fix(lock): reject platform regressions during relock

[jdx]

Summary

• reject version bumps that cannot reproduce a platform entry present on the previous locked version
• fail before pruning stale versions or writing the incomplete lockfile
• preserve best-effort skips for platforms the tool never supported

Root cause

A lockfile maintenance run in jdx/usage#773 resolved github:crate-ci/cargo-release@latest from 1.1.2 to 1.1.0. The selected release had no Linux assets, so mise lock --bump skipped those entries, pruned 1.1.2, wrote an incomplete lockfile, and exited successfully. Renovate then committed a lockfile that failed under locked mode.

This change treats that loss of previously locked platform coverage as an error while retaining the existing best-effort behavior for newly targeted unsupported platforms.

Validation

• mise run format
• cargo test cli::lock::tests
• mise run test:e2e e2e/lockfile/test_lockfile_bump e2e/cli/test_lock_resolution_failure

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.

---

Note

Medium Risk
Changes lockfile write semantics and failure modes for mise lock/--bump, which can block previously succeeding maintenance runs but prevents corrupt lockfiles.

Overview
mise lock now fails instead of writing a lockfile when a version bump would drop platform coverage that existed on the version being pruned.

Lock resolution results are tracked per tool/version/platform with statuses (Updated, Unresolved, ProvenanceFailed). After resolution, platform_regression_errors compares those results to stale versions slated for removal: if the new version cannot be locked for a platform but the old locked version could, the run errors before stale-version pruning or lockfile write for that target. Skips stay best-effort when the tool never had that platform, when the new version already has an entry, or when multiple current versions make the bump ambiguous.

Provenance failures are aggregated with platform regressions into a single exit error. Unit tests cover the regression matrix.

^{Reviewed by Cursor Bugbot for commit ef104a2. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes
  • Improved lock updates to accurately track results across platforms.
  • Prevented unresolved or failed platform checks from removing previously supported versions.
  • Lock updates now report all relevant errors instead of applying incomplete replacements.
  • Preserved support for newly supported platforms and ambiguous multi-version scenarios.
  • Updated summary counts to reflect only successfully applied updates.
  • Added safeguards for platform compatibility during version cleanup.

[coderabbitai]

📝 Walkthrough

Walkthrough

Lock processing now records structured per-platform outcomes. Before stale lock entries are pruned, unresolved and provenance-failed tasks are checked against prior platform support. Regression cases produce errors, while new unsupported platforms and ambiguous cases remain allowed.

Changes

Platform-aware lock pruning

Layer / File(s)	Summary
Structured lock task results src/cli/lock.rs	LockTaskResult records tool, version, platform, and task status. Processing and progress counts use structured results.
Platform regression validation and tests src/cli/lock.rs	Pruning rejects unresolved or provenance-failed replacements when a stale version supported the platform. Tests cover regression, new unsupported platforms, existing current-platform entries, and ambiguous multi-version cases.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• jdx/mise#11175: Extends the same stale-tool pruning logic with platform regression and provenance validation.
• jdx/mise#11299: Tracks whether lock-resolution results update platform entries.
• jdx/mise#11392: Prevents pruning when platform-specific version information is incomplete.

Poem

A rabbit checks each platform’s state,
Before old lock entries meet their fate.
Failed paths raise errors clear,
New gaps pass without fear.
The lockfile keeps its facts in place.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: rejecting platform regressions during lockfile relocking.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR prevents relocks from dropping previously locked platform coverage when a replacement version cannot resolve.

• Models each platform resolution as updated, unresolved, or provenance-failed.
• Checks platform regressions before pruning stale versions or writing the lockfile.
• Aggregates platform and provenance errors after processing lockfile targets.

Confidence Score: 4/5

The PR is not yet safe to merge because cross-version regression matching can still reject a valid relock when one current version has multiple unrelated stale versions.

The ambiguity guard only counts current result versions, while the regression check still scans every stale version under the same short name; failed relocks can preserve multiple stale records, allowing an unrelated platform entry to trigger an erroneous command failure.

Files Needing Attention: src/cli/lock.rs

Important Files Changed

Filename	Overview
src/cli/lock.rs	Adds structured lock-resolution results and pre-write platform-coverage validation.

_{Reviews (3): Last reviewed commit: "fix(lock): preserve existing platform co..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

src/cli/lock.rs (1)

1389-1427: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Good coverage for the two documented regression scenarios.

test_platform_regression_rejects_unresolved_version_bump and test_platform_regression_allows_new_unsupported_platform correctly exercise the "loses previously supported platform" and "never supported this platform" cases described in the PR objective. Consider adding a case where apply_lock_result fails (provenance-style, unresolved: false, updated: false) for a platform the stale version supports, to pin down the behavior discussed at lines 1111-1128 once that categorization is confirmed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/cli/lock.rs` around lines 1389 - 1427, The regression tests cover
unresolved version bumps but omit apply_lock_result failures. Add a test
alongside test_platform_regression_rejects_unresolved_version_bump that uses
unresolved: false and updated: false for a platform listed in stale_versions,
then assert platform_regression_errors reports the expected failure and
locked-version details.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/cli/lock.rs`:
- Around line 315-320: In the lockfile-target loop in run, replace the immediate
Err return for platform_regressions with accumulation into a function-level
collection and continue processing the next target. After the loop completes,
propagate the aggregated platform-regression messages alongside the existing
all_provenance_errors handling so every lockfile target is processed and written
before reporting failure.
- Around line 1111-1128: Update the LockTaskResult construction for the
provenance-check error path in lockfile::apply_lock_result so it sets
unresolved: true instead of false. Keep the existing success/update handling
unchanged, ensuring provenance failures are included in the platform-regression
check.

---

Nitpick comments:
In `@src/cli/lock.rs`:
- Around line 1389-1427: The regression tests cover unresolved version bumps but
omit apply_lock_result failures. Add a test alongside
test_platform_regression_rejects_unresolved_version_bump that uses unresolved:
false and updated: false for a platform listed in stale_versions, then assert
platform_regression_errors reports the expected failure and locked-version
details.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: f21d6ae5-a9d3-431f-a7a1-699ee7684c4d

📥 Commits

Reviewing files that changed from the base of the PR and between 18f68b0 and 342b9cc.

📒 Files selected for processing (1)

• src/cli/lock.rs

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
env	▁▅▇█▆	80,223,085 → 80,201,091	-0.03%	17.61 → 17.52ms	-0.53%
hook-env	▁▅▃▇█	82,346,637 → 82,377,802	+0.04%	18.33 → 18.19ms	-0.77%
ls	▇▄▃█▁	73,189,665 → 73,146,314	-0.06%	16.37 → 16.65ms	+1.71%
registry	▇██▄▁	49,107,725 → 49,058,546	-0.10%	11.75 → 11.81ms	+0.52%
startup	███▃▁	15,758,094 → 15,741,783	-0.10%	8.80 → 9.39ms	+6.70%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{ef104a2dbd7b vs 0c809d49da6a · measured on the runner, not pushed to the history.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 56d6bc6. Configure here.}