does not bound or track removal of the exception.
.mise/mise.lock	Records the corresponding string-serialized option for locked Renovate installations.

_{Reviews (1): Last reviewed commit: "fix(mise): allow the @yarnpkg/libzip tru..." | Re-trigger Greptile}

[greptile-apps]

Bound the trust-policy exception

This package-wide exclusion has no automated expiry or tracked removal mechanism, so it remains active after an attested release resolves the original downgrade and leaves future @yarnpkg/libzip releases outside the normal supply-chain check.