bump tool versions

.agents/setup

@@ -4,14 +4,25 @@ set -euo pipefail
 
 curl -fsSL https://mise.run/bash | sh
 
+if [[ -n "${USER_ENV_SETUP_REPO:-}" ]]; then
+    if ! (
+        user_env_dir="$(mktemp -d)"
+        trap 'rm -rf "$user_env_dir"' EXIT
+
+        git clone --depth 1 --quiet -- \
+            "$USER_ENV_SETUP_REPO" \
+            "$user_env_dir" &&
+            "$user_env_dir/setup.sh"
+    ); then
+        echo "warning: user environment could not be set up; continuing" >&2
+    fi
+fi
+
 "$HOME/.local/bin/mise" trust
 "$HOME/.local/bin/mise" install --locked \
-	actionlint \
-	go \
-	"go:golang.org/x/vuln/cmd/govulncheck" \
-	gofumpt \
-	golangci-lint \
-	"github:dhth/terminal-control" \
-	yamlfmt
-
-git config push.autoSetupRemote true
+    actionlint \
+    go \
+    gofumpt \
+    golangci-lint \
+    govulncheck \
+    yamlfmt

.github/workflows/main.yml

@@ -147,6 +147,6 @@ jobs:
       - name: Set up mise
         uses: jdx/mise-action@v4
         with:
-          install_args: go go:golang.org/x/vuln/cmd/govulncheck
+          install_args: go govulncheck
       - name: Vulnerability check
         run: mise run vulncheck

.github/workflows/pr.yml

@@ -145,6 +145,6 @@ jobs:
       - name: Set up mise
         uses: jdx/mise-action@v4
         with:
-          install_args: go go:golang.org/x/vuln/cmd/govulncheck
+          install_args: go govulncheck
       - name: Vulnerability check
         run: mise run vulncheck

.github/workflows/release.yml

@@ -5,21 +5,22 @@ on:
     tags:
       - 'v*'
 
-permissions:
-  id-token: write
-
 jobs:
   release:
+    permissions:
+      contents: write
+      id-token: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up mise
         uses: jdx/mise-action@v4
         with:
           install_args: go goreleaser cosign
       - name: Release binaries
         run: mise run release
         env:
-          GITHUB_TOKEN: ${{secrets.GH_PAT}}
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/vulncheck.yml

@@ -13,6 +13,6 @@ jobs:
       - name: Set up mise
         uses: jdx/mise-action@v4
         with:
-          install_args: go go:golang.org/x/vuln/cmd/govulncheck
+          install_args: go govulncheck
       - name: Vulnerability check
         run: mise run vulncheck

.goreleaser.yml

@@ -6,39 +6,27 @@ release:
 before:
   hooks:
     - go mod tidy
-    - go generate ./...
 
 builds:
   - env:
       - CGO_ENABLED=0
     goos:
       - linux
       - darwin
-      - windows
+    goarch:
+      - amd64
+      - arm64
 
 signs:
   - cmd: cosign
-    signature: "${artifact}.sig"
-    certificate: "${artifact}.pem"
+    signature: "${artifact}.sigstore.json"
     args:
       - "sign-blob"
-      - "--oidc-issuer=https://token.actions.githubusercontent.com"
-      - "--output-certificate=${certificate}"
-      - "--output-signature=${signature}"
+      - "--bundle=${signature}"
       - "${artifact}"
       - "--yes"
     artifacts: checksum
 
-brews:
-  - name: mult
-    repository:
-      owner: dhth
-      name: homebrew-tap
-    directory: Formula
-    license: MIT
-    homepage: "https://github.com/dhth/mult"
-    description: "Run a command multiple times and glance at the outputs"
-
 changelog:
   sort: asc
   filters:

mise.toml

@@ -2,20 +2,17 @@
 task.run_auto_install = false
 
 [tools]
-actionlint = "1.7.12"
-cosign = "2.5.0"
+actionlint = "latest"
+cosign = "3.1.3"
 go = "1.26.6"
-"go:golang.org/x/vuln/cmd/govulncheck" = "latest"
-gofumpt = "0.11.0"
-golangci-lint = "2.12.2"
-goreleaser = "2.14.1"
-"npm:@kitlangton/terminal-control-darwin-arm64" = { version = "0.6.0", os = ["macos/arm64"] }
-yamlfmt = "0.21.0"
-
-[tools."github:dhth/terminal-control"]
-version = "0.6.0-r1"
-version_prefix = "musl-v"
-os = ["linux/x64"]
+gofumpt = "latest"
+golangci-lint = "latest"
+goreleaser = "2.18.0"
+govulncheck = { version = "latest", depends = "go" }
+yamlfmt = "latest"
+
+[tool_alias]
+govulncheck = "go:golang.org/x/vuln/cmd/govulncheck"
 
 [tasks.all]
 alias = "a"