feat: use-mise (#415)

.github/workflows/build.yml

@@ -10,8 +10,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  tofu_version: '1.10.2'
-  tg_version: '0.83.0'
+  MISE_TRUSTED_CONFIG_PATHS: ${{ github.workspace }}/.mise/config.toml
   ENVIRONMENT: ${{ github.ref == 'refs/heads/main' && 'prod' || 'dev' }}
 
 jobs:
@@ -29,10 +28,17 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@df46d635b905e618b88fc4c95baa920aeb30b309 # create-workflow-token-action-v3.0.1
         with:
-          node-version-file: './${{ matrix.name }}/.nvmrc'
+          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
+
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
+        with:
+          github_token: ${{ steps.token.outputs.token }}
 
       - name: Run npm install
         run: npm ci
@@ -83,16 +89,17 @@ jobs:
       - name: Install 1Password CLI
         uses: 1password/install-cli-action@1a3160d5e9de1ae0803eaa08a88746f5ae3daa50 # v4.1.0
 
-      - name: Install Terragrunt
-        uses: eLco/setup-terragrunt@d6093fd3d1e651013c072facb41d488602b85fbf # v1.0.4
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@df46d635b905e618b88fc4c95baa920aeb30b309 # create-workflow-token-action-v3.0.1
         with:
-          terragrunt_version: ${{ env.tg_version }}
+          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
-      - name: 'Install OpenTofu'
-        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
-          tofu_version: ${{ env.tofu_version }}
-          tofu_wrapper: false
+          github_token: ${{ steps.token.outputs.token }}
 
       - name: Deploy All
         working-directory: ${{ env.working_dir }}
@@ -111,14 +118,13 @@ jobs:
           echo "output=$(op run --no-masking --env-file='../../../.env' -- terragrunt output -json | jq -c .)" >> $GITHUB_OUTPUT
 
       - name: Publish Frontend to Cloudflare Pages
-        uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1.5.0
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN_PAGES_UPLOAD }}
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          projectName: ${{ fromJson(steps.deploy-frontend-output.outputs.output).pages_project_name.value }}
-          directory: 'dist/frontend'
-          branch: ${{ fromJson(steps.deploy-frontend-output.outputs.output).pages_branch.value }}
-          wranglerVersion: '3'
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN_PAGES_UPLOAD }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          BUILD_DIR: dist/frontend
+          PROJECT_NAME: ${{ fromJson(steps.deploy-frontend-output.outputs.output).pages_project_name.value }}
+          BRANCH_NAME: ${{ fromJson(steps.deploy-frontend-output.outputs.output).pages_branch.value }}
+        run: mise run deploy
 
       - name: Comment
         uses: immich-app/devtools/actions/sticky-comment@0135acd12ad9f3369b94a2aa3c0ae8c835a4e926 # sticky-comment-action-v1.0.0

.github/workflows/destroy.yml

@@ -4,8 +4,7 @@ on:
     types: [closed]
 
 env:
-  tofu_version: '1.10.2'
-  tg_version: '0.83.0'
+  MISE_TRUSTED_CONFIG_PATHS: ${{ github.workspace }}/.mise/config.toml
 
 jobs:
   deploy:
@@ -21,16 +20,17 @@ jobs:
       - name: Install 1Password CLI
         uses: 1password/install-cli-action@1a3160d5e9de1ae0803eaa08a88746f5ae3daa50 # v4.1.0
 
-      - name: Install Terragrunt
-        uses: eLco/setup-terragrunt@d6093fd3d1e651013c072facb41d488602b85fbf # v1.0.4
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@df46d635b905e618b88fc4c95baa920aeb30b309 # create-workflow-token-action-v3.0.1
         with:
-          terragrunt_version: ${{ env.tg_version }}
+          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
-      - name: 'Install OpenTofu'
-        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
-          tofu_version: ${{ env.tofu_version }}
-          tofu_wrapper: false
+          github_token: ${{ steps.token.outputs.token }}
 
       - name: Destroy All
         working-directory: ${{ env.working_dir }}

.github/workflows/test.yml

@@ -9,6 +9,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  MISE_TRUSTED_CONFIG_PATHS: ${{ github.workspace }}/.mise/config.toml
+
 jobs:
   test:
     name: Test
@@ -21,10 +24,17 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@df46d635b905e618b88fc4c95baa920aeb30b309 # create-workflow-token-action-v3.0.1
         with:
-          node-version-file: './frontend/.nvmrc'
+          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
+
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
+        with:
+          github_token: ${{ steps.token.outputs.token }}
 
       - name: Run npm install
         run: npm ci

.mise/config.toml

@@ -0,0 +1,46 @@
+[tools]
+opentofu = "1.10.2"
+terragrunt = "0.83.0"
+node = "24.21.0"
+wrangler = "4.131.0"
+
+[tasks.deploy]
+run = "wrangler pages deploy ${BUILD_DIR} --project-name=${PROJECT_NAME} --branch=${BRANCH_NAME}"
+
+[tasks.tg]
+run = "op run '--env-file={{config_root}}/deployment/.env' -- terragrunt"
+description = "Wrapper for terragrunt"
+dir = "{{cwd}}"
+
+[tasks."tg:fmt"]
+run = "mise run tg hcl format"
+description = "Format terragrunt files"
+
+[tasks.tf]
+run = "mise run tg run --all"
+description = "Wrapper for terragrunt run --all"
+dir = "{{cwd}}"
+
+[tasks."tf:fmt"]
+run = "tofu fmt -recursive deployment/"
+description = "Format terraform files"
+
+[tasks."tf:init"]
+run = "mise run tf init -- -reconfigure"
+dir = "{{cwd}}"
+
+[tasks."tf:plan"]
+run = "mise run tf plan"
+dir = "{{cwd}}"
+
+[tasks."tf:apply"]
+run = "mise run tf apply"
+dir = "{{cwd}}"
+
+[tasks."tf:destroy"]
+run = "mise run tf destroy"
+dir = "{{cwd}}"
+
+[settings]
+lockfile = true
+idiomatic_version_file_enable_tools = []

.mise/mise.lock

@@ -0,0 +1,125 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html
+
+lockfile_version = 2
+
+[[tools.node]]
+version = "24.21.0"
+backend = "core:node"
+specifiers = ["24.21.0"]
+
+[tools.node."platforms.linux-arm64"]
+checksum = "sha256:724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5"
+url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-linux-arm64.tar.gz"
+
+[tools.node."platforms.linux-arm64-musl"]
+checksum = "sha256:3048b0811e158ca0d8672b59c839861763e144492980d8d29b369dfee45747e4"
+url = "https://unofficial-builds.nodejs.org/download/release/v24.21.0/node-v24.21.0-linux-arm64-musl.tar.gz"
+
+[tools.node."platforms.linux-x64"]
+checksum = "sha256:6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff"
+url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-linux-x64.tar.gz"
+
+[tools.node."platforms.linux-x64-musl"]
+checksum = "sha256:01a713e34da98e7b4d2a3191ee7ca3f93dd0384d1a2ef23c379b2161ee6e133a"
+url = "https://unofficial-builds.nodejs.org/download/release/v24.21.0/node-v24.21.0-linux-x64-musl.tar.gz"
+
+[tools.node."platforms.macos-arm64"]
+checksum = "sha256:bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057"
+url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-arm64.tar.gz"
+
+[tools.node."platforms.macos-x64"]
+checksum = "sha256:1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097"
+url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-x64.tar.gz"
+
+[tools.node."platforms.windows-x64"]
+checksum = "sha256:158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541"
+url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-win-x64.zip"
+
+[[tools.opentofu]]
+version = "1.10.2"
+backend = "aqua:opentofu/opentofu"
+specifiers = ["1.10.2"]
+
+[tools.opentofu."platforms.linux-arm64"]
+checksum = "sha256:71a42ae4ead817d0234ea3611361e4b17690afc3ea30ad12a270973223dedccc"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.10.2/tofu_1.10.2_linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/269065927"
+
+[tools.opentofu."platforms.linux-arm64-musl"]
+checksum = "sha256:71a42ae4ead817d0234ea3611361e4b17690afc3ea30ad12a270973223dedccc"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.10.2/tofu_1.10.2_linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/269065927"
+
+[tools.opentofu."platforms.linux-x64"]
+checksum = "sha256:4d00a35452e7a2c17d7c46bad44142fb393fad39c84427a26433f29c9b0174a4"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.10.2/tofu_1.10.2_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/269065917"
+
+[tools.opentofu."platforms.linux-x64-musl"]
+checksum = "sha256:4d00a35452e7a2c17d7c46bad44142fb393fad39c84427a26433f29c9b0174a4"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.10.2/tofu_1.10.2_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/269065917"
+
+[tools.opentofu."platforms.macos-arm64"]
+checksum = "sha256:c5f2750bd3ab2727448336a407c59c29b5defd2e67f4b39f30a0aa7f4c14ddc8"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.10.2/tofu_1.10.2_darwin_arm64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/269065914"
+
+[tools.opentofu."platforms.macos-x64"]
+checksum = "sha256:c3e7270e27d1f94ccdd5a7a4fdbbb1af2f86bf78162c4a982c560228cf20fc7f"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.10.2/tofu_1.10.2_darwin_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/269065928"
+
+[tools.opentofu."platforms.windows-x64"]
+checksum = "sha256:fd25a96008f62ffff9a8450fb6d9f958e76a106a36c3f45a75fc9b20d8035cbf"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.10.2/tofu_1.10.2_windows_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/269065916"
+
+[[tools.terragrunt]]
+version = "0.83.0"
+backend = "aqua:gruntwork-io/terragrunt"
+specifiers = ["0.83.0"]
+
+[tools.terragrunt."platforms.linux-arm64"]
+checksum = "sha256:a24f1defb8f2d2493d2901739506fee0f08532e95df1a7625a63b9122be60e25"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v0.83.0/terragrunt_linux_arm64"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/269983545"
+
+[tools.terragrunt."platforms.linux-arm64-musl"]
+checksum = "sha256:a24f1defb8f2d2493d2901739506fee0f08532e95df1a7625a63b9122be60e25"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v0.83.0/terragrunt_linux_arm64"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/269983545"
+
+[tools.terragrunt."platforms.linux-x64"]
+checksum = "sha256:77347a0e801e58b7dbbc5111aa1ef0059db91dd8847fb735e6a73f50d132e723"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v0.83.0/terragrunt_linux_amd64"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/269983543"
+
+[tools.terragrunt."platforms.linux-x64-musl"]
+checksum = "sha256:77347a0e801e58b7dbbc5111aa1ef0059db91dd8847fb735e6a73f50d132e723"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v0.83.0/terragrunt_linux_amd64"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/269983543"
+
+[tools.terragrunt."platforms.macos-arm64"]
+checksum = "sha256:a98856a1565a8ffdacc6f6ce090750a86e8bc1f6a43600e96cea0c866701c7b0"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v0.83.0/terragrunt_darwin_arm64"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/269983501"
+
+[tools.terragrunt."platforms.macos-x64"]
+checksum = "sha256:04c2c90348c674e2e93f202d640f42ed3f7d3c6a637bc8465efe5248764f3c4a"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v0.83.0/terragrunt_darwin_amd64"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/269983496"
+
+[tools.terragrunt."platforms.windows-x64"]
+checksum = "sha256:99b35a84c9354e896fe744274cf3834b6e455770ca3a39abb6b7af81c34928dc"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v0.83.0/terragrunt_windows_amd64.exe"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/269983552"
+
+[[tools.wrangler]]
+version = "4.131.0"
+aube = { path = "locks/wrangler/4.131.0~d1f80b8e", digest = "sha256:b3c01dabebaa03bac4f087c48c78f7e3e2d74424b558585593cc3af29446eb31" }
+backend = "npm:wrangler"
+specifiers = ["4.131.0"]
+
+[tools.wrangler.options]
+allow_builds = '["esbuild", "sharp", "workerd"]'

backend/.nvmrc

@@ -1 +0,0 @@
-24.21.0

frontend/.nvmrc

@@ -1 +0,0 @@
-24.21