[CI][deps] Switch from devbox to mise and from docker to ko. Bump go to 1.26.4

.github/copilot-instructions.md

@@ -49,19 +49,19 @@ Example: `scope.NewClusterScope()` combines `LinodeCluster` + CAPI `Cluster` res
 ## Development Workflows
 
 ### Build & Test Commands
-- `make generate` - Regenerate CRDs and mocks after API changes
-- `make test` - Run unit tests with mocked clients
-- `make e2e E2E_SELECTOR=quick` - Run specific E2E tests using Chainsaw
-- `make lint` - Run golangci-lint with project-specific rules
-- `make build` - Build the controller manager binary
+- `mise run generate` - Regenerate CRDs and mocks after API changes
+- `mise run test` - Run unit tests with mocked clients
+- `mise run e2e E2E_SELECTOR=quick` - Run specific E2E tests using Chainsaw
+- `mise run lint` - Run golangci-lint with project-specific rules
+- `mise run build` - Build the controller manager binary
 
 ### Adding New Resources
 1. Define API types in `api/v1alpha2/` with proper validation markers
 2. Implement controller in `internal/controller/` following the standard pattern
 3. Add scope in `cloud/scope/` for client management
 4. Add validation webhook in `internal/webhook/v1alpha2/`
 5. Add cloud services in `cloud/services/` if needed
-6. Run `make generate` to update CRDs and mocks
+6. Run `mise run generate` to update CRDs and mocks
 7. Add E2E tests in `e2e/<resource>-controller/`
 
 ### Testing Patterns
@@ -200,5 +200,5 @@ Standard OpenTelemetry environment variables are supported via `autoexport` pack
 - Use `kubectl describe` on resources to see status conditions and events
 - E2E test failures often indicate webhook validation or API compatibility issues
 - Enable debug logging with `CAPL_DEBUG=true` for detailed tracing
-- Validate CRDs are current with `make generate` after API changes
-- Generate local-release whenever making changes to the /templates directory. Use command `make local-release` to generate the release files.
+- Validate CRDs are current with `mise run generate` after API changes
+- Generate local-release whenever making changes to the /templates directory. Use command `mise run local-release` to generate the release files.

.github/workflows/build-push.yml

@@ -35,30 +35,28 @@ jobs:
             sum.golang.org:443
             *.githubusercontent.com:443
             storage.googleapis.com:443
+            mise.jdx.dev:443
+            mise-versions.jdx.dev:443
+            tuf-repo-cdn.sigstore.dev:443
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-      - name: Docker Meta
-        id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+
+      - name: Set up Mise
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
         with:
-          images: linode/cluster-api-provider-linode
+          install_args: go ko
+
       - name: Login to Docker Hub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Build and Push to Docker Hub
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          context: .
-          build-args: VERSION=${{ github.ref_name == 'main' && format('main-{0}', github.sha) || github.ref_name }}
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Publish image with ko
+        env:
+          KO_DOCKER_REPO: docker.io/linode/cluster-api-provider-linode
+          IMAGE_VERSION: ${{ github.ref_name }}
+        run: mise run ko-publish

.github/workflows/build_test_ci.yml

@@ -59,37 +59,27 @@ jobs:
             sum.golang.org:443
             *.githubusercontent.com:443
             storage.googleapis.com:443
-            get.jetify.com:443
-            get.jetpack.io:443
-            releases.jetify.com:443
-            releases.jetpack.io:443
-            artifacts.nixos.org:443
-            cache.nixos.org:443
             cli.codecov.io:443
             api.codecov.io:443
             ingest.codecov.io:443
             dl.k8s.io:443
             cdn.dl.k8s.io:443
+            mise.jdx.dev:443
+            mise-versions.jdx.dev:443
+            tuf-repo-cdn.sigstore.dev:443
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
-      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - name: Set up Mise
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
         with:
-          go-version-file: 'go.mod'
-          check-latest: true
-
-      - name: Install devbox
-        uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
-        with:
-          enable-cache: 'true'
-          refresh-cli: 'false'
+          install_args: go
 
       - name: Test
-        run: devbox run make test
+        run: mise run test
 
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2

.github/workflows/e2e-test.yaml

@@ -119,34 +119,19 @@ jobs:
             *.linodeobjects.com:443
             dl.k8s.io:443
             cdn.dl.k8s.io:443
-            get.jetify.com:443
-            get.jetpack.io:443
-            releases.jetify.com:443
-            releases.jetpack.io:443
-            artifacts.nixos.org:443
-            cache.nixos.org:443
+            mise.jdx.dev:443
+            mise-versions.jdx.dev:443
+            tuf-repo-cdn.sigstore.dev:443
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
-      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - name: Set up Mise
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
         with:
-          go-version-file: 'go.mod'
-          check-latest: true
-
-      - name: Docker cache
-        uses: ScribeMD/docker-cache@fb28c93772363301b8d0a6072ce850224b73f74e # 0.5.0
-        with:
-          key: docker-${{ runner.os }}-${{ hashFiles('go.sum') }}
-
-      - name: Install devbox
-        uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
-        with:
-          enable-cache: 'true'
-          refresh-cli: 'false'
+          install_args: go golangci-lint
 
       - name: Create IPv4-only kind network
         run: |
@@ -170,11 +155,11 @@ jobs:
           LINODE_MACHINE_TYPE: g6-standard-2
           CLUSTERCTL_CONFIG: /home/runner/work/cluster-api-provider-linode/cluster-api-provider-linode/e2e/gha-clusterctl-config.yaml
           LINODE_CLIENT_TIMEOUT: 30
-        run: devbox run make e2etest
+        run: mise run e2etest
 
       - name: cleanup stale clusters
         if: ${{ always() }}
-        run: make clean-child-clusters
+        run: mise run clean-child-clusters
 
       - name: Copy logs
         if: ${{ always() }}

.github/workflows/e2e-upgrade-test.yaml

@@ -89,11 +89,10 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - name: Set up Mise
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
         with:
-          go-version-file: 'go.mod'
-          check-latest: true
+          install_args: go
 
       - name: Create IPv4-only kind network
         run: |
@@ -113,12 +112,12 @@ jobs:
           LINODE_MACHINE_TYPE: g6-standard-2
           CLUSTERCTL_CONFIG: /home/runner/work/cluster-api-provider-linode/cluster-api-provider-linode/e2e/gha-clusterctl-config.yaml
           E2E_FLAGS: --assert-timeout 20m0s
-        run: make test-upgrade
+        run: mise run test-upgrade
 
       - name: cleanup stale clusters
         if: ${{ always() }}
-        run: make clean-child-clusters
+        run: mise run clean-child-clusters
 
       - name: cleanup kind mgmt cluster
         if: ${{ always() }}
-        run: make clean-kind-cluster
+        run: mise run clean-kind-cluster

.github/workflows/go-analyze.yml

@@ -69,23 +69,22 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - name: Set up Mise
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
         with:
-          go-version-file: 'go.mod'
-          check-latest: true
+          install_args: go
 
       - name: lint
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
 
       - name: lint-api
-        run: make lint-api
+        run: mise run lint-api
 
       - name: Nilcheck
-        run: make nilcheck
+        run: mise run nilcheck
 
       - name: Vulncheck
-        run: make vulncheck
+        run: mise run vulncheck
 
       - name: Gosec
-        run: make gosec
+        run: mise run gosec

.github/workflows/pull_request_ci.yaml

@@ -73,38 +73,28 @@ jobs:
             sum.golang.org:443
             *.githubusercontent.com:443
             storage.googleapis.com:443
-            get.jetify.com:443
-            get.jetpack.io:443
-            releases.jetify.com:443
-            releases.jetpack.io:443
-            artifacts.nixos.org:443
-            cache.nixos.org:443
+            mise.jdx.dev:443
+            mise-versions.jdx.dev:443
+            tuf-repo-cdn.sigstore.dev:443
             dl.k8s.io:443
             cdn.dl.k8s.io:443
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
-      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - name: Set up Mise
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
         with:
-          go-version-file: 'go.mod'
-          check-latest: true
-
-      - name: Install devbox
-        uses: jetify-com/devbox-install-action@8c6a66ed6273138b1915457069de78cb52fe3bd7 # v0.15.0
-        with:
-          enable-cache: 'true'
-          refresh-cli: 'false'
+          install_args: go
 
       - name: Build
-        run: devbox run make build
+        run: mise run build
 
       - name: Check for generated diff
-        run: make check-gen-diff
+        run: mise run check-gen-diff
 
-  docker-build:
+  image-build:
     runs-on: ubuntu-latest
     needs: changes
     if: ${{ contains(fromJSON(needs.changes.outputs.paths), 'src') }}
@@ -130,15 +120,19 @@ jobs:
             production.cloudfront.docker.com:443
             gcr.io:443
             storage.googleapis.com:443
+            mise.jdx.dev:443
+            mise-versions.jdx.dev:443
+            tuf-repo-cdn.sigstore.dev:443
+            dl.k8s.io:443
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
-      - name: Docker cache
-        uses: ScribeMD/docker-cache@fb28c93772363301b8d0a6072ce850224b73f74e # 0.5.0
+      - name: Set up Mise
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
         with:
-          key: docker-${{ runner.os }}-${{ hashFiles('go.sum') }}
+          install_args: go ko
 
-      - name: Build the Docker image
-        run: make docker-build
+      - name: Build the image
+        run: mise run ko-build

.ko.yaml

@@ -0,0 +1,4 @@
+defaultBaseImage: gcr.io/distroless/static:nonroot
+defaultPlatforms:
+  - linux/arm64
+  - linux/amd64