SRE-805: Validate mise lockfile in CI

.github/workflows/lint.yml

@@ -397,9 +397,58 @@ jobs:
           title: "SQLFluff Lint"
           input: "annotations.json"
 
+  mise-lock:
+    name: Mise lockfile (${{ matrix.runner }})
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # The lockfile does not exist on `main` yet (it lands with #9000), so
+      # skip gracefully when it is absent instead of failing.
+      - name: Check for lockfile
+        id: lockfile
+        run: echo "exists=$([[ -f .config/mise/mise.lock ]] && echo true || echo false)" | tee -a $GITHUB_OUTPUT
+
+      - name: Install mise
+        if: steps.lockfile.outputs.exists == 'true'
+        uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3.5.1
+        with:
+          install: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # `--locked` makes mise fail if any configured tool is missing from the
+      # lockfile or, for URL-locked backends, has no pre-resolved URL for
+      # this platform. `--dry-run` validates without downloading.
+      - name: Validate lockfile covers configured tools
+        if: steps.lockfile.outputs.exists == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: mise install --locked --dry-run
+
+      # Download the tools that have pre-resolved URLs in the lockfile so
+      # mise verifies their sha256 checksums and sizes. This catches a broken
+      # or tampered lockfile entry before the (slower) Docker builds do.
+      # Keep the list in sync with the tools carrying `platforms.*` entries
+      # in `mise.lock`; the dry-run step above already fails on tools missing
+      # from the lockfile. Cargo/npm/pipx tools are excluded, as they install
+      # through their own package managers and have no locked URLs to verify.
+      - name: Install URL-locked tools
+        if: steps.lockfile.outputs.exists == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: mise install --locked cargo-binstall java just node protoc sentry-cli taplo uv yq
+
   passed:
     name: Linting passed
-    needs: [setup, package, global]
+    needs: [setup, package, global, mise-lock]
     if: always()
     runs-on: ubuntu-latest
     steps:
@@ -412,6 +461,9 @@ jobs:
       - name: Check global results
         run: |
           [[ ${{ needs.global.result }} =~ success|skipped ]]
+      - name: Check mise lockfile results
+        run: |
+          [[ ${{ needs.mise-lock.result }} =~ success|skipped ]]
 
       - name: Notify Slack on failure
         uses: rtCamp/action-slack-notify@c58b60ee33df2229ed2d2eed86eeaf7e6c527c5a