chore(deps): update jdx/mise-action action to v4.2.1 (#2312)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [jdx/mise-action](https://redirect.github.com/jdx/mise-action) |
action | patch | `v4.2.0` → `v4.2.1` |

---

### Release Notes

<details>
<summary>jdx/mise-action (jdx/mise-action)</summary>

###
[`v4.2.1`](https://redirect.github.com/jdx/mise-action/releases/tag/v4.2.1):
: Signed checksums and PATH export fix

[Compare
Source](https://redirect.github.com/jdx/mise-action/compare/v4.2.0...v4.2.1)

A small patch release with two user-facing fixes: mise downloads are now
verified against minisign-signed release checksums by default, and the
`env` input no longer leaks the runner's `PATH` into subsequent steps.

##### Fixed

##### Verify mise downloads with signed checksums
([#&#8203;548](https://redirect.github.com/jdx/mise-action/pull/548)) by
[@&#8203;jdx](https://redirect.github.com/jdx)

The action now embeds mise's minisign public key and verifies
`SHASUMS256.txt.minisig` before trusting any release checksums, then
checks the downloaded mise binary's SHA256 against the verified list.
This applies to both GitHub release archives (verified before
extraction) and the default `mise.jdx.dev` CDN path (verified against
the signed checksum for the matching release asset). If a CDN download
fails verification, the action warns and falls back to the signed GitHub
release asset instead of installing an unverified binary.

- The existing `sha256` input still works as an explicit override.
- Pinned mise versions older than `2024.12.24` (which predate minisign
checksums) get a warning and skip signed verification rather than
failing.
- Because tar installs now extract from a verified file on disk, the
previous streaming `download | tar` fast path is replaced with a
download-then-verify-then-extract flow.

Thanks to [@&#8203;potiuk](https://redirect.github.com/potiuk) for the
detailed threat-model writeup in
[#&#8203;547](https://redirect.github.com/jdx/mise-action/issues/547).

##### Exclude `PATH` from environment export
([#&#8203;556](https://redirect.github.com/jdx/mise-action/pull/556)) by
[@&#8203;jdx](https://redirect.github.com/jdx)

The `env` input has always documented that "PATH modifications are not
part of this", but since the switch to `mise env --json` in
[#&#8203;252](https://redirect.github.com/jdx/mise-action/pull/252)
(needed for redaction support), the action was exporting every string
value returned by mise — including the computed `PATH` — into
`GITHUB_ENV`. That effectively snapshotted the runner's entire `PATH`
into subsequent steps and let `[env] _.path` entries in `mise.toml` leak
past the action's own PATH management.

`exportMiseEnv` now skips `PATH` (case-insensitive) when exporting JSON
env vars, restoring the documented behavior. Normal mise env vars are
still exported, and PATH continues to be managed by the action's own
setup (e.g. `add_shims_to_path`). Fixes
[#&#8203;555](https://redirect.github.com/jdx/mise-action/issues/555).

**Full Changelog**:
<jdx/mise-action@v4.2.0...v4.2.1>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/prometheus/client_java).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>

Author: renovate[bot]

.github/workflows/acceptance-tests.yml

@@ -13,7 +13,7 @@ jobs:
         with:
           persist-credentials: false
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
           version: v2026.7.5
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778

.github/workflows/api-diff.yml

@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
           version: v2026.7.5
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778

.github/workflows/build.yml

@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
           version: v2026.7.5
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778

.github/workflows/bump-api-diff-baseline.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           ref: ${{ env.SNAPSHOT_BRANCH }}
           persist-credentials: true
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
           version: v2026.7.5
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778

.github/workflows/generate-protobuf.yml

@@ -18,7 +18,7 @@ jobs:
         with:
           ref: ${{ github.ref }}
           persist-credentials: false
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
           version: v2026.7.5
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778

.github/workflows/github-pages.yaml

@@ -37,7 +37,7 @@ jobs:
           persist-credentials: false
           fetch-tags: "true"
           fetch-depth: 0
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
           version: v2026.7.5
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778

.github/workflows/java-version-matrix-tests.yml

@@ -31,7 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up mise
-        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
           version: v2026.7.5
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778

.github/workflows/jmx-exporter-compatibility.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
           version: v2026.7.5
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778

.github/workflows/lint.yml

@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 0 # needed for git diff --merge-base in lint:links
 
       - name: Setup mise
-        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
           version: v2026.7.5
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778

.github/workflows/micrometer-compatibility.yml

@@ -30,7 +30,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
           version: v2026.7.5
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778