[codex] Add mise and shared Rust toolchain setup

.github/actions/download-ofl/action.yml

@@ -0,0 +1,16 @@
+name: download ofl
+description: Download the ofl artifact for the current runner.
+
+runs:
+  using: composite
+  steps:
+  - uses: actions/download-artifact@v4
+    with:
+      name: ofl-${{ runner.os }}
+      path: bin/
+  # Artifact downloads do not preserve executable bits, so restore the Unix
+  # bit here rather than spreading that implementation detail through jobs.
+  - name: restore ofl executable bit
+    if: runner.os != 'Windows'
+    shell: bash
+    run: chmod +x bin/ofl

.github/actions/setup-project-tools/action.yml

@@ -0,0 +1,40 @@
+name: setup project tools
+description: Install host packages and mise-managed project tools.
+
+runs:
+  using: composite
+  steps:
+  # Keep this OS package list intentionally tiny. Every package here is outside
+  # mise and makes the CI runner image part of the build contract, so prefer
+  # project manifests, .mise/config.toml, or tool-managed installs whenever
+  # possible. Only add packages that are true header/linker/runtime requirements
+  # for current CI jobs and cannot reasonably be provisioned by project tools.
+  - name: install Linux system dependencies
+    if: runner.os == 'Linux'
+    shell: bash
+    run: |
+      sudo apt-get update
+      sudo apt-get install -y libssl-dev
+  # mise installs Rust through rustup, but rustup stores toolchains and
+  # components outside mise's install metadata by default. Keep rustup's state
+  # under mise's OS-specific data dir here so jdx/mise-action's cache restores
+  # the clippy/rustfmt/target components that the project tool config requests.
+  # The Rust backend also shares a cached rustup-init binary across all Rust
+  # entries, so install serially to avoid concurrent first-run permission races.
+  - name: configure mise-managed rustup cache
+    shell: bash
+    run: |
+      if [[ "$RUNNER_OS" == "Windows" ]]; then
+        rustup_home="${LOCALAPPDATA}\\mise\\rustup"
+      else
+        rustup_home="${HOME}/.local/share/mise/rustup"
+      fi
+
+      {
+        echo "MISE_RUSTUP_HOME=$rustup_home"
+        echo "RUSTUP_HOME=$rustup_home"
+        echo "MISE_JOBS=1"
+      } >> "$GITHUB_ENV"
+  - uses: jdx/mise-action@v4
+    with:
+      cache_key_prefix: mise-v3

.github/workflows/main.yml

@@ -1,8 +1,5 @@
 env:
   RUSTFLAGS: -D warnings
-  # coverage collection depends on unstable features.
-  # we want the CI results to all be from the same toolchain, so we set it up here.
-  RUSTUP_TOOLCHAIN: nightly-2021-10-30
 on:
   push:
     branches:
@@ -17,11 +14,11 @@ jobs:
         os: [macos-latest, ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@master
-    - run: rustup install ${{ env.RUSTUP_TOOLCHAIN }}
-    - uses: actions/cache@v2
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/setup-project-tools
+    - uses: actions/cache@v4
       with:
-        key: ${{ runner.os }}-ofl-${{ hashFiles('ofl/Cargo.lock') }}-${{ env.RUSTUP_TOOLCHAIN }}-2
+        key: ${{ runner.os }}-ofl-${{ hashFiles('ofl/Cargo.lock') }}-${{ hashFiles('.mise/config.toml') }}-3
         path: |
           ~/.cargo/git
           ~/.cargo/registry
@@ -30,7 +27,7 @@ jobs:
       working-directory: ofl
     - run: cargo test --release
       working-directory: ofl
-    - uses: actions/upload-artifact@v2
+    - uses: actions/upload-artifact@v4
       with:
         name: ofl-${{ runner.os }}
         path: ofl/target/release/ofl*
@@ -42,22 +39,13 @@ jobs:
         os: [macos-latest, ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@master
-    - run: rustup install ${{ env.RUSTUP_TOOLCHAIN }}
-    - run: rustup component add llvm-tools-preview
-    - uses: actions/download-artifact@v2
-      with:
-        name: ofl-${{ runner.os }}
-        path: bin/
-    # TODO(actions/download-artifact#14) undo hack
-    - run: chmod +x bin/ofl
-      if: runner.os != 'Windows'
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/setup-project-tools
+    - uses: ./.github/actions/download-ofl
 
-    - name: ensure lockfile up to date
-      run: cargo generate-lockfile
-    - uses: actions/cache@v2
+    - uses: actions/cache@v4
       with:
-        key: ${{ runner.os }}-coverage-${{ hashFiles('Cargo.lock') }}-${{ env.RUSTUP_TOOLCHAIN }}-2
+        key: ${{ runner.os }}-coverage-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('.mise/config.toml') }}-3
         path: |
           ~/.cargo/git
           ~/.cargo/registry
@@ -70,7 +58,7 @@ jobs:
     - run: bin/ofl coverage report
     - run: bin/ofl coverage cleanup
 
-    - uses: codecov/codecov-action@v1
+    - uses: codecov/codecov-action@v5
       with:
         file: ./target/coverage/lcov.info
 
@@ -81,21 +69,13 @@ jobs:
         os: [macos-latest, ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@master
-    - run: rustup install ${{ env.RUSTUP_TOOLCHAIN }}
-    - uses: actions/download-artifact@v2
-      with:
-        name: ofl-${{ runner.os }}
-        path: bin/
-    # TODO(actions/download-artifact#14) undo hack
-    - run: chmod +x bin/ofl
-      if: runner.os != 'Windows'
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/setup-project-tools
+    - uses: ./.github/actions/download-ofl
 
-    - name: ensure lockfile up to date
-      run: cargo generate-lockfile
-    - uses: actions/cache@v2
+    - uses: actions/cache@v4
       with:
-        key: ${{ runner.os }}-dom-${{ hashFiles('Cargo.lock') }}-${{ env.RUSTUP_TOOLCHAIN }}-2
+        key: ${{ runner.os }}-dom-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('.mise/config.toml') }}-3
         path: |
           ~/.cargo/git
           ~/.cargo/registry
@@ -123,21 +103,13 @@ jobs:
         os: [macos-latest, ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@master
-    - run: rustup install ${{ env.RUSTUP_TOOLCHAIN }}
-    - uses: actions/download-artifact@v2
-      with:
-        name: ofl-${{ runner.os }}
-        path: bin/
-    # TODO(actions/download-artifact#14) undo hack
-    - run: chmod +x bin/ofl
-      if: runner.os != 'Windows'
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/setup-project-tools
+    - uses: ./.github/actions/download-ofl
 
-    - name: ensure lockfile up to date
-      run: cargo generate-lockfile
-    - uses: actions/cache@v2
+    - uses: actions/cache@v4
       with:
-        key: ${{ runner.os }}-website-${{ hashFiles('Cargo.lock') }}-${{ env.RUSTUP_TOOLCHAIN }}-2
+        key: ${{ runner.os }}-website-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('.mise/config.toml') }}-3
         path: |
           ~/.cargo/git
           ~/.cargo/registry
@@ -151,7 +123,7 @@ jobs:
     - run: cargo docs-all
     - run: cargo docs-ofl
     - run: bin/ofl website build target/website
-    - uses: actions/upload-artifact@v2
+    - uses: actions/upload-artifact@v4
       if: runner.os == 'Linux'
       with:
         name: website
@@ -161,15 +133,9 @@ jobs:
     needs: ofl
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@master
-    - run: rustup install ${{ env.RUSTUP_TOOLCHAIN }}
-    - run: rustup component add rustfmt
-    - uses: actions/download-artifact@v2
-      with:
-        name: ofl-${{ runner.os }}
-        path: bin/
-    # TODO(actions/download-artifact#14) undo hack
-    - run: chmod +x bin/ofl
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/setup-project-tools
+    - uses: ./.github/actions/download-ofl
     - run: bin/ofl fmt --check
 
   clippy:
@@ -178,33 +144,53 @@ jobs:
         os: [macos-latest, ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@master
-    - run: rustup install ${{ env.RUSTUP_TOOLCHAIN }}
-    - run: rustup component add clippy
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/setup-project-tools
     - run: cargo clippy-ofl
     - run: cargo clippy-core
     - run: cargo clippy-dom
 
+  blocking-ci:
+    name: blocking CI
+    if: always()
+    needs: [clippy, coverage, dom, fmt, ofl, website]
+    runs-on: ubuntu-latest
+    steps:
+    - name: report CI results
+      run: |
+        echo "clippy: ${{ needs.clippy.result }}"
+        echo "coverage: ${{ needs.coverage.result }}"
+        echo "dom: ${{ needs.dom.result }}"
+        echo "fmt: ${{ needs.fmt.result }}"
+        echo "ofl: ${{ needs.ofl.result }}"
+        echo "website: ${{ needs.website.result }}"
+    - name: require successful CI
+      run: |
+        if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]]; then
+          exit 1
+        fi
+        if [[ "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
+          exit 1
+        fi
+        if [[ "${{ contains(needs.*.result, 'skipped') }}" == "true" ]]; then
+          exit 1
+        fi
+
   publish:
     if: github.ref == 'refs/heads/main'
-    needs: [clippy, coverage, dom, fmt, ofl, website]
+    needs: blocking-ci
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@master
-    - run: rustup install ${{ env.RUSTUP_TOOLCHAIN }}
-    - uses: actions/download-artifact@v2
-      with:
-        name: ofl-${{ runner.os }}
-        path: bin/
-    # TODO(actions/download-artifact#14) undo hack
-    - run: chmod +x bin/ofl
-    - uses: actions/download-artifact@v2
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/setup-project-tools
+    - uses: ./.github/actions/download-ofl
+    - uses: actions/download-artifact@v4
       with:
         name: website
         path: target/website
     - name: promote website to prod, ensure crates published
       run: |
-        npx netlify-cli deploy --prod --auth ${{ secrets.NETLIFY_AUTH_TOKEN }}
+        netlify deploy --prod --auth ${{ secrets.NETLIFY_AUTH_TOKEN }}
         cargo login ${{ secrets.CARGO_API_TOKEN }}
         bin/ofl published
         git push origin --tags

.gitignore

@@ -1,12 +1,11 @@
 bin/
 target/
 **/*.rs.bk
-/Cargo.lock
 *.log
 *.new
 node_modules/
 .idea/
 pkg/
 cargo-timing*.html
 **/cypress/screenshots
-**/cypress/videos
+**/cypress/videos

.mise/config.toml

@@ -0,0 +1,35 @@
+[tools]
+# Canonical Rust toolchains for this project. The first entry is the active
+# project toolchain; the additional stable toolchains are used to install older
+# cargo-managed CLIs below.
+rust = [
+  { version = "nightly-2021-10-30", components = "clippy,rustfmt,llvm-tools-preview", targets = "wasm32-unknown-unknown", profile = "minimal" },
+  { version = "1.75.0", profile = "minimal" },
+  { version = "1.65.0", profile = "minimal" },
+]
+
+# The TodoMVC e2e lockfile is npm v6-era and pins Cypress 5.2.0. Node 16 is the
+# oldest practical LTS here with official darwin-arm64 builds, avoiding a local
+# Node-from-source compile on Apple Silicon.
+node = "16.20.2"
+
+# External cargo subcommands used by project aliases such as `cargo core-flow`,
+# `cargo dom-flow`, `cargo server`, and `cargo ofl-flow`. cargo-watch's locked
+# deps require Rust 1.75.0.
+"cargo:cargo-watch" = { version = "8.5.3", depends = [
+  "rust@1.75.0",
+], install_env = { RUSTUP_TOOLCHAIN = "1.75.0" } }
+
+# wasm-pack 0.9.1 needs wasm-bindgen-cli 0.2.69 for this toolchain. Install it
+# with Rust 1.65.0: new enough for mise's cargo backend syntax, old enough for
+# this wasm-bindgen release. Vendored OpenSSL keeps this old transitive
+# openssl-sys version building on modern Linux runners.
+"cargo:wasm-bindgen-cli" = { version = "0.2.69", depends = [
+  "rust@1.65.0",
+], features = "vendored-openssl", install_env = { RUSTUP_TOOLCHAIN = "1.65.0" } }
+
+# Node CLIs referenced by repo docs/CI. The TodoMVC e2e package still has its
+# own package-lock.json; run `npm ci` from dom/examples/todo/e2e for that app's
+# local test dependencies.
+"npm:cypress" = { version = "5.2.0", npm_args = "--ignore-scripts=false" }
+"npm:netlify-cli" = "12.14.0"

CONTRIBUTING.md

@@ -31,9 +31,10 @@ GitHub now offers an option to require that a branch is up-to-date before it is
 
 ### Requirements
 
-* [rustup](https://rustup.rs)
-  * `rustup component add clippy rustfmt`
-* [cargo-watch](https://crates.io/crates/cargo-watch)
+* [mise](https://mise.jdx.dev)
+  * Rust, Node, cargo subcommands, and npm CLIs are pinned in
+    [`.mise/config.toml`](./.mise/config.toml); run `mise install` from the
+    project root to install them.
 
 ### Workflows
 
@@ -45,7 +46,7 @@ From the project root, this command will run the default development loop:
 $ cargo core-flow
 ```
 
-See [its definition](./.cargo/config) for details.
+See [its definition](./.cargo/config.toml) for details.
 
 #### moxie-dom