ci: switch builds from docker compose to mise

.buildkite/hooks/pre-command

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+checkout_path="${BUILDKITE_BUILD_CHECKOUT_PATH:-$(pwd)}"
+cache_root="${checkout_path}/.buildkite/cache-volume"
+
+mkdir -p \
+  "${cache_root}/go/build" \
+  "${cache_root}/go/pkg/mod" \
+  "${cache_root}/golangci-lint"
+
+export GOCACHE="${cache_root}/go/build"
+export GOMODCACHE="${cache_root}/go/pkg/mod"
+export GOLANGCI_LINT_CACHE="${cache_root}/golangci-lint"
+
+# CI pins tool versions in mise.toml/mise.lock, but the go: backend used for
+# go-cover-treemap does not support locked-mode URLs. Skip the GitHub API-backed
+# attestation/SLSA checks instead so reruns do not fail on unauthenticated rate
+# limits inside the mise plugin.
+export MISE_AQUA_GITHUB_ATTESTATIONS=false
+export MISE_AQUA_SLSA=false
+export MISE_GITHUB_ATTESTATIONS=false
+export MISE_GITHUB_GITHUB_ATTESTATIONS=false
+export MISE_GITHUB_SLSA=false
+export MISE_SLSA=false

.buildkite/pipeline.release.yml

@@ -1,6 +1,11 @@
 agents:
   queue: hosted
 
+x-mise-plugin: &mise_plugin
+  buildkite-plugins/mise#v1.1.1: ~
+
+cache: ".buildkite/cache-volume"
+
 steps:
   - label: ":terminal: build ({{matrix}})"
     matrix:
@@ -12,44 +17,21 @@ steps:
     secrets:
       - POSTHOG_API_KEY
       - OAUTH_CLIENT_ID
+    command: 'GOOS="{{matrix}}" .buildkite/release.sh release --clean --split'
     plugins:
-      - docker-compose#v5.12.1:
-          command:
-            - .buildkite/release.sh
-            - release
-            - --clean
-            - --split
-          config: .buildkite/docker-compose.yaml
-          entrypoint: /bin/sh
-          env:
-            - GOOS={{matrix}}
-            - POSTHOG_API_KEY
-            - OAUTH_CLIENT_ID
-          mount-buildkite-agent: true
-          run: goreleaser
-          shell: false
-          tty: true
+      - *mise_plugin
 
   - wait
 
   - label: ":rocket: :package: upload packages ({{matrix}})"
     matrix:
       - "deb"
       - "rpm"
+    command: '.buildkite/upload-packages.sh "{{matrix}}"'
     plugins:
       - artifacts#v1.9.4:
           download:
             - dist/linux/*
-      - docker-compose#v5.12.1:
-          command:
-            - .buildkite/upload-packages.sh
-            - "{{matrix}}"
-          config: .buildkite/docker-compose.yaml
-          entrypoint: /bin/sh
-          mount-buildkite-agent: true
-          run: goreleaser
-          shell: false
-          tty: true
 
   - label: ":rocket: :github: release"
     artifact_paths:
@@ -74,20 +56,5 @@ steps:
       - artifacts#v1.9.4:
           download:
             - dist/**/*
-      - docker-compose#v5.12.1:
-          command:
-            - .buildkite/release.sh
-            - continue
-            - --merge
-          config: .buildkite/docker-compose.yaml
-          entrypoint: /bin/sh
-          env:
-            - GITHUB_TOKEN
-            - DOCKERHUB_USER
-            - DOCKERHUB_PASSWORD
-            - POSTHOG_API_KEY
-            - OAUTH_CLIENT_ID
-          mount-buildkite-agent: true
-          run: goreleaser
-          shell: false
-          tty: true
+      - *mise_plugin
+    command: '.buildkite/release.sh continue --merge'

.buildkite/pipeline.yml

@@ -1,28 +1,30 @@
 agents:
   queue: hosted
 
+x-mise-plugin: &mise_plugin
+  buildkite-plugins/mise#v1.1.1: ~
+
+cache: ".buildkite/cache-volume"
+
 steps:
   - name: ":golangci-lint: lint"
-    command: golangci-lint run --verbose --timeout 3m
+    command: 'golangci-lint run --verbose --timeout 3m'
     plugins:
-      - docker-compose#v5.12.1:
-          config: .buildkite/docker-compose.yaml
-          run: golangci-lint
-          tty: true
+      - *mise_plugin
 
   - name: ":go: test"
+    key: test
     artifact_paths:
       - cover-tree.svg
     commands:
+      # Hosted agents inject org/token env that breaks config-precedence tests,
+      # so clear those variables in the command shell right before go test.
+      - unset BUILDKITE_ORGANIZATION_SLUG BUILDKITE_API_TOKEN
       - go test -coverprofile cover.out ./...
-      - go run github.com/nikolaydubina/go-cover-treemap@latest -coverprofile cover.out > cover-tree.svg
+      - go-cover-treemap -coverprofile cover.out > cover-tree.svg
       - echo '<details><summary>Coverage tree map</summary><img src="artifact://cover-tree.svg" alt="Test coverage tree map" width="70%"></details>' | buildkite-agent annotate --style "info"
     plugins:
-      -  docker-compose#v5.12.1:
-          config: .buildkite/docker-compose.yaml
-          run: golangci-lint
-          tty: true
-          mount-buildkite-agent: true
+      - *mise_plugin
 
   - wait
 
@@ -36,24 +38,9 @@ steps:
     secrets:
       - POSTHOG_API_KEY
       - OAUTH_CLIENT_ID
+    command: 'GOOS="{{matrix}}" .buildkite/release.sh release --clean --snapshot --split'
     plugins:
-      - docker-compose#v5.12.1:
-          command:
-            - .buildkite/release.sh
-            - release
-            - --clean
-            - --snapshot
-            - --split
-          config: .buildkite/docker-compose.yaml
-          entrypoint: /bin/sh
-          env:
-            - GOOS={{matrix}}
-            - POSTHOG_API_KEY
-            - OAUTH_CLIENT_ID
-          mount-buildkite-agent: true
-          run: goreleaser
-          shell: false
-          tty: true
+      - *mise_plugin
 
   - input: ":package: Create a release?"
     prompt: "Select the release type"

CONTRIBUTING.md

@@ -16,7 +16,6 @@ To get started with contributing, please follow these steps:
    * Lint with `mise run lint`.
    * Make sure the tests pass with `mise run test`.
    * Run `mise run generate` after GraphQL changes. If you need to refresh `schema.graphql`, set `BUILDKITE_GRAPHQL_TOKEN` first.
-   * If you prefer the containerized lint setup, `docker-compose -f .buildkite/docker-compose.yaml run golangci-lint golangci-lint run` still works.
 7. Commit your changes and push them to your forked repository.
 8. Submit a pull request with a detailed description of your changes and links to any relevant issues.
 

README.md

@@ -43,5 +43,6 @@ mise run generate
 go run main.go --help
 ```
 
-`mise.toml` pins Go `1.26.1` to match the current release build image. The
-module itself remains compatible with Go `1.25.0` as declared in `go.mod`.
+`mise.toml` pins the shared toolchain, including the release helpers used in
+CI. The module itself remains compatible with Go `1.25.0` as declared in
+`go.mod`.

mise.lock

@@ -0,0 +1,39 @@
+[[tools."aqua:mvdan/gofumpt"]]
+version = "0.9.2"
+backend = "aqua:mvdan/gofumpt"
+"platforms.linux-x64" = { checksum = "sha256:72cf61b12fef91eab6df6db4a4284f30616b5ead330112e28a1fa1cb15e57339", url = "https://github.com/mvdan/gofumpt/releases/download/v0.9.2/gofumpt_v0.9.2_linux_amd64"}
+"platforms.macos-arm64" = { checksum = "sha256:c241fb742599a6cb0563d7377f59def65d451b23dd718dbc6ddf4ab5e695e8f1", url = "https://github.com/mvdan/gofumpt/releases/download/v0.9.2/gofumpt_v0.9.2_darwin_arm64"}
+
+[[tools."github:goreleaser/goreleaser-pro"]]
+version = "2.14.3"
+backend = "github:goreleaser/goreleaser-pro"
+"platforms.linux-x64" = { checksum = "sha256:a6a7ba86950db98b1e7d18ac189bf43237645f9ef5ca89a66a56308c45f29b73", url = "https://github.com/goreleaser/goreleaser-pro/releases/download/v2.14.3/goreleaser-pro_Linux_x86_64.tar.gz", url_api = "https://api.github.com/repos/goreleaser/goreleaser-pro/releases/assets/370146679"}
+"platforms.macos-arm64" = { checksum = "sha256:c616cb4dd73c1d49f41dd23160a7b5a8092e45e40735f98fc02173611a8dfcbb", url = "https://github.com/goreleaser/goreleaser-pro/releases/download/v2.14.3/goreleaser-pro_Darwin_arm64.tar.gz", url_api = "https://api.github.com/repos/goreleaser/goreleaser-pro/releases/assets/370146635"}
+
+[[tools.go]]
+version = "1.26.1"
+backend = "core:go"
+"platforms.linux-x64" = { checksum = "sha256:031f088e5d955bab8657ede27ad4e3bc5b7c1ba281f05f245bcc304f327c987a", url = "https://dl.google.com/go/go1.26.1.linux-amd64.tar.gz"}
+"platforms.macos-arm64" = { checksum = "sha256:353df43a7811ce284c8938b5f3c7df40b7bfb6f56cb165b150bc40b5e2dd541f", url = "https://dl.google.com/go/go1.26.1.darwin-arm64.tar.gz"}
+
+[[tools."go:github.com/nikolaydubina/go-cover-treemap"]]
+version = "1.5.1"
+backend = "go:github.com/nikolaydubina/go-cover-treemap"
+
+[[tools.golangci-lint]]
+version = "2.11.3"
+backend = "aqua:golangci/golangci-lint"
+"platforms.linux-x64" = { checksum = "sha256:87bb8cddbcc825d5778b64e8a91b46c0526b247f4e2f2904dea74ec7450475d1", url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.3/golangci-lint-2.11.3-linux-amd64.tar.gz"}
+"platforms.macos-arm64" = { checksum = "sha256:30ee39979c516b9d1adca289a3f93429d130c4c0fda5e57d637850894221f6cc", url = "https://github.com/golangci/golangci-lint/releases/download/v2.11.3/golangci-lint-2.11.3-darwin-arm64.tar.gz"}
+
+[[tools.ko]]
+version = "0.18.1"
+backend = "aqua:ko-build/ko"
+"platforms.linux-x64" = { checksum = "sha256:048ab11818089a43b7b74bc554494a79a3fd0d9822c061142e5cd3cf8b30cb27", url = "https://github.com/ko-build/ko/releases/download/v0.18.1/ko_0.18.1_Linux_x86_64.tar.gz"}
+"platforms.macos-arm64" = { checksum = "sha256:752a639e0fbc013a35a43974b5ed87e7008bc2aee4952dfd2cc19f0013205492", url = "https://github.com/ko-build/ko/releases/download/v0.18.1/ko_0.18.1_Darwin_arm64.tar.gz"}
+
+[[tools.lefthook]]
+version = "2.1.4"
+backend = "aqua:evilmartians/lefthook"
+"platforms.linux-x64" = { checksum = "sha256:991a11fb98c853dbecf7de3fe7f4b5648872f4279ac2b50ef3302f0a058c99bd", url = "https://github.com/evilmartians/lefthook/releases/download/v2.1.4/lefthook_2.1.4_Linux_x86_64.gz"}
+"platforms.macos-arm64" = { checksum = "sha256:41fa330710344f66683edb2ee19dfd531e9469bebf7c89ef8e201263565c12ad", url = "https://github.com/evilmartians/lefthook/releases/download/v2.1.4/lefthook_2.1.4_MacOS_arm64.gz"}

mise.toml

@@ -1,11 +1,17 @@
 # Pinned local toolchain for contributors. The Go version matches the
-# repository's current release build image; the module minimum stays in go.mod.
+# CI and release toolchain; the module minimum stays in go.mod.
+[settings]
+experimental = true
+lockfile = true
+
 [tools]
 go = "1.26.1"
 golangci-lint = "2.11.3"
 lefthook = "2.1.4"
 "aqua:mvdan/gofumpt" = "0.9.2"
-"aqua:goreleaser/goreleaser" = "2.14.3"
+"go:github.com/nikolaydubina/go-cover-treemap" = "1.5.1"
+"github:goreleaser/goreleaser-pro" = "2.14.3"
+ko = "0.18.1"
 
 [tasks.format]
 description = "Format Go files with gofumpt"