Use mise to manage dev tools

.devcontainer/devcontainer.json

@@ -1,10 +1,16 @@
 {
   "name": "Iceberg Rust",
   "image": "mcr.microsoft.com/devcontainers/rust:bullseye",
+  "features": {
+    "ghcr.io/devcontainers-extra/features/mise:1": {
+      "version": "2026.7.5"
+    }
+  },
   "customizations": {
     "vscode": {
       "extensions": [
-        "rust-lang.rust-analyzer"
+        "rust-lang.rust-analyzer",
+        "hverlin.mise-vscode"
       ],
       "settings": {
         "editor.formatOnSave": true,
@@ -13,5 +19,19 @@
         }
       }
     }
-  }
+  },
+  "mounts": [
+    {
+      "source": "iceberg-rust-mise-data",
+      "target": "/mnt/mise-data",
+      "type": "volume"
+    }
+  ],
+  "containerEnv": {
+    "MISE_DATA_DIR": "/mnt/mise-data"
+  },
+  "remoteEnv": {
+    "PATH": "${containerEnv:PATH}:/mnt/mise-data/shims"
+  },
+  "postCreateCommand": "sudo chown -R $(id -u):$(id -g) /mnt/mise-data && mise trust --yes mise.toml && mise install"
 }

.github/workflows/audit.yml

@@ -28,21 +28,21 @@ on:
     paths:
       - "**/Cargo.toml"
       - "**/Cargo.lock"
+      - ".github/workflows/audit.yml"
+      - "mise.toml"
 
   pull_request:
     paths:
       - "**/Cargo.toml"
       - "**/Cargo.lock"
       - ".github/workflows/audit.yml"
+      - "mise.toml"
 
   schedule:
     - cron: '0 0 * * *'
 
 permissions:
-  # All other permissions are set to none
   contents: read
-  checks: write
-  issues: write
 
 jobs:
   security_audit:
@@ -52,10 +52,9 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - name: Setup Rust toolchain
-        uses: ./.github/actions/setup-builder
-        with:
-          rust-version: stable
-      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
+      - name: Setup mise
+        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          version: 2026.7.5
+      - name: Audit dependencies
+        run: mise run check-audit

.github/workflows/bindings_python_ci.yml

@@ -50,21 +50,16 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
+      - name: Setup mise
+        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
         with:
-          version: "0.9.3"
-          enable-cache: true
-      - name: Install tools
-        run: |
-          uv tool install ruff
+          version: 2026.7.5
       - name: Check format
-        working-directory: "bindings/python"
-        run: |
-          uvx ruff format . --diff
+        working-directory: bindings/python
+        run: mise run check-format
       - name: Check style
-        working-directory: "bindings/python"
-        run: |
-          uvx ruff check .
+        working-directory: bindings/python
+        run: mise run check-style
 
   test:
     runs-on: ${{ matrix.os }}
@@ -79,43 +74,18 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - name: Setup mise
+        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
         with:
-          python-version: 3.12
-      # Linux maturin builds may run inside manylinux Docker, so host Rust caches only help Windows/macOS.
-      - name: Setup Rust toolchain
-        if: runner.os != 'Linux'
-        uses: ./.github/actions/setup-builder
+          version: 2026.7.5
       - name: Cache Rust artifacts
-        if: runner.os != 'Linux'
         uses: swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           key: bindings-python
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
-        with:
-          working-directory: "bindings/python"
-          command: build
-          args: --out dist -i python3.12 # Explicitly set interpreter; manylinux containers have multiple Pythons and maturin may pick an older one
-      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
-        with:
-          version: "0.9.3"
-          enable-cache: true
-      - name: Sync dependencies
-        working-directory: "bindings/python"
-        shell: bash
-        run: |
-          uv sync --group dev --no-install-project
-      - name: Install built wheel
-        working-directory: "bindings/python"
-        shell: bash
-        run: |
-          uv pip install --no-build --reinstall --find-links dist/ pyiceberg-core
-      - name: Run tests
-        working-directory: "bindings/python"
-        shell: bash
+      - name: Build, install, and test wheel
+        working-directory: bindings/python
         env:
           HF_TOKEN: ${{ secrets.HF_TOKEN }}
           HF_DATASET: ${{ secrets.HF_DATASET }}
-        run: |
-          make test
+        run: mise run test-wheel